www.kaspersky.com Open in urlscan Pro
93.159.228.40 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.kaspersky.com/blog/extortion-spam/25070/
Submission: On April 10 via api (April 10th 2020, 1:27:28 am UTC) from US

Summary HTTP 89 Redirects Links 48 Behaviour Indicators

Summary

This website contacted 34 IPs in 10 countries across 33 domains to perform 89 HTTP transactions. The main IP is 93.159.228.40, located in Russian Federation and belongs to KL-EXT, RU. The main domain is www.kaspersky.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on March 17th 2020. Valid for: a year.

This is the only time www.kaspersky.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
6	93.159.228.40 93.159.228.40	200107 (KL-EXT) (KL-EXT)
18	2600:9000:21f... 2600:9000:21f3:7800:12:5eb9:fe40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	104.16.92.80 104.16.92.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2600:9000:215... 2600:9000:2156:be00:7:b0d4:2940:93a1	16509 (AMAZON-02) (AMAZON-02)
1	52.218.57.232 52.218.57.232	16509 (AMAZON-02) (AMAZON-02)
1	185.85.15.31 185.85.15.31	200107 (KL-EXT) (KL-EXT)
1	143.204.101.124 143.204.101.124	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:808::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700:10:... 2606:4700:10::6814:15ef	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	52.31.188.35 52.31.188.35	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:820::2003	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f02... 2a03:2880:f02d:e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	2a05:f500:11:... 2a05:f500:11:101::b93f:9001	14413 (LINKEDIN) (LINKEDIN)
1	199.232.53.140 199.232.53.140	54113 (FASTLY) (FASTLY)
1	104.16.224.72 104.16.224.72	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.77.236.71 54.77.236.71	16509 (AMAZON-02) (AMAZON-02)
2	15.188.31.119 15.188.31.119	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
4	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:81d::200e	15169 (GOOGLE) (GOOGLE)
1	104.111.247.111 104.111.247.111	16625 (AKAMAI-AS) (AKAMAI-AS)
1	13.224.194.12 13.224.194.12	16509 (AMAZON-02) (AMAZON-02)
1	143.204.94.29 143.204.94.29	16509 (AMAZON-02) (AMAZON-02)
3 3	104.109.80.223 104.109.80.223	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 3	37.252.173.38 37.252.173.38	29990 (ASN-APPNEX) (ASN-APPNEX)
1	34.250.128.129 34.250.128.129	16509 (AMAZON-02) (AMAZON-02)
1	52.16.109.72 52.16.109.72	16509 (AMAZON-02) (AMAZON-02)
2	185.31.128.128 185.31.128.128	54312 (ROCKETFUEL) (ROCKETFUEL)
1 1	35.227.248.159 35.227.248.159	15169 (GOOGLE) (GOOGLE)
6 9	18.184.247.200 18.184.247.200	16509 (AMAZON-02) (AMAZON-02)
1	147.75.102.200 147.75.102.200	54825 (PACKET) (PACKET)
1 2	216.58.205.230 216.58.205.230	15169 (GOOGLE) (GOOGLE)
1	46.51.196.250 46.51.196.250	16509 (AMAZON-02) (AMAZON-02)
1	185.31.128.129 185.31.128.129	54312 (ROCKETFUEL) (ROCKETFUEL)
89	34

6 93.159.228.40 (Russian Federation)

ASN200107 (KL-EXT, RU)

www.kaspersky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2600:9000:21f3:7800:12:5eb9:fe40:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.kasperskydaily.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.92.80 (United States)

ASN13335 (CLOUDFLARENET, US)

app-sj06.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2600:9000:2156:be00:7:b0d4:2940:93a1 (United States)

ASN16509 (AMAZON-02, US)

media.kasperskydaily.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.218.57.232 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: s3-eu-west-1-r-w.amazonaws.com

analytics-scripts.s3-eu-west-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.85.15.31 (Russian Federation)

ASN200107 (KL-EXT, RU)

media.kaspersky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.101.124 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-101-124.fra50.r.cloudfront.net

d1xnn692s7u6t6.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:808::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:15ef (United States)

ASN13335 (CLOUDFLARENET, US)

rum-static.pingdom.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.31.188.35 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-188-35.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f02d:e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:f500:11:101::b93f:9001 (Ireland)

ASN14413 (LINKEDIN, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.53.140 (Manchester, United Kingdom)

ASN54113 (FASTLY, US)

www.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.224.72 (United States)

ASN13335 (CLOUDFLARENET, US)

hn.algolia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.77.236.71 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-77-236-71.eu-west-1.compute.amazonaws.com

kaspersky.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.188.31.119 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

kaspersky.d3.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.247.111 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-247-111.deploy.static.akamaitechnologies.com

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.194.12 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-194-12.fra2.r.cloudfront.net

vt.myvisualiq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.94.29 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-94-29.fra50.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.109.80.223 (Netherlands) 3 redirects

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-80-223.deploy.static.akamaitechnologies.com

s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.252.173.38 (Ascension Island) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.250.128.129 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-250-128-129.eu-west-1.compute.amazonaws.com

rum-collector-2.pingdom.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.16.109.72 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-109-72.eu-west-1.compute.amazonaws.com

w.usabilla.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.31.128.128 (Netherlands)

ASN54312 (ROCKETFUEL, US)

a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.248.159 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 159.248.227.35.bc.googleusercontent.com

tapestry.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 18.184.247.200 (Frankfurt am Main, Germany) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-184-247-200.eu-central-1.compute.amazonaws.com

t.myvisualiq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.102.200 (Central, Hong Kong)

ASN54825 (PACKET, US)

loadus.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.205.230 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s24-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.51.196.250 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-46-51-196-250.eu-west-1.compute.amazonaws.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.31.128.129 (Netherlands)

ASN54312 (ROCKETFUEL, US)

20730592p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	kasperskydaily.com assets.kasperskydaily.com media.kasperskydaily.com	1 MB
10	myvisualiq.net 6 redirects vt.myvisualiq.net t.myvisualiq.net	9 KB
7	kaspersky.com www.kaspersky.com media.kaspersky.com	121 KB
5	facebook.com graph.facebook.com www.facebook.com	999 B
4	demdex.net 1 redirects dpm.demdex.net kaspersky.demdex.net	3 KB
4	facebook.net connect.facebook.net	256 KB
3	rfihub.com a.rfihub.com 20730592p.rfihub.com	685 B
3	adnxs.com 2 redirects ib.adnxs.com	3 KB
3	tribalfusion.com 3 redirects s.tribalfusion.com a.tribalfusion.com	1 KB
3	google.com www.google.com	541 B
2	doubleclick.net 1 redirects ad.doubleclick.net	960 B
2	adsrvr.org js.adsrvr.org insight.adsrvr.org	2 KB
2	google-analytics.com www.google-analytics.com	36 KB
2	omtrdc.net kaspersky.d3.sc.omtrdc.net	542 B
2	pingdom.net rum-static.pingdom.net rum-collector-2.pingdom.net	3 KB
2	googletagmanager.com www.googletagmanager.com	113 KB
1	exelator.com loadus.exelator.com	124 B
1	tapad.com 1 redirects tapestry.tapad.com	488 B
1	usabilla.com w.usabilla.com	13 KB
1	rfihub.net c1.rfihub.net	7 KB
1	everesttech.net 1 redirects cm.everesttech.net	554 B
1	algolia.com hn.algolia.com	1009 B
1	reddit.com www.reddit.com	1 KB
1	linkedin.com www.linkedin.com
1	gstatic.com www.gstatic.com	92 KB
1	cloudfront.net d1xnn692s7u6t6.cloudfront.net	5 KB
1	amazonaws.com analytics-scripts.s3-eu-west-1.amazonaws.com	7 KB
1	marketo.com app-sj06.marketo.com	58 KB
0	contentsquare.net Failed t.contentsquare.net Failed
0	xg4ken.com Failed resources.xg4ken.com Failed
0	bing.com Failed bat.bing.com Failed
0	google.de Failed www.google.de Failed
0	licdn.com Failed snap.licdn.com Failed
89	33

	Domain	Requested by
18	assets.kasperskydaily.com	www.kaspersky.com app-sj06.marketo.com
12	media.kasperskydaily.com	www.kaspersky.com
9	t.myvisualiq.net	6 redirects
6	www.kaspersky.com	www.kaspersky.com
4	www.facebook.com	www.kaspersky.com connect.facebook.net
4	connect.facebook.net	www.kaspersky.com connect.facebook.net
3	ib.adnxs.com	2 redirects
3	dpm.demdex.net	1 redirects media.kaspersky.com www.kaspersky.com
3	www.google.com	www.kaspersky.com www.gstatic.com
2	ad.doubleclick.net	1 redirects
2	a.rfihub.com	c1.rfihub.net
2	s.tribalfusion.com	2 redirects
2	www.google-analytics.com	www.googletagmanager.com
2	kaspersky.d3.sc.omtrdc.net	media.kaspersky.com www.kaspersky.com
2	www.googletagmanager.com	www.kaspersky.com www.googletagmanager.com
1	20730592p.rfihub.com	c1.rfihub.net
1	insight.adsrvr.org	js.adsrvr.org
1	loadus.exelator.com
1	tapestry.tapad.com	1 redirects
1	w.usabilla.com	www.kaspersky.com
1	rum-collector-2.pingdom.net	rum-static.pingdom.net
1	a.tribalfusion.com	1 redirects
1	js.adsrvr.org	www.googletagmanager.com
1	vt.myvisualiq.net	www.googletagmanager.com
1	c1.rfihub.net	www.kaspersky.com
1	cm.everesttech.net	1 redirects
1	kaspersky.demdex.net	media.kaspersky.com
1	hn.algolia.com	www.kaspersky.com
1	www.reddit.com	www.kaspersky.com
1	www.linkedin.com	www.kaspersky.com
1	graph.facebook.com	www.kaspersky.com
1	www.gstatic.com	www.google.com
1	rum-static.pingdom.net	www.kaspersky.com
1	d1xnn692s7u6t6.cloudfront.net	www.kaspersky.com
1	media.kaspersky.com	www.kaspersky.com
1	analytics-scripts.s3-eu-west-1.amazonaws.com	www.kaspersky.com
1	app-sj06.marketo.com	www.kaspersky.com
0	t.contentsquare.net Failed	www.kaspersky.com
0	resources.xg4ken.com Failed	www.kaspersky.com
0	bat.bing.com Failed	www.kaspersky.com
0	www.google.de Failed	www.kaspersky.com
0	snap.licdn.com Failed	www.googletagmanager.com
89	42

This site contains links to these domains. Also see Links.

Domain
my.kaspersky.com
app.appsflyer.com
support.kaspersky.com
wwww.kaspersky.com
companyaccount.kaspersky.com
www.kasperskypartners.com
media.kasperskydaily.com
www.wired.com
www.bleepstatic.com
www.zdnet.com
www.bleepingcomputer.com
securelist.com
threatpost.com
eugene.kaspersky.com
facebook.com
twitter.com
www.linkedin.com
youtube.com
www.kaspersky.com.br
latam.kaspersky.com
usa.kaspersky.com
www.kaspersky.co.za
me-en.kaspersky.com
me.kaspersky.com
www.kaspersky.de
www.kaspersky.es
www.kaspersky.fr
www.kaspersky.it
www.kaspersky.nl
www.kaspersky.co.uk
plblog.kaspersky.com
www.kaspersky.com.tr
www.kaspersky.ru
blog.kaspersky.kz
www.kaspersky.com.au
www.kaspersky.co.in
www.kaspersky.com.cn
blog.kaspersky.co.jp

Subject Issuer	Validity	Valid
www.kaspersky.com DigiCert SHA2 Secure Server CA	`2020-03-17` - `2021-03-22`	a year	crt.sh
media.kasperskydaily.com Amazon	`2019-06-28` - `2020-07-28`	a year	crt.sh
app-sj06.marketo.com CloudFlare Inc ECC CA-2	`2020-01-22` - `2020-10-09`	9 months	crt.sh
*.s3-eu-west-1.amazonaws.com DigiCert Baltimore CA-2 G2	`2019-11-09` - `2020-12-10`	a year	crt.sh
media.kaspersky.com Thawte RSA CA 2018	`2019-06-11` - `2020-06-10`	a year	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-03-24` - `2020-06-16`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-03-24` - `2020-06-16`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-03-01` - `2020-05-30`	3 months	crt.sh
*.pingdom.net DigiCert SHA2 High Assurance Server CA	`2019-11-08` - `2021-01-19`	a year	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
*.gstatic.com GTS CA 1O1	`2020-03-24` - `2020-06-16`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2020-03-09` - `2020-09-09`	6 months	crt.sh
*.reddit.com DigiCert SHA2 Secure Server CA	`2020-04-06` - `2020-10-03`	6 months	crt.sh
algolia.com CloudFlare Inc ECC CA-2	`2019-12-17` - `2020-10-09`	10 months	crt.sh
*.d3.sc.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2020-02-28` - `2022-03-04`	2 years	crt.sh
*.rfihub.net DigiCert SHA2 Secure Server CA	`2020-04-01` - `2021-07-01`	a year	crt.sh
*.myvisualiq.net Amazon	`2019-11-14` - `2020-12-14`	a year	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
w.usabilla.com Amazon	`2020-04-10` - `2021-05-10`	a year	crt.sh
*.rfihub.com DigiCert SHA2 Secure Server CA	`2019-08-27` - `2020-08-31`	a year	crt.sh
t.myvisualiq.net COMODO RSA Domain Validation Secure Server CA	`2017-07-05` - `2020-07-28`	3 years	crt.sh
*.exelator.com Go Daddy Secure Certificate Authority - G2	`2019-05-17` - `2021-06-25`	2 years	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-03-24` - `2020-06-16`	3 months	crt.sh

This page contains 8 frames:

Primary Page: https://www.kaspersky.com/blog/extortion-spam/25070/
Frame ID: 9B1BDF536B33499B0CF4FC1F0496710A
Requests: 82 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld65SMUAAAAAGvFXOFt8IDAf7lVwkl3i9yxLTtx&co=aHR0cHM6Ly93d3cua2FzcGVyc2t5LmNvbTo0NDM.&hl=en&v=NjSCg_IbX1Pdc6A9cf-rvw4e&theme=light&size=normal&cb=mrf1cjb8u0v5
Frame ID: 212AB196764EA58FBC0EC0E69F366BA8
Requests: 1 HTTP requests in this frame

Frame: https://kaspersky.demdex.net/dest5.html?d_nsid=0
Frame ID: BA6D9F3A260D3C0BB67912D0CB0B3FB8
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=NjSCg_IbX1Pdc6A9cf-rvw4e&k=6Ld65SMUAAAAAGvFXOFt8IDAf7lVwkl3i9yxLTtx&cb=n8isavuz1f7m
Frame ID: DA29E01EAD904F046206A19E9A08852E
Requests: 1 HTTP requests in this frame

Frame: https://w.usabilla.com/1649d5fbb67c.js?lv=1
Frame ID: 144B6E8A0DE6F0AB0A0E8260382666CE
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=3flza28&ref=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&upid=5jbt2zb&upv=1.1.0
Frame ID: B3CC0F0E1139F1E3E25706A08F5608E4
Requests: 1 HTTP requests in this frame

Frame: https://20730592p.rfihub.com/ca.html?rfiidc=1041527797682395166&rfiaid=8672439cbc514270a95c7f210e7285c1&ver=9&rb=20707&ca=20730592&pe=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&pf=&ra=19019400296301892
Frame ID: AB40E89E3FB598E809E00092248C8E40
Requests: 1 HTTP requests in this frame

Frame: https://a.rfihub.com/pstats.html?rb=20707&ca=20730592&ri=9a741326e8ad0b6593e47780f65f3957&rfiidc=1041527797682395166&rfiaid=8672439cbc514270a95c7f210e7285c1&stats=%7B%2213488%22%3A%22119%2C1%22%2C%2217243%22%3A%2289%2C1%22%2C%2254651%22%3A%2277%2C2%22%2C%2254863%22%3A%22270%2C1%22%2C%2257363%22%3A%22198%2C1%22%2C%2257895%22%3A%22217%2C1%22%2C%2258143%22%3A%22103%2C2%22%2C%2258553%22%3A%22977%2C2%22%2C%2258561%22%3A%22477%2C2%22%7D&ra=2759578026400782
Frame ID: E7CC06A3CFB232F2C6C8192FF6B79DC9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

89
Requests

91 %
HTTPS

31 %
IPv6

33
Domains

42
Subdomains

34
IPs

10
Countries

2068 kB
Transfer

4570 kB
Size

11
Cookies

48 Outgoing links

These are links going to different origins than the main page.

