www.denverpost.com Open in urlscan Pro
192.0.66.2 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Submission: On March 05 via manual (March 5th 2018, 8:04:48 pm UTC) from US

Summary HTTP 277 Redirects Links 45 Behaviour Indicators

Summary

This website contacted 68 IPs in 6 countries across 51 domains to perform 277 HTTP transactions. The main IP is 192.0.66.2, located in San Francisco, United States and belongs to AUTOMATTIC - Automattic, Inc, US. The main domain is www.denverpost.com.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on May 2nd 2017. Valid for: a year.

This is the only time www.denverpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
16	192.0.66.2 192.0.66.2	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
2	2.18.233.186 2.18.233.186	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	54.204.38.141 54.204.38.141	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
8	151.101.113.53 151.101.113.53	54113 (FASTLY) (FASTLY - Fastly)
2	104.20.50.244 104.20.50.244	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4	172.217.22.10 172.217.22.10	15169 (GOOGLE) (GOOGLE - Google LLC)
1	216.58.214.42 216.58.214.42	15169 (GOOGLE) (GOOGLE - Google LLC)
4 15	173.241.240.220 173.241.240.220	36089 (OPENX-AS1) (OPENX-AS1 - OPENX TECHNOLOGIES)
1 28	172.217.18.2 172.217.18.2	15169 (GOOGLE) (GOOGLE - Google LLC)
26	209.197.3.63 209.197.3.63	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
18	2.18.234.190 2.18.234.190	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1 2	2.18.234.64 2.18.234.64	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2.18.234.163 2.18.234.163	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC - Automattic)
1	54.230.92.79 54.230.92.79	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	172.217.23.168 172.217.23.168	15169 (GOOGLE) (GOOGLE - Google LLC)
1	94.31.29.16 94.31.29.16	6461 (ZAYO-6461) (ZAYO-6461 - Zayo Bandwidth)
2	151.101.113.130 151.101.113.130	() ()
22	172.217.23.163 172.217.23.163	15169 (GOOGLE) (GOOGLE - Google LLC)
13	172.217.22.2 172.217.22.2	15169 (GOOGLE) (GOOGLE - Google LLC)
13	172.217.23.162 172.217.23.162	() ()
1	52.94.218.7 52.94.218.7	() ()
1 5	172.217.22.14 172.217.22.14	15169 (GOOGLE) (GOOGLE - Google LLC)
1	52.85.184.15 52.85.184.15	() ()
1	95.172.94.21 95.172.94.21	() ()
7 14	107.178.250.234 107.178.250.234	15169 (GOOGLE) (GOOGLE - Google LLC)
2	185.60.216.19 185.60.216.19	32934 (FACEBOOK) (FACEBOOK - Facebook)
3	35.157.8.66 35.157.8.66	() ()
1 6	2.19.43.224 2.19.43.224	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 1	54.72.25.143 54.72.25.143	() ()
1 1	34.236.182.108 34.236.182.108	() ()
1 2	34.226.60.227 34.226.60.227	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2 2	66.102.1.157 66.102.1.157	15169 (GOOGLE) (GOOGLE - Google LLC)
2 3	172.217.22.4 172.217.22.4	15169 (GOOGLE) (GOOGLE - Google LLC)
2	172.217.22.3 172.217.22.3	15169 (GOOGLE) (GOOGLE - Google LLC)
1	52.85.184.252 52.85.184.252	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	52.85.184.73 52.85.184.73	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	185.60.216.35 185.60.216.35	32934 (FACEBOOK) (FACEBOOK - Facebook)
1	95.172.94.35 95.172.94.35	15570 (Internap ...) (Internap European Autonomous System)
8	52.5.12.45 52.5.12.45	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
11	172.217.23.161 172.217.23.161	15169 (GOOGLE) (GOOGLE - Google LLC)
3	54.77.82.250 54.77.82.250	() ()
5	52.5.76.191 52.5.76.191	() ()
1	2.18.234.227 2.18.234.227	() ()
2	216.137.61.227 216.137.61.227	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	54.230.93.112 54.230.93.112	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	192.0.77.48 192.0.77.48	() ()
1	104.25.149.25 104.25.149.25	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	52.7.208.137 52.7.208.137	() ()
2	34.239.50.116 34.239.50.116	() ()
1	52.3.86.250 52.3.86.250	() ()
1	52.5.130.242 52.5.130.242	() ()
4	52.6.36.75 52.6.36.75	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	216.137.61.62 216.137.61.62	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	151.101.114.2 151.101.114.2	54113 (FASTLY) (FASTLY - Fastly)
1	54.164.16.198 54.164.16.198	() ()
1	94.31.29.250 94.31.29.250	54104 (AS-STACKPATH) (AS-STACKPATH - netDNA)
4	52.48.203.249 52.48.203.249	() ()
2	54.154.35.241 54.154.35.241	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	52.70.27.99 52.70.27.99	() ()
1	172.217.23.166 172.217.23.166	15169 (GOOGLE) (GOOGLE - Google LLC)
1	95.172.94.13 95.172.94.13	27281 (QUANTCAST) (QUANTCAST - Quantcast Corporation)
2	74.201.198.92 74.201.198.92	13789 (INTERNAP-...) (INTERNAP-BLK3 - Internap Network Services Corporation)
1	34.194.12.155 34.194.12.155	() ()
2	151.101.114.107 151.101.114.107	() ()
8 9	185.94.180.125 185.94.180.125	() ()
1 1	151.101.114.49 151.101.114.49	54113 (FASTLY) (FASTLY - Fastly)
1 1	54.77.170.180 54.77.170.180	() ()
2 2	54.72.119.233 54.72.119.233	() ()
1 1	185.29.135.181 185.29.135.181	() ()
1 1	34.231.175.253 34.231.175.253	() ()
1 1	85.114.159.93 85.114.159.93	() ()
1	34.197.188.11 34.197.188.11	() ()
1	151.101.114.202 151.101.114.202	54113 (FASTLY) (FASTLY - Fastly)
1	50.17.242.191 50.17.242.191	() ()
1	52.38.152.125 52.38.152.125	() ()
277	68