URL: https://my.kaspersky.com/
Title: My Kaspersky

Search URL Search Domain Scan URL

URL: https://my.kaspersky.com/MyDevices?redef=1&THRU&reseller=gl_kdailyheader_acq_ona_smm__onl_b2c_kasperskydaily_prodmen_______
Title: My Devices

Search URL Search Domain Scan URL

URL: https://my.kaspersky.com/MyLicenses?redef=1&THRU&reseller=gl_kdailyheader_acq_ona_smm__onl_b2c_kasperskydaily_prodmen_______
Title: My Products / Subscriptions

Search URL Search Domain Scan URL

URL: https://my.kaspersky.com/MyAccount?redef=1&THRU&reseller=gl_kdailyheader_acq_ona_smm__onl_b2c_kasperskydaily_prodmen_______#ordersHistory
Title: My Orders

Search URL Search Domain Scan URL

URL: https://app.appsflyer.com/com.kms.free?pid=smm&c=ww_kdaily
Title: Download

Search URL Search Domain Scan URL

URL: https://support.kaspersky.com/?redef=1&THRU&reseller=gl_kdailyheader_acq_ona_smm__onl_b2c_kasperskydaily_prodmen_______
Title: Support

Search URL Search Domain Scan URL

URL: https://wwww.kaspersky.com/blog/
Title: Blog

Search URL Search Domain Scan URL

URL: https://my.kaspersky.com/?redef=1&THRU&reseller=gl_kdailyheader_acq_ona_smm__onl_b2c_kasperskydaily_prodmen_______
Title: My Kaspersky

Search URL Search Domain Scan URL

URL: https://my.kaspersky.com/MyAccount/OrdersHistory?redef=1&THRU&reseller=gl_kdailyheader_acq_ona_smm__onl_b2c_kasperskydaily_prodmen_______
Title: My Orders

Search URL Search Domain Scan URL

URL: https://support.kaspersky.com/?redef=1&THRU&reseller=gl_kdailyheader_acq_ona_smm__onl_b2b_kasperskydaily_prodmen_______
Title: Support

Search URL Search Domain Scan URL

URL: https://my.kaspersky.com/?redef=1&THRU&reseller=gl_kdailyheader_acq_ona_smm__onl_b2b_kasperskydaily_prodmen_______
Title: My Kaspersky

Search URL Search Domain Scan URL

URL: https://my.kaspersky.com/MyDevices?redef=1&THRU&reseller=gl_kdailyheader_acq_ona_smm__onl_b2b_kasperskydaily_prodmen_______
Title: My Devices

Search URL Search Domain Scan URL

URL: https://my.kaspersky.com/MyLicenses?redef=1&THRU&reseller=gl_kdailyheader_acq_ona_smm__onl_b2b_kasperskydaily_prodmen_______
Title: My Products / Subscriptions

Search URL Search Domain Scan URL

URL: https://my.kaspersky.com/MyAccount?redef=1&THRU&reseller=gl_kdailyheader_acq_ona_smm__onl_b2b_kasperskydaily_prodmen_______#ordersHistory
Title: My Orders

Search URL Search Domain Scan URL

URL: https://companyaccount.kaspersky.com/advert/?redef=1&THRU&reseller=gl_kdailyheader_acq_ona_smm__onl_b2b_kasperskydaily_prodmen_______
Title: CompanyAccount

Search URL Search Domain Scan URL

URL: https://www.kasperskypartners.com/?eid=global&lang=en-gb
Title: Find a Partner

Search URL Search Domain Scan URL

URL: https://media.kasperskydaily.com/wp-content/uploads/sites/92/2018/12/20095436/extortion-scam-letter-EN.png

Search URL Search Domain Scan URL

URL: https://www.wired.com/story/how-email-open-tracking-quietly-took-over-the-web/
Title: tracking pixel

Search URL Search Domain Scan URL

URL: https://www.bleepstatic.com/images/news/security/e/extortion-scams/adult-site-scam/email-scam.jpg
Title: existence of a compromising video

Search URL Search Domain Scan URL

URL: https://www.zdnet.com/article/those-annoying-sextortion-scams-are-redirecting-users-to-ransomware-now/
Title: offering victims to personally verify the existence of an embarrassing video

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-distributed-by-exploit-kits-appends-gdcb-extension/
Title: GandCrab malware

Search URL Search Domain Scan URL

URL: https://securelist.com/
Title: Securelist

Search URL Search Domain Scan URL

URL: https://threatpost.com/
Title: Threatpost

Search URL Search Domain Scan URL

URL: https://eugene.kaspersky.com/
Title: Eugene Personal Blog

Search URL Search Domain Scan URL

URL: https://facebook.com/Kaspersky

Search URL Search Domain Scan URL

URL: https://twitter.com/Kaspersky

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/kaspersky-lab

Search URL Search Domain Scan URL

URL: https://youtube.com/Kaspersky

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com.br/blog/
Title: Brasil

Search URL Search Domain Scan URL

URL: https://latam.kaspersky.com/blog
Title: México

Search URL Search Domain Scan URL

URL: https://usa.kaspersky.com/blog/
Title: United States

Search URL Search Domain Scan URL

URL: https://www.kaspersky.co.za/blog/
Title: South Africa

Search URL Search Domain Scan URL

URL: https://me-en.kaspersky.com/blog/
Title: Middle East

Search URL Search Domain Scan URL

URL: https://me.kaspersky.com/blog/
Title: الشرق الأوسط

Search URL Search Domain Scan URL

URL: https://www.kaspersky.de/blog/
Title: Deutschland & Schweiz

Search URL Search Domain Scan URL

URL: https://www.kaspersky.es/blog/
Title: España

Search URL Search Domain Scan URL

URL: https://www.kaspersky.fr/blog/
Title: France & Suisse

Search URL Search Domain Scan URL

URL: https://www.kaspersky.it/blog/
Title: Italia & Svizzera

Search URL Search Domain Scan URL

URL: https://www.kaspersky.nl/blog
Title: Nederland & België

Search URL Search Domain Scan URL

URL: https://www.kaspersky.co.uk/blog/
Title: United Kingdom

Search URL Search Domain Scan URL

URL: https://plblog.kaspersky.com/
Title: Polska

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com.tr/blog/
Title: Türkiye

Search URL Search Domain Scan URL

URL: https://www.kaspersky.ru/blog/
Title: Россия (Russia)

Search URL Search Domain Scan URL

URL: https://blog.kaspersky.kz/
Title: Kazakhstan

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com.au/blog/
Title: Australia

Search URL Search Domain Scan URL

URL: https://www.kaspersky.co.in/blog
Title: India

Search URL Search Domain Scan URL

URL: https://www.kaspersky.com.cn/blog
Title: 中国 (China)

Search URL Search Domain Scan URL

URL: https://blog.kaspersky.co.jp/
Title: 日本 (Japan)

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 55

https://cm.everesttech.net/cm/dd?d_uuid=02720183112897171970556832903836748002 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xo-LYgAAAdQsHy3-

Request Chain 60

https://www.google-analytics.com/r/collect?v=1&_v=j81&aip=1&a=593664384&t=pageview&_s=1&dl=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&ul=en-us&de=UTF-8&dt=Blackmail%20demand%20claims%20to%20have%20nailed%20you%20watching%20porn%20%7C%20Kaspersky%20official%20blog&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAEAB~&jid=1175750096&gjid=204595666&cid=524137618.1586482018&tid=UA-35676203-1&_gid=61111889.1586482018&_r=1&gtm=2wg432K974KNN&cd1=Leonid%20Grustniy&cd2=25070&cd3=2018-12-21&cd4=Threats%2C%20Tips&cd5=%23tips%2C%20extortion%2C%20fraud%2C%20porn%2C%20Ransomware%2C%20spam%2C%20threats&cd6=fraud&cd7=&z=1104841794 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-1&cid=524137618.1586482018&jid=1175750096&_gid=61111889.1586482018&gjid=204595666&_v=j81&z=1104841794 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-1&cid=524137618.1586482018&jid=1175750096&_v=j81&z=1104841794

Request Chain 72

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=593664384&t=pageview&_s=1&dl=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&dp=%2Fblog%2Fextortion-spam%2F25070%2F&ul=en-us&de=UTF-8&dt=Kaspersky%20Daily%20Blog%20%3E%20Extortion%20Spam&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aEDAAEAB~&jid=60065817&gjid=1076001747&cid=524137618.1586482018&uid=09808024118675987430711746025338300088&tid=UA-63997723-28&_gid=61111889.1586482018&_r=1&gtm=2wg432WZ7LJ3&cd6=&cd7=&cd8=&cd9=&cd13=&cd14=en_IE&cd15=09808024118675987430711746025338300088&cd17=Kaspersky%20Daily%20Blog%20%3E%20Extortion%20Spam&cd18=Kaspersky%20Daily%20Blog&cd23=Default&cd37=0&cd40=0&cd16=524137618.1586482018&z=1344668619 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-63997723-28&cid=524137618.1586482018&jid=60065817&uid=09808024118675987430711746025338300088&_gid=61111889.1586482018&gjid=1076001747&_v=j81&z=1344668619 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63997723-28&cid=524137618.1586482018&jid=60065817&_v=j81&z=1344668619

Request Chain 73

https://s.tribalfusion.com/i.cid?c=705083&ev=0&page=Global HTTP 302
https://s.tribalfusion.com/z/i.cid?c=705083&ev=0&page=Global HTTP 302
https://ib.adnxs.com/getuidu?https://a.tribalfusion.com/i.match?p=b26&u=$UID&redirect=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D305%26code%3D%24TF_USER_ID_ENC%24 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuidu%3Fhttps%3A%2F%2Fa.tribalfusion.com%2Fi.match%3Fp%3Db26%26u%3D%24UID%26redirect%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D305%2526code%253D%2524TF_USER_ID_ENC%2524 HTTP 302
https://a.tribalfusion.com/i.match?p=b26&u=1692248615869220997&redirect=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D305%26code%3D%24TF_USER_ID_ENC%24 HTTP 302
https://ib.adnxs.com/setuid?entity=305&code=18072662245400444836

Request Chain 79

https://tapestry.tapad.com/tapestry/1?ta_partner_id=950&ta_redirect=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3D1001%26ao%3D0%26pruuid%3DTAPAD_%24%7BIDS%3Akey%7D HTTP 302
https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_5f50e161-7aca-11ea-b04f-4e3e1dc0b01b

Request Chain 80

https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&red=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D125310%26dpuuid%3D%24%7BUUID%7D%26redir%3Dhttps%253A%252F%252Ft.myvisualiq.net%252Fsync%253Fprid%253DAOEPNR1%2526ao%253D0%2526pruuid%253D%2524%257BDD_UUID%257D%250A HTTP 302
https://t.myvisualiq.net/ul_cb/sync?prid=AOEPNR1&ao=0&red=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D125310%26dpuuid%3D%24%7BUUID%7D%26redir%3Dhttps%253A%252F%252Ft.myvisualiq.net%252Fsync%253Fprid%253DAOEPNR1%2526ao%253D0%2526pruuid%253D%2524%257BDD_UUID%257D%250A HTTP 302
https://dpm.demdex.net/ibs:dpid=125310&dpuuid=d5b19529-69bb-468d-a13b-d343cc6a4d57&redir=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3DAOEPNR1%26ao%3D0%26pruuid%3D%24%7BDD_UUID%7D HTTP 302
https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=02720183112897171970556832903836748002

Request Chain 81

https://t.myvisualiq.net/sync?prid=EEAEPNR1&red=https%3A%2F%2Floadus.exelator.com%2Fload%2F%3Fp%3D204%26g%3D1260%26buid%3D%24%7BUUID%7D HTTP 302
https://t.myvisualiq.net/ul_cb/sync?prid=EEAEPNR1&red=https%3A%2F%2Floadus.exelator.com%2Fload%2F%3Fp%3D204%26g%3D1260%26buid%3D%24%7BUUID%7D HTTP 302
https://loadus.exelator.com/load/?p=204&g=1260&buid=d5b19529-69bb-468d-a13b-d343cc6a4d57

Request Chain 82

https://t.myvisualiq.net/sync?prid=Test&ao=0&red=https%253A%252F%252Fad.doubleclick.net%252Fddm%252Ftrackimp%252FN408002.2426714VISUALIQ%252FB10122619.135787232%253Bdc_trk_aid%253D308320322%253Bdc_trk_cid%253D72964178%253Bsz%253D1x1%253Bu%253D-https%25253A%25252F%25252Fwww.kaspersky.com%25252Fblog%25252Fextortion-spam%25252F25070%25252F%7CVIQ_%24%7BUUID%7D%7C%3Bord%3D5513887 HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N408002.2426714VISUALIQ/B10122619.135787232;dc_trk_aid=308320322;dc_trk_cid=72964178;sz=1x1;u=-https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F%7CVIQ_0-fbf5e39b-a178-4434-a30b-3882a92a85ee%7C;ord=5513887 HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N408002.2426714VISUALIQ/B10122619.135787232;dc_pre=CNWvv4na3OgCFUnzdwodjGwHlQ;dc_trk_aid=308320322;dc_trk_cid=72964178;sz=1x1;u=-https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F%7CVIQ_0-fbf5e39b-a178-4434-a30b-3882a92a85ee%7C;ord=5513887

Request Chain 84

https://t.myvisualiq.net/sync?prid=123&ao=0&red=https%3A%2F%2Fwww.facebook.com%2Ftr%3Fid%3D238727726635232%26ev%3DPageView%26cd%5Border_id%5D%3D%24%7BUUID%7D HTTP 302
https://www.facebook.com/tr?id=238727726635232&ev=PageView&cd[order_id]=0-3c7fbd01-4e58-4731-a475-029b05cac7fa

89 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.kaspersky.com/blog/extortion-spam/25070/ 111 KB
27 KB 1834ms
1584ms Document
text/html 93.159.228.40
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

93.159.228.40 , Russian Federation, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