16 192.0.66.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

www.denverpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.233.186 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)

cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn3.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.204.38.141 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-204-38-141.compute-1.amazonaws.com

8276234126.log.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 151.101.113.53 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

assets.digitalfirstmedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
extras.denverpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.20.50.244 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

js.appboycdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.22.10 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s14-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.214.42 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s09-in-f10.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 173.241.240.220 (New York, United States) 4 redirects

ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US)
PTR: ox-173-241-240-220.xa.dc.openx.org

digitalfirst-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 172.217.18.2 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s28-in-f2.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 209.197.3.63 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip0x03f.map2.ssl.hwcdn.net

recirculation.spot.im	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.spot.im	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.spot.im	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app-cdn.spot.im	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2.18.234.190 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)

widgets.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.234.64 (European Union) 1 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)

launch.newsinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.234.163 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)

s.ntv.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC - Automattic, Inc, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.230.92.79 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-92-79.fra2.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.168 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s22-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.31.29.16 (United Kingdom)

ASN6461 (ZAYO-6461 - Zayo Bandwidth, US)
PTR: 94.31.29.16.IPYX-077437-ZYO.above.net

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.113.130 (San Francisco, United States)

ASN- ()

dev.appboy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 172.217.23.163 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s22-in-f163.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 172.217.22.2 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s14-in-f2.1e100.net

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 172.217.23.162 (Mountain View, United States)

ASN- ()
PTR: fra15s22-in-f162.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.94.218.7 (Dublin, Ireland)

ASN- ()

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.217.22.14 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s14-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.184.15 (Seattle, United States)

ASN- ()
PTR: server-52-85-184-15.fra2.r.cloudfront.net

d31qbv1cthcecs.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.172.94.21 (United Kingdom)

ASN- ()
PTR: pixel.quantserve.com

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 107.178.250.234 (Mountain View, United States) 7 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: 234.250.178.107.bc.googleusercontent.com

js.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.60.216.19 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.157.8.66 (Frankfurt, Germany)

ASN- ()
PTR: ec2-35-157-8-66.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2.19.43.224 (European Union) 1 redirects

ASN20940 (AKAMAI-ASN1, US)

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.72.25.143 (Dublin, Ireland) 1 redirects

ASN- ()
PTR: ec2-54-72-25-143.eu-west-1.compute.amazonaws.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.236.182.108 (Ashburn, United States) 1 redirects

ASN- ()
PTR: ec2-34-236-182-108.compute-1.amazonaws.com

sync.adap.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.226.60.227 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-226-60-227.compute-1.amazonaws.com

sync.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 66.102.1.157 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: wb-in-f157.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.22.4 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s14-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.22.3 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s14-in-f3.1e100.net

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.184.252 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-85-184-252.fra2.r.cloudfront.net

certify.alexametrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.85.184.73 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-85-184-73.fra2.r.cloudfront.net

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.60.216.35 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.172.94.35 (United Kingdom)

ASN15570 (Internap European Autonomous System, GB)
PTR: pixel.quantserve.com

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 52.5.12.45 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-5-12-45.compute-1.amazonaws.com

www.i.matheranalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 172.217.23.161 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s22-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.77.82.250 (Dublin, Ireland)

ASN- ()
PTR: ec2-54-77-82-250.eu-west-1.compute.amazonaws.com

a.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 52.5.76.191 (Ashburn, United States)

ASN- ()
PTR: ec2-52-5-76-191.compute-1.amazonaws.com

track.spots.im	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.234.227 (European Union)

ASN- ()

cdn.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.137.61.227 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-216-137-61-227.fra2.r.cloudfront.net

d1z2jf7jlzjs58.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.230.93.112 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-93-112.fra2.r.cloudfront.net

cdn.listrakbi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.77.48 (San Francisco, United States)

ASN- ()
PTR: s.w.org

s.w.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.25.149.25 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

freegeoip.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.7.208.137 (Ashburn, United States)

ASN- ()
PTR: ec2-52-7-208-137.compute-1.amazonaws.com

jadserve.postrelease.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.239.50.116 (Ashburn, United States)

ASN- ()
PTR: ec2-34-239-50-116.compute-1.amazonaws.com

c.newsinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.3.86.250 (Ashburn, United States)

ASN- ()
PTR: ec2-52-3-86-250.compute-1.amazonaws.com

s1.listrakbi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.5.130.242 (Ashburn, United States)

ASN- ()
PTR: ec2-52-5-130-242.compute-1.amazonaws.com

onescript-recscont.listrakbi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.6.36.75 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-6-36-75.compute-1.amazonaws.com

at1.listrakbi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.137.61.62 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-216-137-61-62.fra2.r.cloudfront.net

d2lv4zbk7v5f93.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.114.2 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

odb.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.164.16.198 (Ashburn, United States)

ASN- ()
PTR: ec2-54-164-16-198.compute-1.amazonaws.com

srv-2018-03-05-20.config.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.31.29.250 (United Kingdom)

ASN54104 (AS-STACKPATH - netDNA, US)
PTR: 94.31.29.250.IPYX-077437-ZYO.above.net

cdn.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.48.203.249 (Dublin, Ireland)

ASN- ()
PTR: ec2-52-48-203-249.eu-west-1.compute.amazonaws.com

t.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.154.35.241 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-154-35-241.eu-west-1.compute.amazonaws.com

t.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.70.27.99 (Ashburn, United States)

ASN- ()
PTR: ec2-52-70-27-99.compute-1.amazonaws.com

c.newsinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.166 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s22-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.172.94.13 (United Kingdom)

ASN27281 (QUANTCAST - Quantcast Corporation, US)
PTR: pixel.quantserve.com

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.201.198.92 (United States)

ASN13789 (INTERNAP-BLK3 - Internap Network Services Corporation, US)

log.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.194.12.155 (Ashburn, United States)

ASN- ()
PTR: ec2-34-194-12-155.compute-1.amazonaws.com

srv-2018-03-05-20.pixel.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.114.107 (San Francisco, United States)

ASN- ()

cdns.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 185.94.180.125 (Netherlands) 8 redirects

ASN- ()

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.114.49 (San Francisco, United States) 1 redirects

ASN54113 (FASTLY - Fastly, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.77.170.180 (Dublin, Ireland) 1 redirects

ASN- ()
PTR: ec2-54-77-170-180.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.72.119.233 (Dublin, Ireland) 2 redirects

ASN- ()
PTR: ec2-54-72-119-233.eu-west-1.compute.amazonaws.com

sync.tidaltv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.29.135.181 (United Kingdom) 1 redirects

ASN- ()

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.231.175.253 (Ashburn, United States) 1 redirects

ASN- ()
PTR: ec2-34-231-175-253.compute-1.amazonaws.com

log.adap.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.114.159.93 (Germany) 1 redirects

ASN- ()
PTR: dsp.adfarm1.adition.com

dsp.adfarm1.adition.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.197.188.11 (Ashburn, United States)

ASN- ()
PTR: ec2-34-197-188-11.compute-1.amazonaws.com

vcore.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.114.202 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.17.242.191 (Ashburn, United States)

ASN- ()
PTR: ec2-50-17-242-191.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.38.152.125 (Boardman, United States)