nginx /

Resource Hash

75aab9b1224ca3e0d274390ce354092d249f982512069b2b4a2be69b93d7daf1

Security Headers

Name	Value
Content-Security-Policy	connect-src 'self' https://.3gl.net https://.abmr.net https://.demdex.net https://.everesttech.net https://.facebook.com https://.facebook.net https://.google-analytics.com https://.google.com https://.infogram.com https://.kaspersky.com https://.mail.ru https://.marketlinc.com https://.maxymiser.net https://.mktoresp.com https://.omtrdc.net https://.optimizely.com https://.pingdom.net https://.reddit.com https://.veinteractive.com https://.yandex.ru https://.youtube.com https://cdn.securelist.com https://hn.algolia.com https://kaspersky.admo.tv:9999 https://maxymiser.net https://media.kasperskydaily.com https://privacy.kaspersky.com https://tagmanager.google.com https://www.kaspersky.com/blog https://www.opinionstage.com https://www.riddle.com https://www.tag4arm.com wss://kaspersky.admo.tv:9999; default-src 'self' https://.kaspersky.com https://.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://www.kaspersky.com/blog https://www.riddle.com; font-src 'self' data: https://.cloudfront.net https://.gstatic.com https://.kaspersky.com https://.maxymiser.net https://.slideshare.net https://.slidesharecdn.com https://.wp.com https://assets.kasperskydaily.com https://cdn.securelist.com https://fonts.googleapis.com https://fonts.gstatic.com https://maxymiser.net https://media.kasperskydaily.com https://www.kaspersky.com/blog https://www.riddle.com; frame-ancestors 'self' http://webvisor.com https://.kaspersky.com https://.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://webvisor.com https://www.kaspersky.com/blog https://www.riddle.com; frame-src 'self' http://www.tiki-toki.com https://.addthis.com https://.adsrvr.org https://.ampproject.net https://.doubleclick.net https://.facebook.com https://.facebook.net https://.google.com https://.infogram.com https://.instagram.com https://.kaspersky.com https://.libsyn.com https://.marketo.com https://.maxymiser.net https://.owneriq.net https://.rfihub.com https://.sharethis.com https://.slideshare.net https://.soundcloud.com https://.twitter.com https://.usabilla.com https://.veinteractive.com https://.wp.com https://.youtube.com https://amuselabs.com https://cdn.knightlab.com https://cdn.securelist.com https://cyberstat.kaspersky.com https://d6tizftlrpuof.cloudfront.net https://infogram.com https://kaspersky.berkeleypr.com https://kaspersky.demdex.net https://maxymiser.net https://media.kasperskydaily.com https://pixel.mathtag.com https://player.vimeo.com https://s-static.ak.facebook.com https://servedby.flashtalking.com https://tagmanager.google.com https://view.genial.ly https://www.brighttalk.com https://www.kaspersky.com https://www.kaspersky.com/blog https://www.opinionstage.com https://www.riddle.com; img-src 'self' data: http://.cloudfront.net http://.imgix.net http://.ipinyou.com http://.netdna-cdn.com http://.wordpress.com http://.wp.com http://i0.poll.fm https://.addthis.com https://.admixer.net https://.adnxs.com https://.adriver.ru https://.advertising.com https://.behe.com https://.betweendigital.com https://.bidswitch.net https://.bing.com https://.btrll.com https://.casalemedia.com https://.cloudfront.net https://.crwdcntrl.net https://.demdex.net https://.digitaltarget.ru https://.dotomi.com https://.doubleclick.net https://.everesttech.net https://.exelator.com https://.eyeota.net https://.facebook.com https://.google-analytics.com https://.google.com https://.gravatar.com https://.gstatic.com https://.imgix.net https://.infogram.com https://.instagram.com https://.ipinyou.com https://.kaspersky.com https://.marketgid.com https://.mathtag.com https://.maxymiser.net https://.myvisualiq.net https://.netdna-cdn.com https://.omtrdc.net https://.openx.net https://.owneriq.net https://.postrelease.com https://.pubmatic.com https://.qq.com https://.rubiconproject.com https://.rutarget.ru https://.sharethis.com https://.staticflickr.com https://.stickyadstv.com https://.tanx.com https://.tapad.com https://.tradelab.fr https://.tribalfusion.com https://.twimg.com https://.twitter.com https://.undertone.com https://.v12group.com https://.veinteractive.com https://.w55c.net https://.wordpress.com https://.wp.com https://.yahoo.co.jp https://.yandex.ru https://.yieldlab.net https://.youku.com https://ad.mail.ru https://addevent.com https://adm.shinobi.jp https://adsearch.adkontekst.pl https://assets.kasperskydaily.com https://bh.contextweb.com https://cdn.securelist.com https://ckm.aty.sohu.com https://cm.fastapi.net https://cm.pos.baidu.com https://cm.qtmojo.com https://csi.gstatic.com https://exelatesync.extend.tv https://geo.yahoo.com https://images.telechargement.fr https://img.youtube.com https://inpagevideo.nl https://instagramimages-a.akamaihd.net https://kaspersky.d2.sc.omtrdc.net https://kasperskycontenthub.com https://m.addthis.com https://m.one.impact-ad.jp https://maps.googleapis.com https://maxymiser.net https://media.kasperskydaily.com https://pixel.quantserve.com https://pixel.s3xified.com https://player.vimeo.com https://polldaddy.com https://privacy.kaspersky.com https://rum-collector.pingdom.net https://s.w.org https://s3.amazonaws.com https://scontent.cdninstagram.com https://ssl.socdm.com https://stats.g.doubleclick.net https://stats.seedr.com https://t.co https://tagmanager.google.com https://track.addevent.com https://ums.adtech.de https://vmg.host https://www.emjcd.com https://www.google.hr https://www.kaspersky.com/blog https://www.riddle.com https://www.tag4arm.com; media-src 'self' https://.kaspersky.com https://.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://www.kaspersky.com/blog https://www.riddle.com; object-src 'self' https://.kaspersky.com https://.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://player.vimeo.com https://polldaddy.com https://www.kaspersky.com/blog https://www.riddle.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.3gl.net https://.addevent.com https://.addthis.com https://.adnxs.com https://.adsrvr.org https://.airpr.com https://.ampproject.org https://.bazaarvoice.com https://.behe.com https://.bizographics.com https://.cloudfront.net https://.crazyegg.com https://.demdex.net https://.doubleclick.net https://.facebook.com https://.facebook.net https://.flickr.com https://.google-analytics.com https://.google.com https://.googleapis.com https://.gravatar.com https://.gstatic.com https://.infogram.com https://.instagram.com https://.ipinyou.com https://.kaspersky.com https://.mail.ru https://.marketlinc.com https://.marketo.com https://.marketo.net https://.mathtag.com https://.maxymiser.net https://.myvisualiq.net https://.optimizely.com https://.owneriq.net https://.polldaddy.com https://.quantserve.com https://.rfihub.com https://.rfihub.net https://.rutarget.ru https://.salesforceliveagent.com https://.sharethis.com https://.twimg.com https://.twitter.com https://.usabilla.com https://.veinteractive.com https://.volvelle.tech https://.woopra.com https://.wp.com https://.yahoo.co.jp https://.yandex.ru https://.yimg.com https://.yimg.jp https://adcdn.goo.ne.jp https://addthisevent.com https://analytics-scripts.s3-eu-west-1.amazonaws.com https://assets.adobedtm.com https://assets.kasperskydaily.com https://bwb101.goo.ne.jp https://cdn.onesignal.com https://cdn.securelist.com https://cdn.tradelab.fr https://cdn.trmit.com https://connect.facebook.net https://connect.mail.ru https://d6tizftlrpuof.cloudfront.net https://external-assets.loyaltybay.co.uk https://kaspersky.admo.tv https://kaspersky.berkeleypr.com https://kaspersky.d2.sc.omtrdc.net https://m.addthis.com https://m.addthisedge.com https://maxymiser.net https://media.kasperskydaily.com https://munchkin.marketo.net https://player.vimeo.com https://rum-static.pingdom.net https://s3.amazonaws.com https://share.yandex.ru/ https://sp.analytics.yahoo.com https://static.ads-twitter.com https://tagmanager.google.com https://vk.com https://www.addevent.com https://www.brighttalk.com https://www.flickr.com https://www.glancecdn.net https://www.googleadservices.com https://www.googletagmanager.com https://www.kaspersky.com/blog https://www.linkedin.com https://www.opinionstage.com https://www.riddle.com https://www.tag4arm.com https://yastatic.net; style-src 'self' 'unsafe-inline' https://.cloudfront.net https://.googleapis.com https://.gravatar.com https://.kaspersky.com https://.marketo.com https://.maxymiser.net https://.securelist.com https://.sharethis.com https://.twimg.com https://.twitter.com https://.wp.com https://assets.kasperskydaily.com https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://tagmanager.google.com https://www.kaspersky.com/blog https://www.riddle.com; worker-src 'self' blob: data: file: filesystem: https://.kaspersky.com https://*.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://www.kaspersky.com/blog https://www.riddle.com unsafe-eval unsafe-inline
Strict-Transport-Security	max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.kaspersky.com
:scheme: https
:path: /blog/extortion-spam/25070/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
server: nginx
date: Fri, 10 Apr 2020 01:26:54 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
content-security-policy: connect-src 'self' https://*.3gl.net https://*.abmr.net https://*.demdex.net https://*.everesttech.net https://*.facebook.com https://*.facebook.net https://*.google-analytics.com https://*.google.com https://*.infogram.com https://*.kaspersky.com https://*.mail.ru https://*.marketlinc.com https://*.maxymiser.net https://*.mktoresp.com https://*.omtrdc.net https://*.optimizely.com https://*.pingdom.net https://*.reddit.com https://*.veinteractive.com https://*.yandex.ru https://*.youtube.com https://cdn.securelist.com https://hn.algolia.com https://kaspersky.admo.tv:9999 https://maxymiser.net https://media.kasperskydaily.com https://privacy.kaspersky.com https://tagmanager.google.com https://www.kaspersky.com/blog https://www.opinionstage.com https://www.riddle.com https://www.tag4arm.com wss://kaspersky.admo.tv:9999; default-src 'self' https://*.kaspersky.com https://*.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://www.kaspersky.com/blog https://www.riddle.com; font-src 'self' data: https://*.cloudfront.net https://*.gstatic.com https://*.kaspersky.com https://*.maxymiser.net https://*.slideshare.net https://*.slidesharecdn.com https://*.wp.com https://assets.kasperskydaily.com https://cdn.securelist.com https://fonts.googleapis.com https://fonts.gstatic.com https://maxymiser.net https://media.kasperskydaily.com https://www.kaspersky.com/blog https://www.riddle.com; frame-ancestors 'self' http://webvisor.com https://*.kaspersky.com https://*.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://webvisor.com https://www.kaspersky.com/blog https://www.riddle.com; frame-src 'self' http://www.tiki-toki.com https://*.addthis.com https://*.adsrvr.org https://*.ampproject.net https://*.doubleclick.net https://*.facebook.com https://*.facebook.net https://*.google.com https://*.infogram.com https://*.instagram.com https://*.kaspersky.com https://*.libsyn.com https://*.marketo.com https://*.maxymiser.net https://*.owneriq.net https://*.rfihub.com https://*.sharethis.com https://*.slideshare.net https://*.soundcloud.com https://*.twitter.com https://*.usabilla.com https://*.veinteractive.com https://*.wp.com https://*.youtube.com https://amuselabs.com https://cdn.knightlab.com https://cdn.securelist.com https://cyberstat.kaspersky.com https://d6tizftlrpuof.cloudfront.net https://infogram.com https://kaspersky.berkeleypr.com https://kaspersky.demdex.net https://maxymiser.net https://media.kasperskydaily.com https://pixel.mathtag.com https://player.vimeo.com https://s-static.ak.facebook.com https://servedby.flashtalking.com https://tagmanager.google.com https://view.genial.ly https://www.brighttalk.com https://www.kaspersky.com https://www.kaspersky.com/blog https://www.opinionstage.com https://www.riddle.com; img-src 'self' data: http://*.cloudfront.net http://*.imgix.net http://*.ipinyou.com http://*.netdna-cdn.com http://*.wordpress.com http://*.wp.com http://i0.poll.fm https://*.addthis.com https://*.admixer.net https://*.adnxs.com https://*.adriver.ru https://*.advertising.com https://*.behe.com https://*.betweendigital.com https://*.bidswitch.net https://*.bing.com https://*.btrll.com https://*.casalemedia.com https://*.cloudfront.net https://*.crwdcntrl.net https://*.demdex.net https://*.digitaltarget.ru https://*.dotomi.com https://*.doubleclick.net https://*.everesttech.net https://*.exelator.com https://*.eyeota.net https://*.facebook.com https://*.google-analytics.com https://*.google.com https://*.gravatar.com https://*.gstatic.com https://*.imgix.net https://*.infogram.com https://*.instagram.com https://*.ipinyou.com https://*.kaspersky.com https://*.marketgid.com https://*.mathtag.com https://*.maxymiser.net https://*.myvisualiq.net https://*.netdna-cdn.com https://*.omtrdc.net https://*.openx.net https://*.owneriq.net https://*.postrelease.com https://*.pubmatic.com https://*.qq.com https://*.rubiconproject.com https://*.rutarget.ru https://*.sharethis.com https://*.staticflickr.com https://*.stickyadstv.com https://*.tanx.com https://*.tapad.com https://*.tradelab.fr https://*.tribalfusion.com https://*.twimg.com https://*.twitter.com https://*.undertone.com https://*.v12group.com https://*.veinteractive.com https://*.w55c.net https://*.wordpress.com https://*.wp.com https://*.yahoo.co.jp https://*.yandex.ru https://*.yieldlab.net https://*.youku.com https://ad.mail.ru https://addevent.com https://adm.shinobi.jp https://adsearch.adkontekst.pl https://assets.kasperskydaily.com https://bh.contextweb.com https://cdn.securelist.com https://ckm.aty.sohu.com https://cm.fastapi.net https://cm.pos.baidu.com https://cm.qtmojo.com https://csi.gstatic.com https://exelatesync.extend.tv https://geo.yahoo.com https://images.telechargement.fr https://img.youtube.com https://inpagevideo.nl https://instagramimages-a.akamaihd.net https://kaspersky.d2.sc.omtrdc.net https://kasperskycontenthub.com https://m.addthis.com https://m.one.impact-ad.jp https://maps.googleapis.com https://maxymiser.net https://media.kasperskydaily.com https://pixel.quantserve.com https://pixel.s3xified.com https://player.vimeo.com https://polldaddy.com https://privacy.kaspersky.com https://rum-collector.pingdom.net https://s.w.org https://s3.amazonaws.com https://scontent.cdninstagram.com https://ssl.socdm.com https://stats.g.doubleclick.net https://stats.seedr.com https://t.co https://tagmanager.google.com https://track.addevent.com https://ums.adtech.de https://vmg.host https://www.emjcd.com https://www.google.hr https://www.kaspersky.com/blog https://www.riddle.com https://www.tag4arm.com; media-src 'self' https://*.kaspersky.com https://*.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://www.kaspersky.com/blog https://www.riddle.com; object-src 'self' https://*.kaspersky.com https://*.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://player.vimeo.com https://polldaddy.com https://www.kaspersky.com/blog https://www.riddle.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://*.3gl.net https://*.addevent.com https://*.addthis.com https://*.adnxs.com https://*.adsrvr.org https://*.airpr.com https://*.ampproject.org https://*.bazaarvoice.com https://*.behe.com https://*.bizographics.com https://*.cloudfront.net https://*.crazyegg.com https://*.demdex.net https://*.doubleclick.net https://*.facebook.com https://*.facebook.net https://*.flickr.com https://*.google-analytics.com https://*.google.com https://*.googleapis.com https://*.gravatar.com https://*.gstatic.com https://*.infogram.com https://*.instagram.com https://*.ipinyou.com https://*.kaspersky.com https://*.mail.ru https://*.marketlinc.com https://*.marketo.com https://*.marketo.net https://*.mathtag.com https://*.maxymiser.net https://*.myvisualiq.net https://*.optimizely.com https://*.owneriq.net https://*.polldaddy.com https://*.quantserve.com https://*.rfihub.com https://*.rfihub.net https://*.rutarget.ru https://*.salesforceliveagent.com https://*.sharethis.com https://*.twimg.com https://*.twitter.com https://*.usabilla.com https://*.veinteractive.com https://*.volvelle.tech https://*.woopra.com https://*.wp.com https://*.yahoo.co.jp https://*.yandex.ru https://*.yimg.com https://*.yimg.jp https://adcdn.goo.ne.jp https://addthisevent.com https://analytics-scripts.s3-eu-west-1.amazonaws.com https://assets.adobedtm.com https://assets.kasperskydaily.com https://bwb101.goo.ne.jp https://cdn.onesignal.com https://cdn.securelist.com https://cdn.tradelab.fr https://cdn.trmit.com https://connect.facebook.net https://connect.mail.ru https://d6tizftlrpuof.cloudfront.net https://external-assets.loyaltybay.co.uk https://kaspersky.admo.tv https://kaspersky.berkeleypr.com https://kaspersky.d2.sc.omtrdc.net https://m.addthis.com https://m.addthisedge.com https://maxymiser.net https://media.kasperskydaily.com https://munchkin.marketo.net https://player.vimeo.com https://rum-static.pingdom.net https://s3.amazonaws.com https://share.yandex.ru/ https://sp.analytics.yahoo.com https://static.ads-twitter.com https://tagmanager.google.com https://vk.com https://www.addevent.com https://www.brighttalk.com https://www.flickr.com https://www.glancecdn.net https://www.googleadservices.com https://www.googletagmanager.com https://www.kaspersky.com/blog https://www.linkedin.com https://www.opinionstage.com https://www.riddle.com https://www.tag4arm.com https://yastatic.net; style-src 'self' 'unsafe-inline' https://*.cloudfront.net https://*.googleapis.com https://*.gravatar.com https://*.kaspersky.com https://*.marketo.com https://*.maxymiser.net https://*.securelist.com https://*.sharethis.com https://*.twimg.com https://*.twitter.com https://*.wp.com https://assets.kasperskydaily.com https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://tagmanager.google.com https://www.kaspersky.com/blog https://www.riddle.com; worker-src 'self' blob: data: file: filesystem: https://*.kaspersky.com https://*.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://www.kaspersky.com/blog https://www.riddle.com unsafe-eval unsafe-inline
strict-transport-security: max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
link: <https://www.kaspersky.com/blog/wp-json/>; rel="https://api.w.org/" <https://kas.pr/6nod>; rel=shortlink
x-frame-options: SAMEORIGIN
x-cache-hit: HIT
x-request-id: 240f8522b07cf9124cb154b986dfc4bf
set-cookie: country=BE;Path=/;Max-Age=60;Secure
x-proxy: msk2
content-encoding: gzip

GET
H2 200 /
assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/ 526 KB
61 KB 147ms
10ms Stylesheet
text/css 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

328cf927ec01ed50d7f6c1d5e448bb00fd1111a8c3d1df651647ad602bb2f4bd

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Wed, 08 Apr 2020 14:26:24 GMT
content-encoding: gzip
age: 126032
x-cache: Hit from cloudfront
status: 200
content-length: 61482
last-modified: Wed, 08 Apr 2020 14:26:17 GMT
server: nginx
cache-control: max-age=31557600
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 57d93b321db68494cc6755a0d3fb29cd.cloudfront.net (CloudFront)
x-cache-hit: MISS
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: G3o4IsHamBxE_S_cM4XACZmGRhQxJzKMRObPHZLkxRacxnKWgd29Eg==
expires: Thu, 08 Apr 2021 20:26:24 GMT

GET
H2 200 jquery.js Show response
www.kaspersky.com/blog/wp-includes/js/jquery/ 95 KB
34 KB 1036ms
1035ms Script
application/x-javascript 93.159.228.40
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://www.kaspersky.com/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

93.159.228.40 , Russian Federation, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

nginx /

Resource Hash

1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-proxy: msk2
pragma: public
date: Fri, 10 Apr 2020 01:26:56 GMT
content-encoding: gzip
last-modified: Wed, 18 Dec 2019 22:32:15 GMT
server: nginx
etag: W/"5dfaa8ef-17a69"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=864000, public
strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: d2969154b09a7ff319e5e163966b3ea7
expires: Mon, 20 Apr 2020 01:26:56 GMT

GET
H2 200 / Show response
assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/ 43 KB
15 KB 153ms
16ms Script
application/x-javascript 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/kaspersky-banners/assets/js/script.js,wp-content/plugins/kaspersky-related-posts/assets/js/script.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/plugins/kaspersky-instagram/js/jquery.magnific-popup.min.js,wp-content/plugins/kaspersky-instagram/js/widget.js,wp-content/plugins/kaspersky-social-sharing-daily/assets/js/social-share.js&ver=3550ef68

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

6b7a95fa7dd1512c7ad7e592dbf0e9288c813522c690174eeb6d2ddbb484490b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 08 Apr 2020 14:26:31 GMT
content-encoding: gzip
age: 126025
x-cache: Hit from cloudfront
status: 200
content-length: 14672
last-modified: Wed, 08 Apr 2020 14:26:16 GMT
server: nginx
cache-control: max-age=31557600
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 57d93b321db68494cc6755a0d3fb29cd.cloudfront.net (CloudFront)
x-cache-hit: HIT
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: f0X5Tr0ArR-e5k8UKWk_OrcdhaU0JH8gohBIlpHGFGKkUFqqljmSmA==
expires: Thu, 08 Apr 2021 20:26:25 GMT

GET
H2 200 forms2.min.js Show response
app-sj06.marketo.com/js/forms2/js/ 169 KB
58 KB 269ms
45ms Script
application/x-javascript 104.16.92.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj06.marketo.com/js/forms2/js/forms2.min.js?ver=1.0.1

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.92.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f6e7e0830124ea580b3f0de0da80ba48a45d9df9d7c092af0f47c63ed0692578

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 10 Apr 2020 01:26:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2518
status: 200
strict-transport-security: max-age=63113904
last-modified: Wed, 12 Feb 2020 19:42:36 GMT
server: cloudflare
etag: "3a26b4-2a546-59e662c9ea300"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 5818aebbbf8dedeb-CDG
expires: Fri, 10 Apr 2020 05:26:56 GMT

GET
H2 200 radar.png
media.kasperskydaily.com/wp-content/uploads/sites/92/2019/11/14063741/ 719 B
1 KB 143ms
6ms Image
image/png 2600:9000:2156:be00:7:b0d4:2940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskydaily.com/wp-content/uploads/sites/92/2019/11/14063741/radar.png
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:be00:7:b0d4:2940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a19066fb0c739ce42db02271c4699f9dd598afbbbb1cf76c420cd43970f07788

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Tue, 07 Apr 2020 21:20:15 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
last-modified: Thu, 14 Nov 2019 11:37:42 GMT
server: AmazonS3
age: 187602
etag: "eb0f1399430f93f16baa9877b93b698f"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 719
x-amz-cf-id: o0HwpoO44_Gf0NRF2sN_xttxBGJFovh1Ryf1TdZNg9dfyLxLe9qbWQ==
expires: Fri, 13 Nov 2020 11:37:41 GMT

GET
H2 200 20180717_Leonid.png
media.kasperskydaily.com/wp-content/uploads/sites/92/2018/07/25054814/ 218 KB
219 KB 145ms
9ms Image
image/png 2600:9000:2156:be00:7:b0d4:2940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskydaily.com/wp-content/uploads/sites/92/2018/07/25054814/20180717_Leonid.png
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:be00:7:b0d4:2940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8e88598d2ac6fb99306caed497c8bda5d43f629e709996965ef99353a824ad64

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 26 Mar 2020 14:58:23 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
last-modified: Tue, 29 Oct 2019 19:02:51 GMT
server: AmazonS3
age: 1247314
etag: "44484e9e24e2527ac9cf5b647ae9d44d"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 223370
x-amz-cf-id: DuM1DUTBNfGjeFLmFTD7kGDurmQnJNpMPTp44deB2w89Y-j8K0sMXQ==
expires: Wed, 28 Oct 2020 19:02:49 GMT

GET
H2 200 extortion-scam-letter-EN.png
media.kasperskydaily.com/wp-content/uploads/sites/92/2018/12/20095436/ 95 KB
95 KB 9ms
9ms Image
image/png 2600:9000:2156:be00:7:b0d4:2940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskydaily.com/wp-content/uploads/sites/92/2018/12/20095436/extortion-scam-letter-EN.png
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:be00:7:b0d4:2940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9c9069d168f386b84aa285c5f7e9e3da07d8dbbb3da2f9865316b23ebc8aa80f

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 09 Apr 2020 14:18:06 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
last-modified: Tue, 29 Oct 2019 21:28:55 GMT
server: AmazonS3
age: 40131
etag: "3a063f6de49d68de156050842d541cb5"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 96983
x-amz-cf-id: EMFr3sTO13RW7cNf2xNSrm3GeHjKrGXRrQIpTHvMXrb6fOzf9gglgw==
expires: Wed, 28 Oct 2020 21:28:53 GMT

GET
H2 200 white-15.png
www.kaspersky.com/blog/wp-content/plugins/kaspersky-social-sharing-daily/assets/img/ 439 B
745 B 608ms
608ms Image
image/png 93.159.228.40
KL-EXT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.kaspersky.com/blog/wp-content/plugins/kaspersky-social-sharing-daily/assets/img/white-15.png

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

93.159.228.40 , Russian Federation, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

nginx /

Resource Hash

f449a501d38b9e34f33315a7452ac78d5671e953edba65f22449cc4865815e64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-proxy: msk2
pragma: public
date: Fri, 10 Apr 2020 01:26:57 GMT
last-modified: Wed, 08 Apr 2020 14:26:16 GMT
server: nginx
etag: "5e8ddf08-1b7"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
status: 200
cache-control: max-age=604800, public
accept-ranges: bytes
content-length: 439
x-request-id: 996ef1c6c04b17b371df48572f2503f8
expires: Fri, 17 Apr 2020 01:26:57 GMT

GET
H2 200 pankov-192x192.jpg
media.kasperskydaily.com/wp-content/uploads/2017/06/28191758/ 9 KB
9 KB 7ms
6ms Image
image/jpeg 2600:9000:2156:be00:7:b0d4:2940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskydaily.com/wp-content/uploads/2017/06/28191758/pankov-192x192.jpg
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:be00:7:b0d4:2940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4d0d09a76fa93a58c941db6bd93b90b9b217f4b3d947c6bb9ef2fa9c431fc9d8

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 06 Mar 2020 19:37:20 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
last-modified: Thu, 20 Jun 2019 17:06:23 GMT
server: AmazonS3
age: 2958578
etag: "b770c43eb699a51d461441803eeb8fcb"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 8733
x-amz-cf-id: xZmkFfy9OxILCkxm9-7D9yLQqj5dK8i4xURPj1-uGCONoG911KtGTA==
expires: Thu, 05 Jul 2018 15:05:58 GMT

GET
H2 200 chip.png
media.kasperskydaily.com/wp-content/uploads/sites/92/2019/11/14063826/ 340 B
720 B 13ms
13ms Image
image/png 2600:9000:2156:be00:7:b0d4:2940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskydaily.com/wp-content/uploads/sites/92/2019/11/14063826/chip.png
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:be00:7:b0d4:2940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f11af4e7d816fed074fe73d5f3b4173f221e321947d5e8a27893b818a580f2d8

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 06 Jan 2020 00:59:18 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
last-modified: Thu, 14 Nov 2019 11:38:27 GMT
server: AmazonS3
age: 8209660
etag: "183e9c3a7e36f75d258ef037de9f8589"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 340
x-amz-cf-id: _1HzLL5A4Qm8yZ4-gpXBngQw2gTf6u1Rb_wJtnPAAPzLjXk3SE3q0A==
expires: Fri, 13 Nov 2020 11:38:26 GMT

GET
H2 200 VladislavBiryukov1-192x192.png
media.kasperskydaily.com/wp-content/uploads/2017/06/29161805/ 64 KB
64 KB 8ms
7ms Image
image/png 2600:9000:2156:be00:7:b0d4:2940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskydaily.com/wp-content/uploads/2017/06/29161805/VladislavBiryukov1-192x192.png
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:be00:7:b0d4:2940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3819f3fbc20242c5a896b75e4fd23cdf0e4e1c9e45b7e8d2f6547142c5a7c073

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 28 Mar 2020 22:33:42 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
last-modified: Thu, 20 Jun 2019 17:06:42 GMT
server: AmazonS3
age: 1047196
etag: "54c6765924be08b7f31b95f122954df8"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 65403
x-amz-cf-id: KLn_mFtCk-kxUB7N08MaK1uJT6Hhng0hEAcPMw5vcMG55tPMTGt0-g==
expires: Thu, 05 Jul 2018 14:39:53 GMT

GET
H2 200 serg1.jpg
media.kasperskydaily.com/wp-content/uploads/2017/06/29155849/ 7 KB
8 KB 7ms
6ms Image
image/jpeg 2600:9000:2156:be00:7:b0d4:2940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskydaily.com/wp-content/uploads/2017/06/29155849/serg1.jpg
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:be00:7:b0d4:2940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bcd0e1cccdd332747f39acd1353c48eb5a0c7dc966bb140b3f0396b649e906f5

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Sat, 04 Jan 2020 01:48:19 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
last-modified: Thu, 20 Jun 2019 17:06:40 GMT
server: AmazonS3
age: 8379519
etag: "63f7a5fb6897b8e074dd95e970cfa1f5"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 7356
x-amz-cf-id: 7l5qfdm1kQhxHg7ljnc9l8NI6FjhWrr8p4zwTBNqdVKdPK-xt83Iug==
expires: Tue, 15 Oct 2019 06:45:28 GMT

GET
H2 200 esposito-192x192.png
media.kasperskydaily.com/wp-content/uploads/2017/06/28185522/ 63 KB
63 KB 7ms
6ms Image
image/png 2600:9000:2156:be00:7:b0d4:2940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskydaily.com/wp-content/uploads/2017/06/28185522/esposito-192x192.png
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:be00:7:b0d4:2940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 45c1573a63aaa226855a3250f90650204f12eeae085f3ab9ef45ff6aa36f5c56

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 20 Dec 2019 21:49:56 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
last-modified: Thu, 20 Jun 2019 17:06:14 GMT
server: AmazonS3
age: 9603422
etag: "f9efcbd54d8e1c3fe6ad7321424b3ddc"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 64522
x-amz-cf-id: dFw7Q-_xOfe4AAH23LdJ9bNSo4kuSNTxw2yx_xowvt37Dd-iL_COeg==
expires: Thu, 05 Jul 2018 14:39:19 GMT

GET
H/1.1 200
OK daily-events-3.js Show response
analytics-scripts.s3-eu-west-1.amazonaws.com/kaspersky-daily/ 6 KB
7 KB 190ms
47ms Script
application/javascript 52.218.57.232
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics-scripts.s3-eu-west-1.amazonaws.com/kaspersky-daily/daily-events-3.js
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.218.57.232 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-eu-west-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: e5e16e7630033f639e01830eefb07f8041b67093ed2f705c6a8f585f3ac7fba6

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Fri, 10 Apr 2020 01:26:57 GMT
Last-Modified: Fri, 27 Mar 2020 14:28:32 GMT
Server: AmazonS3
x-amz-request-id: F9371C1759F637FF
ETag: "d1fff8229277ff9c3e5fb1421445332e"
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 6490
x-amz-id-2: o7OTpMM73nyp4MAfi1m991FbnprpStlbOybfr13AECTLnCT/wOY1M20oIaFpvibX4+FWxjPWIg8=

GET
H2 200 / Show response
assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/ 212 KB
67 KB 8ms
7ms Script
application/x-javascript 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.js,wp-content/plugins/kaspersky-app-banners/js/config.min.js,wp-content/plugins/social-polls-by-opinionstage/public/js/shortcodes.js,wp-content/themes/daily2019/assets/js/main.js,wp-content/plugins/kaspersky-social-sharing-daily/assets/js/kindle.js,wp-includes/js/wp-embed.min.js,wp-content/plugins/gravityforms/js/jquery.json.min.js,wp-content/plugins/gravityforms/js/gravityforms.min.js,wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=3550ef68

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b696c6e7ce2001064fae204fb142e1af65d9e921494004403943675e97e57f48

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Wed, 08 Apr 2020 14:26:31 GMT
content-encoding: gzip
age: 126025
x-cache: Hit from cloudfront
status: 200
content-length: 67925
last-modified: Wed, 08 Apr 2020 14:26:15 GMT
server: nginx
cache-control: max-age=31557600
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 57d93b321db68494cc6755a0d3fb29cd.cloudfront.net (CloudFront)
x-cache-hit: HIT
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: cdN0y1PbeQGjU6rvoeZBU686XPXpvsUtiW8b8g8s-_KbeWJ6Ibsn-A==
expires: Thu, 08 Apr 2021 20:26:25 GMT

GET
H2 200 s_code_single_suite.js Show response
media.kaspersky.com/tracking/omniture/ 168 KB
47 KB 167ms
88ms Script
application/javascript 185.85.15.31
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js?ver=5.3.2

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.85.15.31 , Russian Federation, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

/ Kaspersky Labs, Kaspersky Labs

Resource Hash

75f7ea06906b87d74e4b64f0d3c83a942ed617662aac4202cda401fa03c2a714

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
vary: Accept-Encoding
x-powered-by: Kaspersky Labs, Kaspersky Labs
status: 200
date: Fri, 10 Apr 2020 01:26:56 GMT
content-length: 48149
x-xss-protection: 1; mode=block
last-modified: Wed, 11 Mar 2020 14:05:15 GMT
server
etag: "b81dcd16aef7d51:0"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=3600
x-server: fr2/FRA2
accept-ranges: bytes
x-content-type-options: nosniff

GET
H/1.1 200
OK widget.js Show response
d1xnn692s7u6t6.cloudfront.net/ 13 KB
5 KB 461ms
385ms Script
text/javascript 143.204.101.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1xnn692s7u6t6.cloudfront.net/widget.js
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.101.124 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-101-124.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 327262f2b3496dd8337891b4d031f547db0e674d8cdc1ebf68e627adafbf7aa9

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-amz-version-id: dJNOY_esNRyASXh00KIOXcNcPuuMMbPH
Content-Encoding: gzip
Last-Modified: Tue, 30 Jul 2013 19:48:18 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA50-C1
ETag: "300a9b06ef340c2e3f3d261712f92663"
X-Cache: RefreshHit from cloudfront
Content-Type: text/javascript
Via: 1.1 baaf38f0a0d54e4834bf934fa5189ceb.cloudfront.net (CloudFront)
Cache-Control: public, max-age=60
Date: Fri, 10 Apr 2020 01:26:58 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4354
X-Amz-Cf-Id: BPK2KT8AlWuzmoLlJ4ayYqeq6tZDrYflsMU752rGTeDoCxwv5XJJvg==

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 676 B
541 B 21ms
21ms Script
text/javascript 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.3.2

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

9060fb01746d2d2767d8bbc547fe3b8c5dc9ac671f777fede7c11a7fc3802316

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 10 Apr 2020 01:26:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 446
x-xss-protection: 1; mode=block
expires: Fri, 10 Apr 2020 01:26:56 GMT

GET
H2 200 museosans-cyrl-500-webfont.woff2
assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/museo/ 30 KB
31 KB 26ms
9ms Font
font/woff2 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/museo/museosans-cyrl-500-webfont.woff2
Requested by: Host: app-sj06.marketo.com
URL: https://app-sj06.marketo.com/js/forms2/js/forms2.min.js?ver=1.0.1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: d730bb6fbbbd41c6dbbc93a37860904fd6e8cdb2c3029efd2eb7104ae41586ce

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 19 Dec 2019 12:14:27 GMT
via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)
age: 9724349
x-cache: Hit from cloudfront
status: 200
content-length: 31176
pragma: public
last-modified: Thu, 19 Dec 2019 08:57:25 GMT
server: nginx
etag: "5dfb3b75-79c8"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: w0P6VMX2-cOfNnGzbmbFivCbnRG8rLC8cFNFXH5-jTwmerCTCEVb4A==
expires: Fri, 18 Dec 2020 12:14:27 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 478 KB
83 KB 16ms
16ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

87956ecf3ee6ec4738484ed5853fb7343b04d4c5c236386ae0ed46e166d4c900

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 10 Apr 2020 01:26:57 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 84997
x-xss-protection: 0
last-modified: Fri, 10 Apr 2020 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Apr 2020 01:26:57 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 126 KB
31 KB 18ms
5ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: LFF1HfbaOEcjAZfeDVz7cWkxiS8mM9294VOfBy4iU9otYpYtoD1PiCwJ+Vi4EZ2WbdMVLHqsEKrWy1ELPpNQ9w==
x-fb-trip-id: 1850256238
date: Fri, 10 Apr 2020 01:26:57 GMT, Fri, 10 Apr 2020 01:26:57 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 pa-560b0d8dabe53d2e7e8a2dfc.js Show response
rum-static.pingdom.net/ 6 KB
3 KB 136ms
117ms Script
application/javascript 2606:4700:10::6814:15ef
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-static.pingdom.net/pa-560b0d8dabe53d2e7e8a2dfc.js
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:15ef , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2eb62ebe67e6047c8793c5680e98c4ea45e916affe0b7961669d850b0727cd80

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 10 Apr 2020 01:26:58 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Wed, 26 Jun 2019 09:19:43 GMT
server: cloudflare
access-control-allow-origin: *
etag: W/"5d1338af-1878"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=86400
cf-ray: 5818aec42f98d711-FRA
expires: Fri, 10 Apr 2020 01:31:58 GMT

GET
H2 200 icons.svg
www.kaspersky.com/blog/wp-content/themes/daily2019/assets/sprite/ 20 KB
8 KB 751ms
750ms Other
image/svg+xml 93.159.228.40
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://www.kaspersky.com/blog/wp-content/themes/daily2019/assets/sprite/icons.svg

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

93.159.228.40 , Russian Federation, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

nginx /

Resource Hash

b9559551a498fa16f275034c6f2435d48cb03c2e1c72a4cf85cd7bc4c1e84cfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-proxy: msk2
pragma: public
date: Fri, 10 Apr 2020 01:26:58 GMT
content-encoding: gzip
last-modified: Wed, 08 Apr 2020 14:26:15 GMT
server: nginx
etag: W/"5e8ddf07-4f77"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: max-age=31536000, public
strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: 9c395213911fa8aeaa4c2aff0a1d2966
expires: Sat, 10 Apr 2021 01:26:58 GMT

GET
H2 200 logo-kaspersky.svg
assets.kasperskydaily.com/wp-content/themes/daily2019/assets/images/logo/ 3 KB
2 KB 8ms
8ms Image
image/svg+xml 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.kasperskydaily.com/wp-content/themes/daily2019/assets/images/logo/logo-kaspersky.svg
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f24864d27bfaffc860ad3f2648709b60153abbeb7ec502552ab987a18d0ff4f

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: public
date: Thu, 19 Dec 2019 12:14:38 GMT
content-encoding: gzip
last-modified: Thu, 19 Dec 2019 08:57:25 GMT
server: nginx
age: 9724339
etag: W/"5dfb3b75-b43"
x-cache: Hit from cloudfront
content-type: image/svg+xml
status: 200
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: _rDGiH0ebgZrz6vI74l2pskKU70e5_iVJ-x_VhkjuTJTxHtGWGRYGw==
via: 1.1 57d93b321db68494cc6755a0d3fb29cd.cloudfront.net (CloudFront)
expires: Fri, 18 Dec 2020 12:14:38 GMT

GET
H2 200 logo-daily.svg
assets.kasperskydaily.com/wp-content/themes/daily2019/assets/images/logo/ 1 KB
1 KB 8ms
8ms Image
image/svg+xml 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.kasperskydaily.com/wp-content/themes/daily2019/assets/images/logo/logo-daily.svg
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 0e409bb24dfc019e40b9a9216840ae95d6ba8c6061e60e3dac334787e0d6233e

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: public
date: Sat, 21 Dec 2019 01:22:22 GMT
content-encoding: gzip
last-modified: Fri, 20 Dec 2019 14:17:09 GMT
server: nginx
age: 9590675
etag: W/"5dfcd7e5-4be"
x-cache: Hit from cloudfront
content-type: image/svg+xml
status: 200
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: cuzUY6rOVwZaZCn-UzGFMR65B6UFFYfbkw2T49ILptbGOXW9YC01Nw==
via: 1.1 57d93b321db68494cc6755a0d3fb29cd.cloudfront.net (CloudFront)
expires: Sun, 20 Dec 2020 01:22:22 GMT

GET
H2 200 search-green.svg
assets.kasperskydaily.com/wp-content/themes/daily2019/assets/images/icon/ 537 B
734 B 8ms
8ms Image
image/svg+xml 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.kasperskydaily.com/wp-content/themes/daily2019/assets/images/icon/search-green.svg
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 47bbcad4a1caac2d6c3dda1d01badd7f6684f8c2b33f9250a3ef24451ce482ff