ASN- ()
PTR: ec2-52-38-152-125.us-west-2.compute.amazonaws.com

www.summerhamster.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	380 KB
26	spot.im recirculation.spot.im www.spot.im images.spot.im app-cdn.spot.im	760 KB
22	matheranalytics.com 7 redirects js.matheranalytics.com www.i.matheranalytics.com	183 KB
22	gstatic.com fonts.gstatic.com	121 KB
22	outbrain.com widgets.outbrain.com odb.outbrain.com images.outbrain.com log.outbrain.com	300 KB
19	denverpost.com www.denverpost.com extras.denverpost.com	239 KB
17	doubleclick.net 3 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net ad.doubleclick.net cm.g.doubleclick.net	170 KB
15	openx.net 4 redirects digitalfirst-d.openx.net	63 KB
10	teads.tv a.teads.tv cdn.teads.tv t.teads.tv	162 KB
9	spotxchange.com 8 redirects sync.search.spotxchange.com	6 KB
9	google.com 2 redirects adservice.google.com www.google.com	1 KB
9	google.de adservice.google.de www.google.de	1 KB
7	listrakbi.com cdn.listrakbi.com s1.listrakbi.com onescript-recscont.listrakbi.com at1.listrakbi.com	24 KB
6	scorecardresearch.com 1 redirects sb.scorecardresearch.com	2 KB
5	spots.im track.spots.im	2 KB
5	google-analytics.com 1 redirects www.google-analytics.com	16 KB
5	newsinc.com 1 redirects launch.newsinc.com c.newsinc.com	91 KB
5	googleapis.com fonts.googleapis.com ajax.googleapis.com	37 KB
5	digitalfirstmedia.com assets.digitalfirstmedia.com	232 KB
4	connatix.com cdn.connatix.com cdns.connatix.com vcore.connatix.com	269 KB
4	cloudfront.net d31qbv1cthcecs.cloudfront.net d1z2jf7jlzjs58.cloudfront.net d2lv4zbk7v5f93.cloudfront.net	61 KB
3	postrelease.com jadserve.postrelease.com	2 KB
3	ensighten.com nexus.ensighten.com	10 KB
3	quantserve.com secure.quantserve.com pixel.quantserve.com	6 KB
3	optimizely.com cdn.optimizely.com 8276234126.log.optimizely.com cdn3.optimizely.com	67 KB
2	tidaltv.com 2 redirects sync.tidaltv.com	986 B
2	parsely.com srv-2018-03-05-20.config.parsely.com srv-2018-03-05-20.pixel.parsely.com	1 KB
2	w.org s.w.org	2 KB
2	facebook.com www.facebook.com	438 B
2	quantcount.com rules.quantcount.com	678 B
2	advertising.com 1 redirects sync.adaptv.advertising.com	1 KB
2	adap.tv 2 redirects sync.adap.tv log.adap.tv	382 B
2	adsrvr.org 2 redirects insight.adsrvr.org match.adsrvr.org	1 KB
2	facebook.net connect.facebook.net	28 KB
2	appboy.com dev.appboy.com	2 KB
2	amazon-adsystem.com c.amazon-adsystem.com aax.amazon-adsystem.com	12 KB
2	wp.com stats.wp.com pixel.wp.com	3 KB
2	googletagservices.com www.googletagservices.com	6 KB
2	appboycdn.com js.appboycdn.com	44 KB
1	summerhamster.com www.summerhamster.com	252 B
1	chartbeat.net ping.chartbeat.net	346 B
1	chartbeat.com static.chartbeat.com	13 KB
1	adition.com 1 redirects dsp.adfarm1.adition.com	492 B
1	mathtag.com 1 redirects sync.mathtag.com	470 B
1	everesttech.net 1 redirects sync-tm.everesttech.net	136 B
1	freegeoip.net freegeoip.net	566 B
1	alexametrics.com certify.alexametrics.com	528 B
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	6 KB
1	googletagmanager.com www.googletagmanager.com	49 KB
1	ntv.io s.ntv.io	74 KB
0	spotim.market Failed cdn.spotim.market Failed
277	51

	Domain	Requested by
25	pagead2.googlesyndication.com	securepubads.g.doubleclick.net pagead2.googlesyndication.com www.denverpost.com
22	fonts.gstatic.com	www.denverpost.com extras.denverpost.com app-cdn.spot.im
17	images.spot.im	pagead2.googlesyndication.com
16	images.outbrain.com	www.denverpost.com
16	www.denverpost.com	www.denverpost.com
15	digitalfirst-d.openx.net	4 redirects www.denverpost.com digitalfirst-d.openx.net
14	js.matheranalytics.com	7 redirects www.denverpost.com
13	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net www.denverpost.com
11	tpc.googlesyndication.com	securepubads.g.doubleclick.net www.denverpost.com
9	sync.search.spotxchange.com	8 redirects www.denverpost.com
8	www.i.matheranalytics.com	www.denverpost.com
7	adservice.google.de	www.googletagservices.com pagead2.googlesyndication.com
6	t.teads.tv	www.denverpost.com
6	sb.scorecardresearch.com	1 redirects www.denverpost.com www.googletagmanager.com
6	adservice.google.com	www.googletagservices.com pagead2.googlesyndication.com
5	track.spots.im	www.denverpost.com
5	www.google-analytics.com	1 redirects www.googletagmanager.com www.google-analytics.com www.denverpost.com
5	www.spot.im	www.denverpost.com recirculation.spot.im www.spot.im app-cdn.spot.im
5	assets.digitalfirstmedia.com	www.denverpost.com assets.digitalfirstmedia.com
4	at1.listrakbi.com	cdn.listrakbi.com
4	fonts.googleapis.com	www.denverpost.com extras.denverpost.com recirculation.spot.im
3	c.newsinc.com	launch.newsinc.com www.denverpost.com
3	jadserve.postrelease.com	s.ntv.io www.denverpost.com
3	app-cdn.spot.im	www.spot.im
3	a.teads.tv	www.denverpost.com cdn.teads.tv
3	www.google.com	2 redirects www.denverpost.com
3	nexus.ensighten.com	www.googletagmanager.com nexus.ensighten.com
3	extras.denverpost.com	www.denverpost.com extras.denverpost.com
2	sync.tidaltv.com	2 redirects
2	cdns.connatix.com	cdn.connatix.com
2	log.outbrain.com	widgets.outbrain.com
2	odb.outbrain.com	widgets.outbrain.com
2	s.w.org	www.denverpost.com
2	d1z2jf7jlzjs58.cloudfront.net	www.denverpost.com d1z2jf7jlzjs58.cloudfront.net
2	pixel.quantserve.com	www.denverpost.com
2	www.facebook.com	www.denverpost.com
2	rules.quantcount.com	secure.quantserve.com
2	www.google.de	www.denverpost.com
2	stats.g.doubleclick.net	2 redirects
2	sync.adaptv.advertising.com	1 redirects www.denverpost.com
2	connect.facebook.net	www.denverpost.com connect.facebook.net
2	dev.appboy.com	js.appboycdn.com www.denverpost.com
2	launch.newsinc.com	1 redirects www.denverpost.com
2	widgets.outbrain.com	www.denverpost.com widgets.outbrain.com
2	www.googletagservices.com	www.denverpost.com recirculation.spot.im
2	js.appboycdn.com	www.denverpost.com
1	www.summerhamster.com
1	ping.chartbeat.net
1	static.chartbeat.com	www.denverpost.com
1	vcore.connatix.com	cdns.connatix.com
1	dsp.adfarm1.adition.com	1 redirects
1	log.adap.tv	1 redirects
1	sync.mathtag.com	1 redirects
1	match.adsrvr.org	1 redirects
1	sync-tm.everesttech.net	1 redirects
1	cm.g.doubleclick.net	1 redirects
1	srv-2018-03-05-20.pixel.parsely.com	www.denverpost.com
1	ad.doubleclick.net	www.denverpost.com
1	cdn3.optimizely.com	d2lv4zbk7v5f93.cloudfront.net
1	cdn.connatix.com	s.ntv.io
1	srv-2018-03-05-20.config.parsely.com	d1z2jf7jlzjs58.cloudfront.net
1	d2lv4zbk7v5f93.cloudfront.net	www.googletagmanager.com
1	onescript-recscont.listrakbi.com	cdn.listrakbi.com
1	s1.listrakbi.com	cdn.listrakbi.com
1	pixel.wp.com	www.denverpost.com
1	freegeoip.net	ajax.googleapis.com
1	cdn.listrakbi.com	www.denverpost.com
1	cdn.teads.tv	a.teads.tv
1	certify.alexametrics.com	www.denverpost.com
1	sync.adap.tv	1 redirects
1	insight.adsrvr.org	1 redirects
1	secure.quantserve.com	www.googletagmanager.com
1	d31qbv1cthcecs.cloudfront.net	www.denverpost.com
1	aax.amazon-adsystem.com	c.amazon-adsystem.com
1	maxcdn.bootstrapcdn.com	js.appboycdn.com
1	www.googletagmanager.com	www.denverpost.com
1	c.amazon-adsystem.com	www.denverpost.com
1	stats.wp.com	www.denverpost.com
1	s.ntv.io	www.denverpost.com
1	recirculation.spot.im	www.denverpost.com
1	ajax.googleapis.com	www.denverpost.com
1	8276234126.log.optimizely.com	cdn.optimizely.com
1	cdn.optimizely.com	www.denverpost.com
0	cdn.spotim.market Failed	recirculation.spot.im
277	84

This site contains links to these domains. Also see Links.

Domain
preps.denverpost.com
stats.denverpost.com
theknow.denverpost.com
calendar.denverpost.com
thecannabist.co
www.gomnlt.com
video.denverpost.com
www.denverpostmemberservices.com
dpo.st
www.stumbleupon.com
www.topworkplaces.com
teads.tv
www.trendmicro.com
buffalonews.com
twitter.com
go.babbel.com
www.drogeriesuche.de
www.equedia.com
globalgrind.cassiuslife.com
www.mansionglobal.com
sn.sptrkr.com
click.clickntrax.com
www.choco-logo.com
www.outbrain.com
facebook.com
instagram.com
www.denverpoststore.com
www.dphomes.today
businessdirectory.denverpost.com
marketplaceshopping.denverpost.com
mediakit.denverpost.com
www.digitalfirstmedia.com
extras.denverpost.com
digitalfirstmedia.com
vip.wordpress.com
local.digitalfirstmedia.com

Subject Issuer	Validity	Valid
denverpost.com COMODO RSA Domain Validation Secure Server CA	`2017-05-02` - `2018-06-09`	a year	crt.sh
dfm.map.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2018-02-13` - `2018-04-05`	2 months	crt.sh

This page contains 17 frames:

Primary Page: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Frame ID: (377E8C5EAD5DEB584B0FAE93B4541D43)
Requests: 189 HTTP requests in this frame

Frame: https://extras.denverpost.com/app/mailer-rules/app-promo.html
Frame ID: (58E49AF5C754B92ADF30681B7E47B373)
Requests: 10 HTTP requests in this frame

Frame: https://extras.denverpost.com/app/in-article-promo/business-1.html
Frame ID: (DF38821980FCCA368B3880CF976F3A7F)
Requests: 8 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: (74AF9872310F2218773217601D284088)
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: (70BBCA35DA2D4101B4C1C3E9FDC1D456)
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: (76EB39A21AED20E62085BE7756D3C0CE)
Requests: 8 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: (C73342A646D66EE0D911A2378861D358)
Requests: 8 HTTP requests in this frame

Frame: https://a.teads.tv/page/50428/tag
Frame ID: (CD7A59841DD7C85D5D931BAA4A1B5C2A)
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js
Frame ID: (61853DBDDF0EAB54D8D483D923F52FC2)
Requests: 2 HTTP requests in this frame