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: public
date: Thu, 19 Dec 2019 12:14:43 GMT
content-encoding: gzip
last-modified: Thu, 19 Dec 2019 08:57:25 GMT
server: nginx
age: 9724334
etag: W/"5dfb3b75-219"
x-cache: Hit from cloudfront
content-type: image/svg+xml
status: 200
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: K1J0ouwviWpddY6Wglwv3J_gOs1YGWc48ogFTv3Vz75OKJY9flGE2g==
via: 1.1 57d93b321db68494cc6755a0d3fb29cd.cloudfront.net (CloudFront)
expires: Fri, 18 Dec 2020 12:14:43 GMT

GET
H2 200 symbol-kaspersky.svg
assets.kasperskydaily.com/wp-content/themes/daily2019/assets/images/logo/ 440 B
679 B 8ms
8ms Image
image/svg+xml 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.kasperskydaily.com/wp-content/themes/daily2019/assets/images/logo/symbol-kaspersky.svg
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: ee5d976601d6164115f94cb752e7d70e1875d911f1833bb9e1d530204b050332

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: public
date: Fri, 03 Jan 2020 01:08:35 GMT
content-encoding: gzip
last-modified: Fri, 20 Dec 2019 14:17:07 GMT
server: nginx
age: 8468302
etag: W/"5dfcd7e3-1b8"
x-cache: Hit from cloudfront
content-type: image/svg+xml
status: 200
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: 41WwyLimVqYfRDARdpfM6d5b4fAIbP32BrEy1bVis6qQkP_tQctb6g==
via: 1.1 57d93b321db68494cc6755a0d3fb29cd.cloudfront.net (CloudFront)
expires: Sat, 02 Jan 2021 01:08:35 GMT

GET
H2 200 br.svg
assets.kasperskydaily.com/wp-content/plugins/kaspersky-social-sharing-daily/assets/img/ 368 B
674 B 8ms
7ms Image
image/svg+xml 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.kasperskydaily.com/wp-content/plugins/kaspersky-social-sharing-daily/assets/img/br.svg
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 4ec9bc8732d180852e446c33ee398d0a5e1d0c35f544f0ef620fefcae0d52222

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: public
date: Thu, 19 Dec 2019 12:14:33 GMT
content-encoding: gzip
last-modified: Thu, 19 Dec 2019 08:57:25 GMT
server: nginx
age: 9724344
etag: W/"5dfb3b75-170"
x-cache: Hit from cloudfront
content-type: image/svg+xml
status: 200
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: upSCp04Y-skNkjW13ozxZrUwas0xNsIjs36Aej1KHdt4UZWrmL8a3w==
via: 1.1 57d93b321db68494cc6755a0d3fb29cd.cloudfront.net (CloudFront)
expires: Fri, 18 Dec 2020 12:14:33 GMT

GET
H2 200 arrow-long-right.svg
assets.kasperskydaily.com/wp-content/themes/daily2019/assets/images/icon/ 445 B
708 B 8ms
6ms Image
image/svg+xml 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.kasperskydaily.com/wp-content/themes/daily2019/assets/images/icon/arrow-long-right.svg
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 9e6fe0d321b1bc161c1ade065e97d7e654851b6fb4d5da7f44931a1895f9aaed

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: public
date: Thu, 19 Dec 2019 12:14:38 GMT
content-encoding: gzip
last-modified: Thu, 19 Dec 2019 08:57:26 GMT
server: nginx
age: 9724339
etag: W/"5dfb3b76-1bd"
x-cache: Hit from cloudfront
content-type: image/svg+xml
status: 200
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: A9Qr-CuWEbYUFh-3lV2U1udBRVIp_Q0xrTJuMSfZUEOmEHyvfLplNA==
via: 1.1 57d93b321db68494cc6755a0d3fb29cd.cloudfront.net (CloudFront)
expires: Fri, 18 Dec 2020 12:14:38 GMT

GET
H2 200 museosans-cyrl-300-webfont.woff2
assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/museo/ 30 KB
31 KB 20ms
18ms Font
font/woff2 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/museo/museosans-cyrl-300-webfont.woff2
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: de892addc549d85b9fd5d5c2f77a4dd96fbe4ec11542d6cf7232fab6ccabae5d

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 19 Mar 2020 15:18:36 GMT
via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)
age: 1850901
x-cache: Hit from cloudfront
status: 200
content-length: 30844
pragma: public
last-modified: Wed, 18 Mar 2020 16:13:43 GMT
server: nginx
etag: "5e7248b7-787c"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: Czkn7Jz-u9tHlEcNHwDKux94RdUpHl1z-lesuicKks2lxkjnFkoOug==
expires: Fri, 19 Mar 2021 15:18:36 GMT

GET
H2 200 font-icons.ttf
assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/font-icons/ 34 KB
22 KB 19ms
17ms Font
application/font-sfnt 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/font-icons/font-icons.ttf?p2bytm
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 20c44a2b00fbdf68041dbfacf8b61d07267786208e0495eb8b7f15b2d26300d9

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 19 Dec 2019 12:14:29 GMT
content-encoding: gzip
age: 9724348
x-cache: Hit from cloudfront
status: 200
via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)
pragma: public
last-modified: Thu, 19 Dec 2019 08:57:25 GMT
server: nginx
vary: Accept-Encoding
content-type: application/font-sfnt
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: q840o8oUqNq0DWAA0nipAClStm2tsd9-Zu0YBPgesJv_pNBNAYcxCw==
expires: Fri, 18 Dec 2020 12:14:29 GMT

GET
H2 200 museosans-cyrl-300italic-webfont.woff2
assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/museo/ 32 KB
32 KB 15ms
14ms Font
font/woff2 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/museo/museosans-cyrl-300italic-webfont.woff2
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 6dd21f48efae5a31b9f4042a2801d3a71f2c8c8fb93a121395dd44bf01fb37ff

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 19 Dec 2019 12:14:29 GMT
via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)
age: 9724348
x-cache: Hit from cloudfront
status: 200
content-length: 32596
pragma: public
last-modified: Thu, 19 Dec 2019 08:57:25 GMT
server: nginx
etag: "5dfb3b75-7f54"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: L2UxSZHgw39Rmv8IzqKAAA0Z0zfDPNCdlV8vnCU4GPT4myt-87zFcQ==
expires: Fri, 18 Dec 2020 12:14:29 GMT

GET
H2 200 museosans-cyrl-700-webfont.woff2
assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/museo/ 30 KB
31 KB 25ms
24ms Font
font/woff2 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/museo/museosans-cyrl-700-webfont.woff2
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: b652721e972ad17bfe8aab3616e4735ccf031e3ed595128c15a5c095f57c61a4

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 19 Dec 2019 12:14:29 GMT
via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)
age: 9724348
x-cache: Hit from cloudfront
status: 200
content-length: 31092
pragma: public
last-modified: Thu, 19 Dec 2019 08:57:26 GMT
server: nginx
etag: "5dfb3b76-7974"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: n8VW_d9uxxUjMyWAzIgd5hFDzpF4rGR14Hkz6qjm5zHrDiDVt2Iz0g==
expires: Fri, 18 Dec 2020 12:14:29 GMT

GET
H2 200 museosans-cyrl-900-webfont.woff2
assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/museo/ 29 KB
30 KB 27ms
25ms Font
font/woff2 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/museo/museosans-cyrl-900-webfont.woff2
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 3402e3f06488735fc4e2401e8746bb43e0361c876cbad35f19f32a9242a9ba89

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 19 Dec 2019 12:14:29 GMT
via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)
age: 9724348
x-cache: Hit from cloudfront
status: 200
content-length: 30012
pragma: public
last-modified: Thu, 19 Dec 2019 08:57:25 GMT
server: nginx
etag: "5dfb3b75-753c"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: 3LHm8sXDevzIFszK_hZiWPjOieCk1-Snz8COfWAxDyEyS8ZmPGxEwg==
expires: Fri, 18 Dec 2020 12:14:29 GMT

GET
H2 200 museosans-cyrl-500italic-webfont.woff2
assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/museo/ 32 KB
33 KB 26ms
25ms Font
font/woff2 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/museo/museosans-cyrl-500italic-webfont.woff2
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 33b07014284aff324a3bec9f4b2e0469994164abbdd268a8c5c19fe8f50822f8

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 19 Dec 2019 12:14:29 GMT
via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)
age: 9724348
x-cache: Hit from cloudfront
status: 200
content-length: 33020
pragma: public
last-modified: Thu, 19 Dec 2019 08:57:26 GMT
server: nginx
etag: "5dfb3b76-80fc"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: qly2p3NE-9hi0w9GKiOFZwjOHdbohjeQrq_GDqXPySI4lVwFHB3cVg==
expires: Fri, 18 Dec 2020 12:14:29 GMT

GET
H2 200 fontawesome-webfont.woff2
assets.kasperskydaily.com/wp-content/themes/daily2019/assets/font-awesome/fonts/ 70 KB
71 KB 21ms
21ms Font
font/woff2 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskydaily.com/wp-content/themes/daily2019/assets/font-awesome/fonts/fontawesome-webfont.woff2?v=4.6.2
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 2932abf996373e87fbf2e950876b1962f1b57db954a1643ea68831d9fbb74da4

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 19 Dec 2019 12:14:33 GMT
via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)
age: 9724344
x-cache: Hit from cloudfront
status: 200
content-length: 71760
pragma: public
last-modified: Thu, 19 Dec 2019 08:57:25 GMT
server: nginx
etag: "5dfb3b75-11850"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: ORakk2PRlS1pTOoTVgi9IGuV0uQ9WQVSCo0FJKQR_G0yKnspPMboQg==
expires: Fri, 18 Dec 2020 12:14:33 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 368 B
1 KB 160ms
43ms XHR
application/json 52.31.188.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=4.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=983502BE532960BE0A490D4C%40AdobeOrg&d_nsid=0&ts=1586482018018

Requested by

Host: media.kaspersky.com
URL: https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js?ver=5.3.2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.31.188.35 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-188-35.eu-west-1.compute.amazonaws.com

Software

Resource Hash

4463edaf7312d92f7e70f2a38dd602de9e4eed43a51fc25db6256f4615e90577

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v065-08c6f72a3.edge-irl1.demdex.com 5.66.0.20200408080925 2ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: UDzh5gFaT5I=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.kaspersky.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 305
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

16c4241b1b765089bbceaa9dc7d7974b1f0d862ea1bb03c6c2b9478cd2bbb2f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: 19ZdUNImM7SFE6CuFOf9pQ==
status: 200
date: Fri, 10 Apr 2020 01:26:58 GMT, Fri, 10 Apr 2020 01:26:58 GMT
expires: Fri, 10 Apr 2020 01:44:48 GMT
alt-svc: h3-27=":443"; ma=3600
content-length: 1780
x-fb-debug: G+6i/L7KxZJNnX4z1j3qk4zERW3EnZmSsAkwVMl5DlNtsk7HvaYHyQtCI1Bvu8DlH7L64D2fMJKS4qNWSNuPJw==
x-fb-trip-id: 1850256238
x-fb-content-md5: 92a304f90b65323eaee73ba49059b8b6
etag: "8e9c991fb08234f64e6f44784bc7d08b"
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/NjSCg_IbX1Pdc6A9cf-rvw4e/ 259 KB
92 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/NjSCg_IbX1Pdc6A9cf-rvw4e/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.3.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9c35c6377a52093f4c4f766b5c528106835a654c31b3bba5015d79826633441

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 06 Apr 2020 16:37:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 06 Apr 2020 04:05:21 GMT
server: sffe
age: 290995
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 94421
x-xss-protection: 0
expires: Tue, 06 Apr 2021 16:37:03 GMT

GET
H2 200 museosans-cyrl-700italic-webfont.woff2
assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/museo/ 32 KB
33 KB 6ms
6ms Font
font/woff2 2600:9000:21f3:7800:12:5eb9:fe40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.kasperskydaily.com/wp-content/themes/daily2019/assets/fonts/museo/museosans-cyrl-700italic-webfont.woff2
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:21f3:7800:12:5eb9:fe40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: d7c02bfd05f418c18d9926ecd9bb0a14da25e22bdc02ecd42c0c948940e5ba23

Request headers

Referer: https://assets.kasperskydaily.com/blog/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/kaspersky-app-banners/lib/smartbanner/jquery.smartbanner.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/daily2019/assets/fonts/museo/stylesheet.css,wp-content/themes/daily2019/assets/css/main.css,wp-content/themes/daily2019/assets/font-awesome/css/font-awesome.min.css,wp-content/plugins/kaspersky-instagram/css/magnific-popup.css,wp-content/plugins/kaspersky-instagram/css/widget.css,wp-content/plugins/kaspersky-social-sharing-daily/assets/css/custom.icons.css&ver=3550ef68
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 19 Dec 2019 12:14:29 GMT
via: 1.1 df26103dc140569d7032449c70c3b141.cloudfront.net (CloudFront)
age: 9724349
x-cache: Hit from cloudfront
status: 200
content-length: 32964
pragma: public
last-modified: Thu, 19 Dec 2019 08:57:25 GMT
server: nginx
etag: "5dfb3b75-80c4"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
x-amz-cf-id: 9mYaK0-KtCMR5EXPS5cUKh7IK13WGt69azsmnoZHRAPmb8gXZiuFPQ==
expires: Fri, 18 Dec 2020 12:14:29 GMT

GET
H2 200 25070 Show response
www.kaspersky.com/blog/wp-json/wp/v2/posts/ 11 KB
4 KB 620ms
620ms XHR
application/json 93.159.228.40
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://www.kaspersky.com/blog/wp-json/wp/v2/posts/25070?platform=mac&cat_id%5B%5D=kis-porno-try

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

93.159.228.40 , Russian Federation, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

nginx /

Resource Hash

df72f800caa45aac99fb9420624de48aa5098a67c44ca1d3e7f2b6a29d339376

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: */*
Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-proxy: msk2
date: Fri, 10 Apr 2020 01:26:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding
x-request-id: 52e9fe24a61f8db41c6c154ac1003fed
link: <https://www.kaspersky.com/blog/extortion-spam/25070/>; rel="alternate"; type=text/html
allow: GET
server: nginx
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages
x-cache-hit: HIT
x-robots-tag: noindex
access-control-allow-headers: Authorization, Content-Type

GET
H2 200 / Show response
graph.facebook.com/ 67 B
512 B 62ms
49ms XHR
application/json 2a03:2880:f02d:e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8ee1560ee195270e335e7edbd741f67ca18fec678ef7e597139e1da55859432e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
etag: "c19f233d11ff22c16135bf8aa31d71cf0dce4626"
x-app-usage: {"call_count":0,"total_cputime":0,"total_time":0}
status: 200
x-fb-rev: 1001969100
alt-svc: h3-27=":443"; ma=3600
content-length: 67
pragma: no-cache
x-fb-debug: xOb7V2jN00ElR/ufKKE20dusIu+74cVwc6HchlO8tLIwEsJ+aZ17n1X5BOnsyeiq+6Z9fNRT8b32xzkqSR2ADg==
x-fb-trace-id: DTgFTrNN7v3
date: Fri, 10 Apr 2020 01:26:58 GMT, Fri, 10 Apr 2020 01:26:58 GMT
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: ACNA_MZtSf0lC7FR_sxuIg8
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v2.12
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 share
www.linkedin.com/countserv/count/ 0
0 168ms
167ms Script
text/html 2a05:f500:11:101::b93f:9001
LINKEDIN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&format=jsonp&callback=jQuery112404446635456125312_1586482017894&_=1586482017895
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9001 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

GET
H2 200 info.json Show response
www.reddit.com/api/ 102 B
1 KB 196ms
140ms XHR
application/json 199.232.53.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.53.140 Manchester, United Kingdom, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 10 Apr 2020 01:26:58 GMT
via: 1.1 varnish
x-content-type-options: nosniff
x-cache: MISS
status: 200
content-length: 102
x-xss-protection: 1; mode=block
x-served-by: cache-man4136-MAN
x-moose: majestic
expires: -1
server: snooserv
x-timer: S1586482018.174473,VS0,VE113
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
x-ua-compatible: IE=edge
accept-ranges: bytes
x-cache-hits: 0

GET
H2 200 search Show response
hn.algolia.com/api/v1/ 389 B
1009 B 265ms
216ms XHR
application/json 104.16.224.72
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://hn.algolia.com/api/v1/search?query=%22https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F%22&tags=story&advancedSyntax=true&attributesToRetrieve=points,url

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.224.72 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b09559d6e101bc77d5b38447b12bdedd9d27fd0bd1df89a8c37ad0b5f9d2c74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 10 Apr 2020 01:26:58 GMT
content-encoding: br
cf-cache-status: DYNAMIC
status: 200
x-request-id: 97d11abb-c4f0-43ec-8d6e-a0221218cf95
x-runtime: 0.029056
server: cloudflare
etag: W/"9b09559d6e101bc77d5b38447b12bded"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-methods: GET, PUT, DELETE, POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: false
cf-ray: 5818aec588a7c83b-AMS
access-control-allow-headers: x-algolia-application-id, connection, origin, x-algolia-api-key, content-type, content-length, x-algolia-signature, x-algolia-usertoken, x-algolia-tagfilters, DNT, X-Mx-ReqToken, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Authorization, Accept

GET
H2 200 index.php Show response
www.kaspersky.com/blog/wp-content/plugins/kaspersky-social-sharing-daily/counter/ 154 B
382 B 681ms
681ms XHR
application/javascript 93.159.228.40
KL-EXT

General

Check archive.org

Show headers Download Go to

Full URL

https://www.kaspersky.com/blog/wp-content/plugins/kaspersky-social-sharing-daily/counter/index.php?url=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&callback=jQuery112404446635456125312_1586482017896&_=1586482017897

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

93.159.228.40 , Russian Federation, ASN200107 (KL-EXT, RU),

Reverse DNS

Software

nginx /

Resource Hash

c59f8b46f7a35dd9390725cd687138456df98c9cdb4e48c4ff9cf48021a46c16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-proxy: msk2
date: Fri, 10 Apr 2020 01:26:58 GMT
content-encoding: gzip
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
status: 200
x-cache-hit: MISS
strict-transport-security: max-age=31536000; includeSubDomains
x-request-id: 383e86d854f5cc8536a0e0696bbd1a42