Frame: https://cdn.spotim.market/prebid/prebid_loader.min.js?prebid=270443_140
Frame ID: (2D202C427335266FA03EAB1102B42427)
Requests: 8 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/show_ads.js
Frame ID: (49FC397F109FD122385C70F46FD77FD5)
Requests: 8 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js
Frame ID: (2CF1A082AADB1DFA67D0D11B04C2DC3F)
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js
Frame ID: (A1D39729346B6202B791D74716942F8D)
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js
Frame ID: (6C12F953CA3B94D5CF16EFDA7066F058)
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js
Frame ID: (1D498AA18C7138CC367606FD9EDCF973)
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20180228/r20110914/client/ext/m_window_focus_non_hydra.js
Frame ID: (5579A5C2BC04925B482AFFC87D5D3CDE)
Requests: 5 HTTP requests in this frame

Frame: https://cdn3.optimizely.com/js/geo2.js?cb=1520280273844
Frame ID: (3B548183B21D7DD3A6E3686DC6D19B57)
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Backbone.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

env /^Backbone$/i

Chartbeat (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^_sf_(?:endpt|async_config)$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i
env /^__google_ad_/i
env /^Goog_AdSense_/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

env /^googletag$/i
env /^google_tag_manager$/i

Hammer.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^Hammer$/i

Optimizely (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /optimizely\.com.*\.js/i
env /^optimizely$/i

Outbrain (Widgets) Expand

Overall confidence: 100%
Detected patterns

env /^(?:OutbrainPermaLink|OB_releaseVer)$/i

Parse.ly (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^PARSELY$/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^quantserve$/i

Twitter Emoji (Twemoji) (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

env /^twemoji$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

webpack (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

env /^webpackJsonp$/i

Underscore.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^Backbone$/i

Page Statistics

277
Requests

7 %
HTTPS

0 %
IPv6

51
Domains

84
Subdomains

68
IPs

6
Countries

3438 kB
Transfer

11296 kB
Size

42
Cookies

45 Outgoing links

These are links going to different origins than the main page.

URL: http://preps.denverpost.com/
Title: Preps Scoreboard

Search URL Search Domain Scan URL

URL: http://stats.denverpost.com/
Title: Scores and Standings

Search URL Search Domain Scan URL

URL: http://theknow.denverpost.com/
Title: Entertainment

Search URL Search Domain Scan URL

URL: http://calendar.denverpost.com/
Title: Calendar

Search URL Search Domain Scan URL

URL: http://theknow.denverpost.com/category/music/
Title: Music

Search URL Search Domain Scan URL

URL: http://theknow.denverpost.com/category/food/
Title: Restaurants & Dining

Search URL Search Domain Scan URL

URL: https://theknow.denverpost.com/neighborhoods/
Title: Neighborhoods

Search URL Search Domain Scan URL

URL: https://theknow.denverpost.com/outdoors/
Title: The Know Outdoors

Search URL Search Domain Scan URL

URL: http://thecannabist.co/
Title: Cannabist

Search URL Search Domain Scan URL

URL: https://www.gomnlt.com/dfm/denverpost/?utm_source=denverpost&utm_medium=navweblink&utm_campaign=dfm
Title: Freelance Jobs

Search URL Search Domain Scan URL

URL: http://video.denverpost.com/
Title: Video

Search URL Search Domain Scan URL

URL: https://www.denverpostmemberservices.com/access.aspx
Title: eEdition

Search URL Search Domain Scan URL

URL: https://www.denverpostmemberservices.com/index.aspx
Title: Subscribe/Members

Search URL Search Domain Scan URL

URL: http://dpo.st/alerts
Title: Newsletters

Search URL Search Domain Scan URL

URL: http://www.stumbleupon.com/submit?url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F
Title: Submit to Stumbleupon (Opens in new window)

Search URL Search Domain Scan URL

URL: https://www.topworkplaces.com/frontend.php/regional-list/nominate/start/denverpost

Search URL Search Domain Scan URL

URL: http://teads.tv/inread-outstream/
Title: inRead invented by Teads

Search URL Search Domain Scan URL

URL: https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/samsam-ransomware-hits-us-hospital-management-pays-55k-ransom
Title: hackers using a vendor’s name and password

Search URL Search Domain Scan URL

URL: http://buffalonews.com/2017/05/20/ecmc-got-hacked-cyber-extortionists/
Title: officials believed hackers exploited a misconfigured hospital web server

Search URL Search Domain Scan URL

URL: https://twitter.com/gadgetress
Title: Follow Tamara Chuang @gadgetress

Search URL Search Domain Scan URL

URL: https://go.babbel.com/engmag-a610-flirtwithagerman-cd-deu-ob/1_eng_out_cd?utm_source=outbrain&utm_medium=CON&utm_campaign=cd_engall_gen_cde_germanflirt&utm_term=$origsrcname$&utm_content=How+To+Flirt+With+A+German&origUrl=true
Title: Babbel How to (successfully) flirt with a German

Search URL Search Domain Scan URL

URL: http://www.drogeriesuche.de/dr-best-odol-med3/kids/index.html?utm_source=outbrain&utm_medium=cpc&utm_campaign=Outbrain_Dr.BEST_OM3_Kids&utm_content=Z%C3%A4hneputzen+bei+Kleinkindern+%E2%80%93+so+klappt%C2%B4s&utm_term=$origsrcid$&origUrl=true
Title: Drogeriesuche.de Wenn Kinder das Zähneputzen verweigern: die besten Tipps