GET
H2 200 extortion-spam-featured-2.jpg
media.kasperskydaily.com/wp-content/uploads/sites/92/2018/12/22063619/ 285 KB
286 KB 8ms
8ms Image
image/jpeg 2600:9000:2156:be00:7:b0d4:2940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskydaily.com/wp-content/uploads/sites/92/2018/12/22063619/extortion-spam-featured-2.jpg
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:be00:7:b0d4:2940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 10fe021440d332d99601692b92772e552d9e25c4a3c0db3b6466795f578ded85

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 09 Apr 2020 14:18:16 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
last-modified: Tue, 29 Oct 2019 22:03:56 GMT
server: AmazonS3
age: 40122
etag: "2d089ba0d2a850aaa8b258bc94c48278"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 292305
x-amz-cf-id: i6GIGrcpiCk8v3inSYdDCEI8zZOsKbn-AgG9PVwrfcNYMtKuoQJb5A==
expires: Wed, 28 Oct 2020 22:03:55 GMT

GET
H2 200 data-leak-compensation-scam-featured-700x460.jpg
media.kasperskydaily.com/wp-content/uploads/sites/92/2020/01/13101051/ 27 KB
28 KB 9ms
8ms Image
image/jpeg 2600:9000:2156:be00:7:b0d4:2940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskydaily.com/wp-content/uploads/sites/92/2020/01/13101051/data-leak-compensation-scam-featured-700x460.jpg
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:be00:7:b0d4:2940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: fa95a6a57dd278f2ec6b5b9e54496026496b5482af23349d3b3c7039be31ee85

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 09 Apr 2020 00:06:10 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
last-modified: Mon, 13 Jan 2020 15:10:54 GMT
server: AmazonS3
age: 91249
etag: "2d4a775a0a8eb18fb111ceeb9a98d286"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 27993
x-amz-cf-id: fsUKMtxn1eHVl77jJfCqLf4gIW-NCCpbwpcEPJPWvvczxz9xRdODIA==
expires: Tue, 12 Jan 2021 15:10:51 GMT

GET
H2 200 prepaid-card-sextortion-featured-700x460.jpg
media.kasperskydaily.com/wp-content/uploads/sites/92/2019/12/16071053/ 33 KB
34 KB 8ms
8ms Image
image/jpeg 2600:9000:2156:be00:7:b0d4:2940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskydaily.com/wp-content/uploads/sites/92/2019/12/16071053/prepaid-card-sextortion-featured-700x460.jpg
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:be00:7:b0d4:2940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5f1f17e86d1fe7d3a51641559718355fa31de849f0089dcefdd3cbffc64b11a5

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 09 Apr 2020 02:02:48 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
last-modified: Mon, 16 Dec 2019 12:10:56 GMT
server: AmazonS3
age: 84251
etag: "56203683f44685f743514e2fd60ca12e"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 33994
x-amz-cf-id: KvOLRhkiUwpZZx6BDXmrbDgfk0DnoB9pQUd_4j-5Fzy5F4rkRFMf3A==
expires: Tue, 15 Dec 2020 12:10:53 GMT

GET
H2 200 839281392784015 Show response
connect.facebook.net/signals/config/ 447 KB
112 KB 12ms
11ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/839281392784015?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

823c238dc56a978c81fed39b83d77f2f61ad74caa1a3401349d9f2ef260989f8

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-27=":443"; ma=3600
content-length: 114947
x-xss-protection: 0
pragma: public
x-fb-debug: jrc2sFoMXsP/DHPJWOdf8sK7ga6cKXBWDo2tvDgzZKBIfLZUfy9/wHUnZMckUU5ufkALxu7Ok4XSplnyTopmUQ==
x-fb-trip-id: 1850256238
date: Fri, 10 Apr 2020 01:26:58 GMT, Fri, 10 Apr 2020 01:26:58 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 382 KB
111 KB 17ms
6ms Script
application/x-javascript 2a03:2880:f02d:12:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=8e4b1764d5b12b101f25655580c9cd04&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d44fdf866fdd1628b3b36122ac1b19c06af70b276d7c08772d41a6f6ef304b07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: c0mpiEIHF5EC1IGoQLeX4w==
status: 200
date: Fri, 10 Apr 2020 01:26:58 GMT, Fri, 10 Apr 2020 01:26:58 GMT
expires: Sat, 10 Apr 2021 01:24:48 GMT
alt-svc: h3-27=":443"; ma=3600
content-length: 113311
x-fb-debug: 8aW4gKDW8VbHoOjxuZNxXghmGSlnzN/FPdLMeR2l07yKQmuLsvZUrd8FkPuKn5yz2gsm1s2gI5XBT/ixbwAgrw==
x-fb-trip-id: 1850256238
x-fb-content-md5: 9811623b85616782b492f57ddbf0257c
etag: "fe7da29f8578277423bfc891adbf2dd9"
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 101 KB
29 KB 16ms
15ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-K974KNN&l=dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

50f3e8204ac912d27367dce252777fc5beb6257c7969d277cccb27f83599aaa0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 10 Apr 2020 01:26:58 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 29958
x-xss-protection: 0
last-modified: Fri, 10 Apr 2020 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 10 Apr 2020 01:26:58 GMT

GET
H2 200 anchor
www.google.com/recaptcha/api2/ Frame 212A 0
0 36ms
36ms Document
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld65SMUAAAAAGvFXOFt8IDAf7lVwkl3i9yxLTtx&co=aHR0cHM6Ly93d3cua2FzcGVyc2t5LmNvbTo0NDM.&hl=en&v=NjSCg_IbX1Pdc6A9cf-rvw4e&theme=light&size=normal&cb=mrf1cjb8u0v5

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/NjSCg_IbX1Pdc6A9cf-rvw4e/recaptcha__en.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-X/k5auyTMSIqHzHedyU2Dg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Ld65SMUAAAAAGvFXOFt8IDAf7lVwkl3i9yxLTtx&co=aHR0cHM6Ly93d3cua2FzcGVyc2t5LmNvbTo0NDM.&hl=en&v=NjSCg_IbX1Pdc6A9cf-rvw4e&theme=light&size=normal&cb=mrf1cjb8u0v5
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.kaspersky.com/blog/extortion-spam/25070/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.kaspersky.com/blog/extortion-spam/25070/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 10 Apr 2020 01:26:58 GMT
content-security-policy: script-src 'report-sample' 'nonce-X/k5auyTMSIqHzHedyU2Dg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10530
server: GSE
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H/1.1 200
OK Cookie set dest5.html
kaspersky.demdex.net/ Frame BA6D 0
0 172ms
39ms Document
text/html 54.77.236.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://kaspersky.demdex.net/dest5.html?d_nsid=0

Requested by

Host: media.kaspersky.com
URL: https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js?ver=5.3.2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.77.236.71 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-77-236-71.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: kaspersky.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=02720183112897171970556832903836748002
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.kaspersky.com/blog/extortion-spam/25070/

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 08 Apr 2020 13:22:04 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=02720183112897171970556832903836748002;Path=/;Domain=.demdex.net;Expires=Wed, 07-Oct-2020 01:26:58 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: gYUyh9M8Skk=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
kaspersky.d3.sc.omtrdc.net/ 2 B
320 B 102ms
29ms XHR
application/x-javascript 15.188.31.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://kaspersky.d3.sc.omtrdc.net/id?d_visid_ver=4.3.0&d_fieldgroup=A&mcorgid=983502BE532960BE0A490D4C%40AdobeOrg&mid=09808024118675987430711746025338300088&ts=1586482018194

Requested by

Host: media.kaspersky.com
URL: https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js?ver=5.3.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.31.119 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Fri, 10 Apr 2020 01:26:58 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-65fb49f79-xwmcz
vary: Origin
x-c: master-1221.I0e927e.M0-376
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.kaspersky.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 2
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=Xo-LYgAAAdQsHy3-
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=02720183112897171970556832903836748002
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xo-LYgAAAdQsHy3-

42 B
915 B

40ms
40ms

Image
image/gif

52.31.188.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xo-LYgAAAdQsHy3-

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.31.188.35 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-188-35.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v065-0f1664ab8.edge-irl1.demdex.com 5.66.0.20200408080925 1ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: r0scDHVASMQ=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Fri, 10 Apr 2020 01:26:57 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xo-LYgAAAdQsHy3-
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 /
www.facebook.com/tr/ 44 B
348 B 19ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=839281392784015&ev=PageView&dl=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&rl=&if=false&ts=1586482018208&sw=1600&sh=1200&v=2.9.15&r=stable&ec=0&o=30&fbp=fb.1.1586482018207.1204262205&it=1586482018115&coo=false&rqm=GET

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 10 Apr 2020 01:26:58 GMT, Fri, 10 Apr 2020 01:26:58 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-27=":443"; ma=3600
content-length: 44
expires: Fri, 10 Apr 2020 01:26:58 GMT

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 42ms
42ms Fetch
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=307769532755023&input_token&origin=1&redirect_uri=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&sdk=joey&wants_cookie_data=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=8e4b1764d5b12b101f25655580c9cd04&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.kaspersky.com/
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
x-fb-debug: PRM+/HM3tFYRjktNMEXJe4lsuSbFE4wwnm9WSA713vynPn4LEN+qUaHDOFBkf1KlHVIpCzMRUhMptS1cjFog7w==
fb-s: unknown
status: 200
date: Fri, 10 Apr 2020 01:26:58 GMT, Fri, 10 Apr 2020 01:26:58 GMT
strict-transport-security: max-age=15552000; preload
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.kaspersky.com
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-27=":443"; ma=3600
content-length: 0
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K974KNN&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 3208
date: Fri, 10 Apr 2020 00:33:30 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Fri, 10 Apr 2020 02:33:30 GMT

GET insight.min.js
snap.licdn.com/li.lms-analytics/ 0
0

GET

ga-audiences
www.google.com/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j81&aip=1&a=593664384&t=pageview&_s=1&dl=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&ul=en-us&de=UTF-8&dt=Blackmail%20demand...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-35676203-1&cid=524137618.1586482018&jid=1175750096&_gid=61111889.1586482018&gjid=204595666&_v=j81&z=1104841794
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-1&cid=524137618.1586482018&jid=1175750096&_v=j81&z=1104841794

0
0

GET
H2 200 s67161077461305
kaspersky.d3.sc.omtrdc.net/b/ss/kaspersky-single-suite/1/JS-2.15.0/ 43 B
222 B 30ms
29ms Image
image/gif 15.188.31.119
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kaspersky.d3.sc.omtrdc.net/b/ss/kaspersky-single-suite/1/JS-2.15.0/s67161077461305?AQB=1&ndh=1&pf=1&t=10%2F3%2F2020%203%3A26%3A58%205%20-120&mid=09808024118675987430711746025338300088&aamlh=6&ce=UTF-8&ns=kaspersky&cdp=2&pageName=Kaspersky%20Daily%20Blog%20%3E%20Extortion%20Spam&g=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&cc=USD&ch=Kaspersky%20Daily%20Blog&server=www.kaspersky.com&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v3=Kaspersky%20Daily%20Blog%20%3E%20Extortion%20Spam&v9=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&c20=undefined%3Aundefined%3Aundefined%3Aundefined%3Aundefined%3Aundefined&c29=v1%3As_code_single_suite.js%3AtrackPageView%20%3E%20sng.t%3Ap&c30=v1%3A20200311%3A248%3AKaspersky%20Daily%20Blog%3A%5BNULL%5D&c31=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&v44=D%3Dv3&c47=Default&v47=D%3Dc47&c51=Kaspersky%20Daily%20Blog&c56=en-GLOBAL&c57=en-global&v57=D%3Dc57&c58=Blackmail%20demand%20claims%20to%20have%20nailed%20you%20watching%20porn%20%7C%20Kaspersky%20official%20blog&v71=v1%3APage%20View%3A%5BNULL%5D&v116=%5BNULL%5D&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=983502BE532960BE0A490D4C%40AdobeOrg&AQE=1

Requested by

Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.31.119 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 10 Apr 2020 01:26:58 GMT
x-content-type-options: nosniff
x-c: master-1221.I0e927e.M0-376
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 11 Apr 2020 01:26:58 GMT
server: jag
xserver: anedge-65fb49f79-9v6sz
etag: 3406944191586336768-4614759588368096638
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Thu, 09 Apr 2020 01:26:58 GMT

GET
H2 200 bframe
www.google.com/recaptcha/api2/ Frame DA29 0
0 28ms
28ms Document
text/html 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=NjSCg_IbX1Pdc6A9cf-rvw4e&k=6Ld65SMUAAAAAGvFXOFt8IDAf7lVwkl3i9yxLTtx&cb=n8isavuz1f7m

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/NjSCg_IbX1Pdc6A9cf-rvw4e/recaptcha__en.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-JtKKGnDxexyw6jTt90AYqQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=NjSCg_IbX1Pdc6A9cf-rvw4e&k=6Ld65SMUAAAAAGvFXOFt8IDAf7lVwkl3i9yxLTtx&cb=n8isavuz1f7m
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.kaspersky.com/blog/extortion-spam/25070/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.kaspersky.com/blog/extortion-spam/25070/

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 10 Apr 2020 01:26:58 GMT
content-security-policy: script-src 'report-sample' 'nonce-JtKKGnDxexyw6jTt90AYqQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1180
server: GSE
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

GET ga-audiences
www.google.de/ads/ 0
0

GET
H2 200 Banner_1460x300_EN.jpg
media.kasperskydaily.com/wp-content/uploads/sites/92/2018/07/02104148/ 74 KB
74 KB 10ms
10ms Image
image/jpeg 2600:9000:2156:be00:7:b0d4:2940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.kasperskydaily.com/wp-content/uploads/sites/92/2018/07/02104148/Banner_1460x300_EN.jpg
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2156:be00:7:b0d4:2940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b6e1a85cdc5508bdeaf4c92bc8d22cbda470c7a2bede43dcafb867f913d95ca1

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 09 Apr 2020 16:54:43 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
last-modified: Tue, 29 Oct 2019 18:51:45 GMT
server: AmazonS3
age: 30736
etag: "aa6f4e6824e48247313f7a105b6f8864"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 75785
x-amz-cf-id: cOs3v1Z3AaIww9P2FazZYzwgqPk42ZWE__RQEUkLa6wjXu68AoYD7A==
expires: Wed, 28 Oct 2020 18:51:43 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 3208
date: Fri, 10 Apr 2020 00:33:30 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Fri, 10 Apr 2020 02:33:30 GMT

GET
H/1.1 200
OK tc.min.js Show response
c1.rfihub.net/js/ 20 KB
7 KB 87ms
27ms Script
application/x-javascript 104.111.247.111
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.247.111 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-247-111.deploy.static.akamaitechnologies.com
Software: Jetty(9.0.6.v20130930) /
Resource Hash: cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Fri, 10 Apr 2020 01:26:58 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 Apr 2020 01:56:14 GMT
Server: Jetty(9.0.6.v20130930)
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=3600
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 6375
Expires: Fri, 10 Apr 2020 02:26:58 GMT

GET bat.js
bat.bing.com/ 0
0

GET ktag.js
resources.xg4ken.com/js/v2/ 0
0

GET
H/1.1 200
OK vt-132.js Show response
vt.myvisualiq.net/2/7hrBnrmZAM5n6cl1WjyOsg%3D%3D/ 17 KB
5 KB 86ms
21ms Script
application/x-javascript 13.224.194.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vt.myvisualiq.net/2/7hrBnrmZAM5n6cl1WjyOsg%3D%3D/vt-132.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.194.12 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-194-12.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b27f6c546b342d36a22801e2ed49f19198c486cb1559f9478e19fde10d498ed6

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 09 Apr 2020 17:41:26 GMT
Content-Encoding: gzip
Last-Modified: Wed, 26 Sep 2018 19:47:38 GMT
Server: AmazonS3
Age: 27932
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
x-amz-version-id: ocso9vBwiDAMIwzgZeIi2Q7YJDCshSHW
Via: 1.1 adb1b226e6965f6206603ba087bd4a0a.cloudfront.net (CloudFront)
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA2-C1
Connection: keep-alive
Content-Type: application/x-javascript
X-Amz-Cf-Id: 9TLJUqFE_5Bh_F3IFIsVCeIpzWUc9RmKJQyfB_uUBt3SwmcsR8AMSg==

GET 2c47087421d0b.js
t.contentsquare.net/uxa/ 0
0

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 64ms
21ms Script
application/x-javascript 143.204.94.29
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.94.29 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-94-29.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 09 Apr 2020 22:41:53 GMT
Content-Encoding: gzip
Last-Modified: Mon, 13 Jan 2020 19:16:48 GMT
Server: AmazonS3
Age: 9907
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 c6702f5f3b6e77da6f394e67ef1a6aab.cloudfront.net (CloudFront)
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA50-C1
Connection: keep-alive
X-Amz-Cf-Id: tCtj22FGuTmBuh6aq65hEL4AYxWG7VVvO2LHr4wdpJpZk_W0v_xU8A==

GET

ga-audiences
www.google.com/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=593664384&t=pageview&_s=1&dl=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&dp=%2Fblog%2Fextortion-spam%2F25070%2F&ul=en-...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-63997723-28&cid=524137618.1586482018&jid=60065817&uid=09808024118675987430711746025338300088&_gid=61111889.1586482018&gjid=10760...
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63997723-28&cid=524137618.1586482018&jid=60065817&_v=j81&z=1344668619

0
0

GET
H/1.1

200
OK

setuid
ib.adnxs.com/
Redirect Chain

https://s.tribalfusion.com/i.cid?c=705083&ev=0&page=Global
https://s.tribalfusion.com/z/i.cid?c=705083&ev=0&page=Global
https://ib.adnxs.com/getuidu?https://a.tribalfusion.com/i.match?p=b26&u=$UID&redirect=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D305%26code%3D%24TF_USER_ID_ENC%24
https://ib.adnxs.com/bounce?%2Fgetuidu%3Fhttps%3A%2F%2Fa.tribalfusion.com%2Fi.match%3Fp%3Db26%26u%3D%24UID%26redirect%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D305%2526code%253D%...
https://a.tribalfusion.com/i.match?p=b26&u=1692248615869220997&redirect=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D305%26code%3D%24TF_USER_ID_ENC%24
https://ib.adnxs.com/setuid?entity=305&code=18072662245400444836

43 B
1012 B

26ms
25ms

Image
image/gif

37.252.173.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=305&code=18072662245400444836

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.38 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 10 Apr 2020 01:27:01 GMT
AN-X-Request-Uuid: db5189dc-8a7a-475f-82dd-d764ef883061
Content-Type: image/gif
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 82.102.19.132; 82.102.19.132; 537.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.40:80
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 10 Apr 2020 01:26:59 GMT
x-function: 209
x-reuse-index: 2705
location: https://ib.adnxs.com/setuid?entity=305&code=18072662245400444836
p3p: CP="NOI DEVo TAIa OUR BUS"
status: 302
cache-control: no-cache, private
content-type: text/html
content-length: 36
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 /
www.facebook.com/tr/ 0
38 B 6ms
6ms Other
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZ0APVhLzeJjIJI9E

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
access-control-allow-origin: https://www.kaspersky.com
date: Fri, 10 Apr 2020 01:26:58 GMT
content-type: text/plain
status: 200
access-control-allow-credentials: true
alt-svc: h3-27=":443"; ma=3600
content-length: 0

GET
H/1.1 200
OK beacon.gif Show response
rum-collector-2.pingdom.net/img/ 0
213 B 164ms
40ms XHR
text/plain 34.250.128.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rum-collector-2.pingdom.net/img/beacon.gif?id=560b0d8dabe53d2e7e8a2dfc&sAW=1600&sAH=1200&bIW=1600&bIH=1200&pD=24&dPR=1&or=landscape-primary&nT=0&rC=0&nS=0&cS=102&cE=251&dLE=102&dLS=2&fS=1&hS=116&rE=-1&rS=-1&reS=251&resS=1835&resE=1837&uEE=-1&uES=-1&dL=2103&dI=3766&dCLES=3766&dCLEE=3833&dC=4430&lES=4430&lEE=4470&s=nt&title=Blackmail%20demand%20claims%20to%20have%20nailed%20you%20watching%20porn%20%7C%20Kaspersky%20official%20blog&path=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&ref=&sId=b611e5d4&sST=1586482018&sIS=1&rV=0&v=1.4.0
Requested by: Host: rum-static.pingdom.net
URL: https://rum-static.pingdom.net/pa-560b0d8dabe53d2e7e8a2dfc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.128.129 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-128-129.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
Origin: https://www.kaspersky.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Pragma: no-cache
Date: Fri, 10 Apr 2020 01:26:58 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H2 200 1649d5fbb67c.js Show response
w.usabilla.com/ Frame 144B 58 KB
13 KB 120ms
37ms Script
text/javascript 52.16.109.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://w.usabilla.com/1649d5fbb67c.js?lv=1
Requested by: Host: www.kaspersky.com
URL: https://www.kaspersky.com/blog/extortion-spam/25070/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.16.109.72 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-109-72.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: b0ecc396b775690fa99736437d90c7ced4a75c3ceeef7a9867e7ee4bc54c4891

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Fri, 10 Apr 2020 01:26:58 GMT
content-encoding: gzip
x-widget-server: 2.1
etag: "408dc98bcb039c9824cd3f6a7fd7afaa"
content-type: text/javascript
status: 200
cache-control: public,max-age=0
content-length: 13557

GET ga-audiences
www.google.de/ads/ 0
0

GET
H/1.1 200
OK idr.js Show response
a.rfihub.com/ 83 B
685 B 107ms
26ms Script
application/javascript 185.31.128.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://a.rfihub.com/idr.js?_callback=window.RocketfuelBCP.jsonpCallbacks.request_cmZpSWRJbkNhY2hl
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 185.31.128.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: 0bf7692573e7f95f9c6c0db01d41968fce7cbb83e60734e9fa2387962feffaeb

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Expires: Wed, 05 May 2021 01:26:58 GMT
Cache-Control: public, max-age=33696000
Server: Jetty(9.0.6.v20130930)
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 83
Content-Type: application/javascript

GET
H/1.1

200
OK

sync
t.myvisualiq.net/
Redirect Chain

https://tapestry.tapad.com/tapestry/1?ta_partner_id=950&ta_redirect=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3D1001%26ao%3D0%26pruuid%3DTAPAD_%24%7BIDS%3Akey%7D
https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_5f50e161-7aca-11ea-b04f-4e3e1dc0b01b

43 B
300 B

42ms
20ms

Image
image/gif

18.184.247.200
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_5f50e161-7aca-11ea-b04f-4e3e1dc0b01b
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.247.200 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-247-200.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 10 Apr 2020 01:26:58 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

strict-transport-security: max-age=31536000
via: 1.1 google
server: Jetty(8.1.13.v20130916)
date: Fri, 10 Apr 2020 01:26:58 GMT
location: https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_5f50e161-7aca-11ea-b04f-4e3e1dc0b01b
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
status: 302
alt-svc: clear
content-length: 0

GET
H/1.1

200
OK

sync
t.myvisualiq.net/
Redirect Chain

https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&red=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D125310%26dpuuid%3D%24%7BUUID%7D%26redir%3Dhttps%253A%252F%252Ft.myvisualiq.net%252Fsync%253Fprid%253D...
https://t.myvisualiq.net/ul_cb/sync?prid=AOEPNR1&ao=0&red=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D125310%26dpuuid%3D%24%7BUUID%7D%26redir%3Dhttps%253A%252F%252Ft.myvisualiq.net%252Fsync%253Fpri...
https://dpm.demdex.net/ibs:dpid=125310&dpuuid=d5b19529-69bb-468d-a13b-d343cc6a4d57&redir=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3DAOEPNR1%26ao%3D0%26pruuid%3D%24%7BDD_UUID%7D
https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=02720183112897171970556832903836748002

43 B
300 B

21ms
20ms

Image
image/gif

18.184.247.200
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=02720183112897171970556832903836748002
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.247.200 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-247-200.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 10 Apr 2020 01:26:59 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: aMVaDyusRSQ=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=02720183112897171970556832903836748002
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

/
loadus.exelator.com/load/
Redirect Chain

https://t.myvisualiq.net/sync?prid=EEAEPNR1&red=https%3A%2F%2Floadus.exelator.com%2Fload%2F%3Fp%3D204%26g%3D1260%26buid%3D%24%7BUUID%7D
https://t.myvisualiq.net/ul_cb/sync?prid=EEAEPNR1&red=https%3A%2F%2Floadus.exelator.com%2Fload%2F%3Fp%3D204%26g%3D1260%26buid%3D%24%7BUUID%7D
https://loadus.exelator.com/load/?p=204&g=1260&buid=d5b19529-69bb-468d-a13b-d343cc6a4d57

124 B
124 B

56ms
18ms

Image
application/x-javascript

147.75.102.200
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadus.exelator.com/load/?p=204&g=1260&buid=d5b19529-69bb-468d-a13b-d343cc6a4d57
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 147.75.102.200 Central, Hong Kong, ASN54825 (PACKET, US),
Reverse DNS
Software: nginx/1.14.0 / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 10 Apr 2020 01:26:59 GMT
server: nginx/1.14.0
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
status: 200
cache-control: no-cache
access-control-allow-credentials: true
content-type: application/x-javascript;charset=UTF-8

Redirect headers

Location: https://loadus.exelator.com/load/?p=204&g=1260&buid=d5b19529-69bb-468d-a13b-d343cc6a4d57
Date: Fri, 10 Apr 2020 01:26:58 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

B10122619.135787232;dc_pre=CNWvv4na3OgCFUnzdwodjGwHlQ;dc_trk_aid=308320322;dc_trk_cid=72964178;sz=1x1;u=-https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F%7CVIQ_0-fbf5e39b-a178-443...
ad.doubleclick.net/ddm/trackimp/N408002.2426714VISUALIQ/
Redirect Chain

https://t.myvisualiq.net/sync?prid=Test&ao=0&red=https%253A%252F%252Fad.doubleclick.net%252Fddm%252Ftrackimp%252FN408002.2426714VISUALIQ%252FB10122619.135787232%253Bdc_trk_aid%253D308320322%253Bdc_...
https://ad.doubleclick.net/ddm/trackimp/N408002.2426714VISUALIQ/B10122619.135787232;dc_trk_aid=308320322;dc_trk_cid=72964178;sz=1x1;u=-https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F2507...
https://ad.doubleclick.net/ddm/trackimp/N408002.2426714VISUALIQ/B10122619.135787232;dc_pre=CNWvv4na3OgCFUnzdwodjGwHlQ;dc_trk_aid=308320322;dc_trk_cid=72964178;sz=1x1;u=-https%3A%2F%2Fwww.kaspersky....

42 B
221 B

41ms
41ms

Image
image/gif

216.58.205.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N408002.2426714VISUALIQ/B10122619.135787232;dc_pre=CNWvv4na3OgCFUnzdwodjGwHlQ;dc_trk_aid=308320322;dc_trk_cid=72964178;sz=1x1;u=-https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F%7CVIQ_0-fbf5e39b-a178-4434-a30b-3882a92a85ee%7C;ord=5513887

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.205.230 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s24-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 10 Apr 2020 01:26:59 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 10 Apr 2020 01:26:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://ad.doubleclick.net/ddm/trackimp/N408002.2426714VISUALIQ/B10122619.135787232;dc_pre=CNWvv4na3OgCFUnzdwodjGwHlQ;dc_trk_aid=308320322;dc_trk_cid=72964178;sz=1x1;u=-https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F%7CVIQ_0-fbf5e39b-a178-4434-a30b-3882a92a85ee%7C;ord=5513887
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK impression_pixel
t.myvisualiq.net/ 43 B
300 B 88ms
21ms Image
image/gif 18.184.247.200
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/impression_pixel?r=1954201&et=i&ago=212&ao=537&aca=-10&si=-10&ci=-10&pi=-10&ad=-10&advt=-10&chnl=-10&vndr=1583&sz=8968&u=||https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&pt=i
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.247.200 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-247-200.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 10 Apr 2020 01:26:58 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

tr
www.facebook.com/
Redirect Chain

https://t.myvisualiq.net/sync?prid=123&ao=0&red=https%3A%2F%2Fwww.facebook.com%2Ftr%3Fid%3D238727726635232%26ev%3DPageView%26cd%5Border_id%5D%3D%24%7BUUID%7D
https://www.facebook.com/tr?id=238727726635232&ev=PageView&cd[order_id]=0-3c7fbd01-4e58-4731-a475-029b05cac7fa

44 B
101 B

6ms
6ms

Image
image/gif

2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr?id=238727726635232&ev=PageView&cd[order_id]=0-3c7fbd01-4e58-4731-a475-029b05cac7fa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 10 Apr 2020 01:26:58 GMT, Fri, 10 Apr 2020 01:26:58 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-27=":443"; ma=3600
content-length: 44
expires: Fri, 10 Apr 2020 01:26:58 GMT

Redirect headers

Location: https://www.facebook.com/tr?id=238727726635232&ev=PageView&cd[order_id]=0-3c7fbd01-4e58-4731-a475-029b05cac7fa
Date: Fri, 10 Apr 2020 01:26:58 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2 200 up
insight.adsrvr.org/track/ Frame B3CC 0
0 151ms
72ms Document
text/html 46.51.196.250
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=3flza28&ref=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&upid=5jbt2zb&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.51.196.250 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-46-51-196-250.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: insight.adsrvr.org
:scheme: https
:path: /track/up?adv=3flza28&ref=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&upid=5jbt2zb&upv=1.1.0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.kaspersky.com/blog/extortion-spam/25070/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.kaspersky.com/blog/extortion-spam/25070/

Response headers

status: 200
date: Fri, 10 Apr 2020 01:26:59 GMT
content-type: text/html
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1 200
OK Cookie set ca.html
20730592p.rfihub.com/ Frame AB40 0
0 109ms
33ms Document
text/html 185.31.128.129
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20730592p.rfihub.com/ca.html?rfiidc=1041527797682395166&rfiaid=8672439cbc514270a95c7f210e7285c1&ver=9&rb=20707&ca=20730592&pe=https%3A%2F%2Fwww.kaspersky.com%2Fblog%2Fextortion-spam%2F25070%2F&pf=&ra=19019400296301892
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 185.31.128.129 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash

Request headers

Host: 20730592p.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: rud=H4sIAAAAAAAAAOMSNjQwMTQ1Mje3NDezMDK2NDU0MxPiM9StMi5INPIs96sozSiR4jU0tTAzsTAyMLSwNLUAAPFeBys0AAAA; ruds=H4sIAAAAAAAAAOMSNjQwMTQ1Mje3NDezMDK2NDU0MxPiM9StMi5INPIs96sozSgBABCf4JolAAAA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.kaspersky.com/blog/extortion-spam/25070/

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: eud=H4sIAAAAAAAAAJvFyGtoamFmYmFkYGhpYG78Co3fxITKX4TG38SKyt_Fjcr_hcZfJIzKf4TGBwDdB8VvkAAAAA; Path=/; Domain=.rfihub.com; Expires=Wed, 5 May 2021 01:26:59 GMT; Secure; SameSite=None rud=H4sIAAAAAAAAAOMSNjQwMTQ1Mje3NDezMDK2NDU0MxPiM9StMi5INPIs96sozSiR4jU0tTAzsTAyMLSwNLUAAPFeBys0AAAA; Path=/; Domain=.rfihub.com; Expires=Wed, 5 May 2021 01:26:59 GMT; Secure; SameSite=None ruds=H4sIAAAAAAAAAOMSNjQwMTQ1Mje3NDezMDK2NDU0MxPiM9StMi5INPIs96sozSgBABCf4JolAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None
Cache-Control: no-cache
Content-Type: text/html
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Transfer-Encoding: chunked
Server: Jetty(9.0.6.v20130930)

GET
H/1.1 200
OK Cookie set pstats.html
a.rfihub.com/ Frame E7CC 0
0 105ms
28ms Document
text/html 185.31.128.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://a.rfihub.com/pstats.html?rb=20707&ca=20730592&ri=9a741326e8ad0b6593e47780f65f3957&rfiidc=1041527797682395166&rfiaid=8672439cbc514270a95c7f210e7285c1&stats=%7B%2213488%22%3A%22119%2C1%22%2C%2217243%22%3A%2289%2C1%22%2C%2254651%22%3A%2277%2C2%22%2C%2254863%22%3A%22270%2C1%22%2C%2257363%22%3A%22198%2C1%22%2C%2257895%22%3A%22217%2C1%22%2C%2258143%22%3A%22103%2C2%22%2C%2258553%22%3A%22977%2C2%22%2C%2258561%22%3A%22477%2C2%22%7D&ra=2759578026400782
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 185.31.128.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash

Request headers

Host: a.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://www.kaspersky.com/blog/extortion-spam/25070/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.kaspersky.com/blog/extortion-spam/25070/

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: eud=H4sIAAAAAAAAALvEymtoamFmYmFkYGxpYG4wiw2VfwmN38SBxudB5QMAnbOmiFAAAAA; Path=/; Domain=.rfihub.com; Expires=Wed, 5 May 2021 01:27:19 GMT; Secure; SameSite=None rud=H4sIAAAAAAAAAOMSNjQwMTQ1Mje3NDezMDK2NDU0MxPiM9StMi5INPIs96sozSiR4jU0tTAzsTAyMLY0MLMEAC4ygLo0AAAA; Path=/; Domain=.rfihub.com; Expires=Wed, 5 May 2021 01:27:19 GMT; Secure; SameSite=None ruds=H4sIAAAAAAAAAOMSNjQwMTQ1Mje3NDezMDK2NDU0MxPiM9StMi5INPIs96sozSgBABCf4JolAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None
Content-Type: text/html; charset=ISO-8859-1
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Transfer-Encoding: chunked
Server: Jetty(9.0.6.v20130930)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Domain: www.google.com
URL: https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-1&cid=524137618.1586482018&jid=1175750096&_v=j81&z=1104841794

Domain: www.google.de
URL: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-35676203-1&cid=524137618.1586482018&jid=1175750096&_v=j81&z=1104841794&slf_rd=1&random=352617254

Domain: bat.bing.com
URL: https://bat.bing.com/bat.js

Domain: resources.xg4ken.com
URL: https://resources.xg4ken.com/js/v2/ktag.js?tid=KT-N3AA7-3EE

Domain: t.contentsquare.net
URL: https://t.contentsquare.net/uxa/2c47087421d0b.js

Domain: www.google.com
URL: https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63997723-28&cid=524137618.1586482018&jid=60065817&_v=j81&z=1344668619

Domain: www.google.de
URL: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63997723-28&cid=524137618.1586482018&jid=60065817&_v=j81&z=1344668619&slf_rd=1&random=1196793272

Verdicts & Comments Add Verdict or Comment

222 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-19 13:00:34	Name: demdex Value: 02720183112897171970556832903836748002
.kaspersky.com/	1970-01-20 02:12:34	Name: AMCV_983502BE532960BE0A490D4C%40AdobeOrg Value: -1712354808%7CMCIDTS%7C18363%7CMCMID%7C09808024118675987430711746025338300088%7CMCAAMLH-1587086818%7C6%7CMCAAMB-1587086818%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1586489218s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18370%7CvVersion%7C4.3.0
.kaspersky.com/	1970-01-19 10:50:58	Name: _gcl_au Value: 1.1.1731487527.1586482018
.kaspersky.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.kaspersky.com/	1969-12-31 23:59:59	Name: AMCVS_983502BE532960BE0A490D4C%40AdobeOrg Value: 1
www.kaspersky.com/	1970-01-19 08:41:22	Name: country Value: BE
.kaspersky.com/	1970-01-19 08:41:22	Name: _gat_UA-35676203-1 Value: 1
.kaspersky.com/	1970-01-19 08:42:48	Name: _gid Value: GA1.2.61111889.1586482018
.kaspersky.com/	1970-01-19 10:50:58	Name: _fbp Value: fb.1.1586482018207.1204262205
.kaspersky.com/	1970-01-20 02:12:34	Name: _ga Value: GA1.2.524137618.1586482018
www.kaspersky.com/blog/extortion-spam/25070	1970-01-19 08:41:31	Name: pa Value: pa=sid%3Db611e5d4%26sst%3D1586482018%26sis%3D1%26rv%3D0