Search URL Search Domain Scan URL

URL: https://www.equedia.com/meet-the-next-product-from-fitbit-designer/?origUrl=true
Title: Equedia How to Invest in the Next Big Product from Fitbit's Designer

Search URL Search Domain Scan URL

URL: https://globalgrind.cassiuslife.com/4245485/7-celebrity-relationships-that-didnt-make-it-into-2018/?utm_source=outbrain&utm_medium=cpc&utm_content=$section_name$&utm_campaign=top-articles.pd&origUrl=true
Title: Global Grind 7 Celebrity Relationships That Didn’t Make It Into 2018

Search URL Search Domain Scan URL

URL: http://www.mansionglobal.com/articles/30404-russian-billionaire-gets-green-light-for-upper-east-side-mega-mansion?mod=mansion_global_articles_en_wsj_home&mod=mansiongl_edit_outbrain_Dec&utm_campaign=71135&utm_term=$publisher_name$&origUrl=true
Title: Mansion Global Russian Billionaire Gets Green Light for Upper East Side Mega-Mansion

Search URL Search Domain Scan URL

URL: http://sn.sptrkr.com/9d1e6bb1?utm_source=Outbrain&utm_medium=$publisher_name$&utm_campaign=SN_DE_D_Outbrain_29353_&utm_content=006baf511ea2ce9845780de4dbbf878b8b&utm_term=$section_id$_$section_name$&origUrl=true
Title: Standard News Seltene Titanic-Fotos, die Du noch nie gesehen hast

Search URL Search Domain Scan URL

URL: http://click.clickntrax.com/7d131792-8f71-44ae-8c3b-dd085eccec22?source=$origsrcid$&ADID=Place-Here&sectionid=$section_id$&sectionname=$section_name$&publisherid=$publisher_id$&publishername=$publisher_name$&adtitle=Antivirus+software+is+not+enough+to+prevent+a+cyberattack&origUrl=true
Title: My Antivirus Review (2018) Mac Virus Protection - See Who's Rated #1.

Search URL Search Domain Scan URL

URL: https://www.choco-logo.com/bringing-chocolate-design-together?schoko_logo_de&origUrl=true
Title: www.choco-logo.com How To: Bring Chocolate & Design Together!

Search URL Search Domain Scan URL

URL: https://www.outbrain.com/what-is/default/en
Title: Recommended by

Search URL Search Domain Scan URL

URL: https://www.denverpostmemberservices.com/
Title: Member Services

Search URL Search Domain Scan URL

URL: https://facebook.com/denverpost
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/denverpost
Title: Twitter

Search URL Search Domain Scan URL

URL: https://instagram.com/denverpost
Title: Instagram

Search URL Search Domain Scan URL

URL: https://www.denverpostmemberservices.com/login.aspx?ReturnUrl=%2fSecurePage%2fVacationStop.aspx
Title: Place a Hold

Search URL Search Domain Scan URL

URL: http://www.denverpoststore.com/
Title: Denver Post Store

Search URL Search Domain Scan URL

URL: http://www.dphomes.today/
Title: Real Estate

Search URL Search Domain Scan URL

URL: https://businessdirectory.denverpost.com/marketplace/todays_ads/
Title: Today’s Ads

Search URL Search Domain Scan URL

URL: https://businessdirectory.denverpost.com/marketplace/
Title: Daily Ads

Search URL Search Domain Scan URL

URL: http://marketplaceshopping.denverpost.com/SS/Tiles.aspx?ex=specialfeatures&source=SubNav_Special_Sections
Title: Special Sections

Search URL Search Domain Scan URL

URL: http://mediakit.denverpost.com/
Title: Advertise With Us

Search URL Search Domain Scan URL

URL: http://www.digitalfirstmedia.com/careers
Title: Careers

Search URL Search Domain Scan URL

URL: http://extras.denverpost.com/mobile/index.html
Title: Mobile Apps

Search URL Search Domain Scan URL

URL: http://digitalfirstmedia.com/
Title: Copyright © 2017 Digital First Media

Search URL Search Domain Scan URL

URL: https://vip.wordpress.com/
Title: Powered by WordPress.com VIP

Search URL Search Domain Scan URL

URL: http://local.digitalfirstmedia.com/common/dfm/arbitrationandrefunds.pdf
Title: Arbitration

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 22

https://launch.newsinc.com/js/embed.js?ver=4.9.4 HTTP 307
https://launch.newsinc.com/243/js/embed.js?ver=4.9.4

Request Chain 54

https://js.matheranalytics.com/s/ma23578/239876503/sp.js?cb=1466 HTTP 301
https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js

Request Chain 57

https://sb.scorecardresearch.com/b?c1=2&c2=6035443&ns__t=1520280271550&ns_c=UTF-8&c8=CDOT%20employees%20still%20offline%20after%20SamSam%20ransomware%20virus%20attack&c7=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1520280271550&ns_c=UTF-8&c8=CDOT%20employees%20still%20offline%20after%20SamSam%20ransomware%20virus%20attack&c7=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&c9=