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://connect.facebook.net/en_US/fbevents.js(Line 23) Message: [Facebook Pixel] - Duplicate Pixel ID: 839281392784015.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	connect-src 'self' https://.3gl.net https://.abmr.net https://.demdex.net https://.everesttech.net https://.facebook.com https://.facebook.net https://.google-analytics.com https://.google.com https://.infogram.com https://.kaspersky.com https://.mail.ru https://.marketlinc.com https://.maxymiser.net https://.mktoresp.com https://.omtrdc.net https://.optimizely.com https://.pingdom.net https://.reddit.com https://.veinteractive.com https://.yandex.ru https://.youtube.com https://cdn.securelist.com https://hn.algolia.com https://kaspersky.admo.tv:9999 https://maxymiser.net https://media.kasperskydaily.com https://privacy.kaspersky.com https://tagmanager.google.com https://www.kaspersky.com/blog https://www.opinionstage.com https://www.riddle.com https://www.tag4arm.com wss://kaspersky.admo.tv:9999; default-src 'self' https://.kaspersky.com https://.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://www.kaspersky.com/blog https://www.riddle.com; font-src 'self' data: https://.cloudfront.net https://.gstatic.com https://.kaspersky.com https://.maxymiser.net https://.slideshare.net https://.slidesharecdn.com https://.wp.com https://assets.kasperskydaily.com https://cdn.securelist.com https://fonts.googleapis.com https://fonts.gstatic.com https://maxymiser.net https://media.kasperskydaily.com https://www.kaspersky.com/blog https://www.riddle.com; frame-ancestors 'self' http://webvisor.com https://.kaspersky.com https://.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://webvisor.com https://www.kaspersky.com/blog https://www.riddle.com; frame-src 'self' http://www.tiki-toki.com https://.addthis.com https://.adsrvr.org https://.ampproject.net https://.doubleclick.net https://.facebook.com https://.facebook.net https://.google.com https://.infogram.com https://.instagram.com https://.kaspersky.com https://.libsyn.com https://.marketo.com https://.maxymiser.net https://.owneriq.net https://.rfihub.com https://.sharethis.com https://.slideshare.net https://.soundcloud.com https://.twitter.com https://.usabilla.com https://.veinteractive.com https://.wp.com https://.youtube.com https://amuselabs.com https://cdn.knightlab.com https://cdn.securelist.com https://cyberstat.kaspersky.com https://d6tizftlrpuof.cloudfront.net https://infogram.com https://kaspersky.berkeleypr.com https://kaspersky.demdex.net https://maxymiser.net https://media.kasperskydaily.com https://pixel.mathtag.com https://player.vimeo.com https://s-static.ak.facebook.com https://servedby.flashtalking.com https://tagmanager.google.com https://view.genial.ly https://www.brighttalk.com https://www.kaspersky.com https://www.kaspersky.com/blog https://www.opinionstage.com https://www.riddle.com; img-src 'self' data: http://.cloudfront.net http://.imgix.net http://.ipinyou.com http://.netdna-cdn.com http://.wordpress.com http://.wp.com http://i0.poll.fm https://.addthis.com https://.admixer.net https://.adnxs.com https://.adriver.ru https://.advertising.com https://.behe.com https://.betweendigital.com https://.bidswitch.net https://.bing.com https://.btrll.com https://.casalemedia.com https://.cloudfront.net https://.crwdcntrl.net https://.demdex.net https://.digitaltarget.ru https://.dotomi.com https://.doubleclick.net https://.everesttech.net https://.exelator.com https://.eyeota.net https://.facebook.com https://.google-analytics.com https://.google.com https://.gravatar.com https://.gstatic.com https://.imgix.net https://.infogram.com https://.instagram.com https://.ipinyou.com https://.kaspersky.com https://.marketgid.com https://.mathtag.com https://.maxymiser.net https://.myvisualiq.net https://.netdna-cdn.com https://.omtrdc.net https://.openx.net https://.owneriq.net https://.postrelease.com https://.pubmatic.com https://.qq.com https://.rubiconproject.com https://.rutarget.ru https://.sharethis.com https://.staticflickr.com https://.stickyadstv.com https://.tanx.com https://.tapad.com https://.tradelab.fr https://.tribalfusion.com https://.twimg.com https://.twitter.com https://.undertone.com https://.v12group.com https://.veinteractive.com https://.w55c.net https://.wordpress.com https://.wp.com https://.yahoo.co.jp https://.yandex.ru https://.yieldlab.net https://.youku.com https://ad.mail.ru https://addevent.com https://adm.shinobi.jp https://adsearch.adkontekst.pl https://assets.kasperskydaily.com https://bh.contextweb.com https://cdn.securelist.com https://ckm.aty.sohu.com https://cm.fastapi.net https://cm.pos.baidu.com https://cm.qtmojo.com https://csi.gstatic.com https://exelatesync.extend.tv https://geo.yahoo.com https://images.telechargement.fr https://img.youtube.com https://inpagevideo.nl https://instagramimages-a.akamaihd.net https://kaspersky.d2.sc.omtrdc.net https://kasperskycontenthub.com https://m.addthis.com https://m.one.impact-ad.jp https://maps.googleapis.com https://maxymiser.net https://media.kasperskydaily.com https://pixel.quantserve.com https://pixel.s3xified.com https://player.vimeo.com https://polldaddy.com https://privacy.kaspersky.com https://rum-collector.pingdom.net https://s.w.org https://s3.amazonaws.com https://scontent.cdninstagram.com https://ssl.socdm.com https://stats.g.doubleclick.net https://stats.seedr.com https://t.co https://tagmanager.google.com https://track.addevent.com https://ums.adtech.de https://vmg.host https://www.emjcd.com https://www.google.hr https://www.kaspersky.com/blog https://www.riddle.com https://www.tag4arm.com; media-src 'self' https://.kaspersky.com https://.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://www.kaspersky.com/blog https://www.riddle.com; object-src 'self' https://.kaspersky.com https://.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://player.vimeo.com https://polldaddy.com https://www.kaspersky.com/blog https://www.riddle.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://.3gl.net https://.addevent.com https://.addthis.com https://.adnxs.com https://.adsrvr.org https://.airpr.com https://.ampproject.org https://.bazaarvoice.com https://.behe.com https://.bizographics.com https://.cloudfront.net https://.crazyegg.com https://.demdex.net https://.doubleclick.net https://.facebook.com https://.facebook.net https://.flickr.com https://.google-analytics.com https://.google.com https://.googleapis.com https://.gravatar.com https://.gstatic.com https://.infogram.com https://.instagram.com https://.ipinyou.com https://.kaspersky.com https://.mail.ru https://.marketlinc.com https://.marketo.com https://.marketo.net https://.mathtag.com https://.maxymiser.net https://.myvisualiq.net https://.optimizely.com https://.owneriq.net https://.polldaddy.com https://.quantserve.com https://.rfihub.com https://.rfihub.net https://.rutarget.ru https://.salesforceliveagent.com https://.sharethis.com https://.twimg.com https://.twitter.com https://.usabilla.com https://.veinteractive.com https://.volvelle.tech https://.woopra.com https://.wp.com https://.yahoo.co.jp https://.yandex.ru https://.yimg.com https://.yimg.jp https://adcdn.goo.ne.jp https://addthisevent.com https://analytics-scripts.s3-eu-west-1.amazonaws.com https://assets.adobedtm.com https://assets.kasperskydaily.com https://bwb101.goo.ne.jp https://cdn.onesignal.com https://cdn.securelist.com https://cdn.tradelab.fr https://cdn.trmit.com https://connect.facebook.net https://connect.mail.ru https://d6tizftlrpuof.cloudfront.net https://external-assets.loyaltybay.co.uk https://kaspersky.admo.tv https://kaspersky.berkeleypr.com https://kaspersky.d2.sc.omtrdc.net https://m.addthis.com https://m.addthisedge.com https://maxymiser.net https://media.kasperskydaily.com https://munchkin.marketo.net https://player.vimeo.com https://rum-static.pingdom.net https://s3.amazonaws.com https://share.yandex.ru/ https://sp.analytics.yahoo.com https://static.ads-twitter.com https://tagmanager.google.com https://vk.com https://www.addevent.com https://www.brighttalk.com https://www.flickr.com https://www.glancecdn.net https://www.googleadservices.com https://www.googletagmanager.com https://www.kaspersky.com/blog https://www.linkedin.com https://www.opinionstage.com https://www.riddle.com https://www.tag4arm.com https://yastatic.net; style-src 'self' 'unsafe-inline' https://.cloudfront.net https://.googleapis.com https://.gravatar.com https://.kaspersky.com https://.marketo.com https://.maxymiser.net https://.securelist.com https://.sharethis.com https://.twimg.com https://.twitter.com https://.wp.com https://assets.kasperskydaily.com https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://tagmanager.google.com https://www.kaspersky.com/blog https://www.riddle.com; worker-src 'self' blob: data: file: filesystem: https://.kaspersky.com https://*.maxymiser.net https://cdn.securelist.com https://maxymiser.net https://media.kasperskydaily.com https://www.kaspersky.com/blog https://www.riddle.com unsafe-eval unsafe-inline
Strict-Transport-Security	max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20730592p.rfihub.com
a.rfihub.com
a.tribalfusion.com
ad.doubleclick.net
analytics-scripts.s3-eu-west-1.amazonaws.com
app-sj06.marketo.com
assets.kasperskydaily.com
bat.bing.com
c1.rfihub.net
cm.everesttech.net
connect.facebook.net
d1xnn692s7u6t6.cloudfront.net
dpm.demdex.net
graph.facebook.com
hn.algolia.com
ib.adnxs.com
insight.adsrvr.org
js.adsrvr.org
kaspersky.d3.sc.omtrdc.net
kaspersky.demdex.net
loadus.exelator.com
media.kaspersky.com
media.kasperskydaily.com
resources.xg4ken.com
rum-collector-2.pingdom.net
rum-static.pingdom.net
s.tribalfusion.com
snap.licdn.com
t.contentsquare.net
t.myvisualiq.net
tapestry.tapad.com
vt.myvisualiq.net
w.usabilla.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
www.kaspersky.com
www.linkedin.com
www.reddit.com
bat.bing.com
resources.xg4ken.com
snap.licdn.com
t.contentsquare.net
www.google.com
www.google.de
104.109.80.223
104.111.247.111
104.16.224.72
104.16.92.80
13.224.194.12
143.204.101.124
143.204.94.29
147.75.102.200
15.188.31.119
18.184.247.200
185.31.128.128
185.31.128.129
185.85.15.31
199.232.53.140
216.58.205.230
2600:9000:2156:be00:7:b0d4:2940:93a1
2600:9000:21f3:7800:12:5eb9:fe40:93a1
2606:4700:10::6814:15ef
2a00:1450:4001:808::2004
2a00:1450:4001:81d::2008
2a00:1450:4001:81d::200e
2a00:1450:4001:820::2003
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f02d:e:face:b00c:0:2
2a03:2880:f12d:83:face:b00c:0:25de
2a05:f500:11:101::b93f:9001
34.250.128.129
35.227.248.159
37.252.173.38
46.51.196.250
52.16.109.72
52.218.57.232
52.31.188.35
54.77.236.71
66.117.28.86
93.159.228.40
0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b
0bf7692573e7f95f9c6c0db01d41968fce7cbb83e60734e9fa2387962feffaeb
0e409bb24dfc019e40b9a9216840ae95d6ba8c6061e60e3dac334787e0d6233e
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
10fe021440d332d99601692b92772e552d9e25c4a3c0db3b6466795f578ded85
16c4241b1b765089bbceaa9dc7d7974b1f0d862ea1bb03c6c2b9478cd2bbb2f3
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
20c44a2b00fbdf68041dbfacf8b61d07267786208e0495eb8b7f15b2d26300d9
2932abf996373e87fbf2e950876b1962f1b57db954a1643ea68831d9fbb74da4
2eb62ebe67e6047c8793c5680e98c4ea45e916affe0b7961669d850b0727cd80
327262f2b3496dd8337891b4d031f547db0e674d8cdc1ebf68e627adafbf7aa9
328cf927ec01ed50d7f6c1d5e448bb00fd1111a8c3d1df651647ad602bb2f4bd
33b07014284aff324a3bec9f4b2e0469994164abbdd268a8c5c19fe8f50822f8
3402e3f06488735fc4e2401e8746bb43e0361c876cbad35f19f32a9242a9ba89
3819f3fbc20242c5a896b75e4fd23cdf0e4e1c9e45b7e8d2f6547142c5a7c073
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4463edaf7312d92f7e70f2a38dd602de9e4eed43a51fc25db6256f4615e90577
45c1573a63aaa226855a3250f90650204f12eeae085f3ab9ef45ff6aa36f5c56
47bbcad4a1caac2d6c3dda1d01badd7f6684f8c2b33f9250a3ef24451ce482ff
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d0d09a76fa93a58c941db6bd93b90b9b217f4b3d947c6bb9ef2fa9c431fc9d8
4ec9bc8732d180852e446c33ee398d0a5e1d0c35f544f0ef620fefcae0d52222
4f24864d27bfaffc860ad3f2648709b60153abbeb7ec502552ab987a18d0ff4f
50f3e8204ac912d27367dce252777fc5beb6257c7969d277cccb27f83599aaa0
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685
5f1f17e86d1fe7d3a51641559718355fa31de849f0089dcefdd3cbffc64b11a5
6b7a95fa7dd1512c7ad7e592dbf0e9288c813522c690174eeb6d2ddbb484490b
6dd21f48efae5a31b9f4042a2801d3a71f2c8c8fb93a121395dd44bf01fb37ff
75aab9b1224ca3e0d274390ce354092d249f982512069b2b4a2be69b93d7daf1
75f7ea06906b87d74e4b64f0d3c83a942ed617662aac4202cda401fa03c2a714
823c238dc56a978c81fed39b83d77f2f61ad74caa1a3401349d9f2ef260989f8
87956ecf3ee6ec4738484ed5853fb7343b04d4c5c236386ae0ed46e166d4c900
8e88598d2ac6fb99306caed497c8bda5d43f629e709996965ef99353a824ad64
8ee1560ee195270e335e7edbd741f67ca18fec678ef7e597139e1da55859432e
9060fb01746d2d2767d8bbc547fe3b8c5dc9ac671f777fede7c11a7fc3802316
9b09559d6e101bc77d5b38447b12bdedd9d27fd0bd1df89a8c37ad0b5f9d2c74
9c9069d168f386b84aa285c5f7e9e3da07d8dbbb3da2f9865316b23ebc8aa80f
9e6fe0d321b1bc161c1ade065e97d7e654851b6fb4d5da7f44931a1895f9aaed
a19066fb0c739ce42db02271c4699f9dd598afbbbb1cf76c420cd43970f07788
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
b0ecc396b775690fa99736437d90c7ced4a75c3ceeef7a9867e7ee4bc54c4891
b27f6c546b342d36a22801e2ed49f19198c486cb1559f9478e19fde10d498ed6
b652721e972ad17bfe8aab3616e4735ccf031e3ed595128c15a5c095f57c61a4
b696c6e7ce2001064fae204fb142e1af65d9e921494004403943675e97e57f48
b6e1a85cdc5508bdeaf4c92bc8d22cbda470c7a2bede43dcafb867f913d95ca1
b9559551a498fa16f275034c6f2435d48cb03c2e1c72a4cf85cd7bc4c1e84cfc
bcd0e1cccdd332747f39acd1353c48eb5a0c7dc966bb140b3f0396b649e906f5
c59f8b46f7a35dd9390725cd687138456df98c9cdb4e48c4ff9cf48021a46c16
c9c35c6377a52093f4c4f766b5c528106835a654c31b3bba5015d79826633441
cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84
d44fdf866fdd1628b3b36122ac1b19c06af70b276d7c08772d41a6f6ef304b07
d730bb6fbbbd41c6dbbc93a37860904fd6e8cdb2c3029efd2eb7104ae41586ce
d7c02bfd05f418c18d9926ecd9bb0a14da25e22bdc02ecd42c0c948940e5ba23
de892addc549d85b9fd5d5c2f77a4dd96fbe4ec11542d6cf7232fab6ccabae5d
df72f800caa45aac99fb9420624de48aa5098a67c44ca1d3e7f2b6a29d339376
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5e16e7630033f639e01830eefb07f8041b67093ed2f705c6a8f585f3ac7fba6
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ee5d976601d6164115f94cb752e7d70e1875d911f1833bb9e1d530204b050332
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f11af4e7d816fed074fe73d5f3b4173f221e321947d5e8a27893b818a580f2d8
f449a501d38b9e34f33315a7452ac78d5671e953edba65f22449cc4865815e64
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
f6e7e0830124ea580b3f0de0da80ba48a45d9df9d7c092af0f47c63ed0692578
fa95a6a57dd278f2ec6b5b9e54496026496b5482af23349d3b3c7039be31ee85

www.kaspersky.com Open in urlscan Pro 93.159.228.40 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

89 Requests

91 %HTTPS

31 %IPv6

33 Domains

42 Subdomains

34 IPs

10 Countries

2068 kBTransfer

4570 kBSize

11 Cookies

48 Outgoing links

Redirected requests

89 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.kaspersky.com Open in urlscan Pro
93.159.228.40 Public Scan

Screenshot
Live screenshot

Full Image

89
Requests

91 %
HTTPS

31 %
IPv6

33
Domains

42
Subdomains

34
IPs

10
Countries

2068 kB
Transfer

4570 kB
Size

11
Cookies

89 HTTP transactions
0 data transactions