Request Chain 58

https://insight.adsrvr.org/track/evnt/?adv=wvvvz6x&ct=0:75j4cjk&fmt=3 HTTP 302
https://sync.adap.tv/sync?type=gif&key=thetradedesk&uid=196068f6-7675-4a2d-b6fe-d7797827bcd2 HTTP 302
https://sync.adaptv.advertising.com/sync?type=gif&key=thetradedesk&uid=196068f6-7675-4a2d-b6fe-d7797827bcd2

Request Chain 64

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j66&tid=UA-61435456-7&cid=1585394644.1520280272&jid=935295173&gjid=110481180&_gid=670420000.1520280272&_u=aGBAgEAj~&z=1851648959 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-61435456-7&cid=1585394644.1520280272&jid=935295173&_v=j66&z=1851648959 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-61435456-7&cid=1585394644.1520280272&jid=935295173&_v=j66&z=1851648959&slf_rd=1&random=1710405933

Request Chain 65

https://www.google-analytics.com/r/collect?v=1&_v=j66&a=1145802074&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&ul=en-us&de=UTF-8&dt=CDOT%20employees%20still%20offline%20after%20SamSam%20ransomware%20virus%20attack&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Scroll%20Tracking&ea=30&el=%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&_u=aGDACEAjB~&jid=1154489413&gjid=398561928&cid=1585394644.1520280272&tid=UA-61435456-7&_gid=670420000.1520280272&_r=1&gtm=G2rTLFP4R&cd2=denverpost.com&cd3=denverpost.com&cd4=&cd5=2018-02-26T11%3A59%3A11%2B00%3A00&cd6=2018-02-26T11%3A59%3A11%2B00%3A00&cd7=2018-02-26T15%3A45%3A14%2B00%3A00&cd8=&cd9=no&cd10=Colorado%20News&cd11=4.9.4&cd12=&cd13=WP&cd14=Colorado%20News&cd15=Colorado%20News&cd16=&cd17=&cd18=&cd19=&cd20=&cd21=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&cd22=samsam-ransomware-virus-cdot&cd23=2965047&cd24=article&cd25=COLORADO&cd26=Tamara%20Chuang&cd27=SamSam%20ransomware%20virus%20keeps%20CDOT%20employees%20offline%20for%20fourth%20day&cd28=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&cd29=SamSam%20ransomware%20virus%20keeps%20CDOT%20employees%20offline%20for%20fourth%20day&cd30=&cd32=p-4ctCQwtnNBNs2&cd33=Denver&cd34=true&cd35=ransomware%2C%20SamSam%2C%20CDOT%2C%20Amy%20Ford%2C%20malware%2C%20cybersecurity%2C&cd36=2440&cd37=345&cd38=Tamara%20Chuang&z=1798990604 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-61435456-7&cid=1585394644.1520280272&jid=1154489413&_gid=670420000.1520280272&gjid=398561928&_v=j66&z=1798990604 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-61435456-7&cid=1585394644.1520280272&jid=1154489413&_v=j66&z=1798990604 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-61435456-7&cid=1585394644.1520280272&jid=1154489413&_v=j66&z=1798990604&slf_rd=1&random=3932948487

Request Chain 69

https://digitalfirst-d.openx.net/w/1.0/acj?ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537064&aus=728x90%2C970x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=-7%2C192&c.pos=top_leaderboard&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1 HTTP 302
https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537064&aus=728x90%2C970x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=-7%2C192&c.pos=top_leaderboard&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1

Request Chain 70

https://digitalfirst-d.openx.net/w/1.0/acj?ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537066&aus=300x600%2C300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=1120%2C435&c.pos=Cube1_RRail_ATF&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1 HTTP 302
https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537066&aus=300x600%2C300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=1120%2C435&c.pos=Cube1_RRail_ATF&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1

Request Chain 71

https://digitalfirst-d.openx.net/w/1.0/acj?ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537067&aus=300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=1120%2C1720&c.pos=Cube2_RRail_mid&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1 HTTP 302
https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537067&aus=300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=1120%2C1720&c.pos=Cube2_RRail_mid&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1

Request Chain 72

https://digitalfirst-d.openx.net/w/1.0/acj?ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537068&aus=300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=327%2C1856&c.pos=Cube_Article&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1 HTTP 302
https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537068&aus=300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=327%2C1856&c.pos=Cube_Article&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1

Request Chain 117

https://js.matheranalytics.com/s/ma23578/239876503/sp.js?cb=1466 HTTP 301
https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js

Request Chain 122

https://js.matheranalytics.com/s/ma23578/239876503/sp.js?cb=1466 HTTP 301
https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js

Request Chain 126

https://js.matheranalytics.com/s/ma23578/239876503/sp.js?cb=1466 HTTP 301
https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js

Request Chain 130

https://js.matheranalytics.com/s/ma23578/239876503/sp.js?cb=1466 HTTP 301
https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js

Request Chain 134

https://js.matheranalytics.com/s/ma23578/239876503/sp.js?cb=1466 HTTP 301
https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js

Request Chain 168

https://js.matheranalytics.com/s/ma23578/239876503/sp.js?cb=1466 HTTP 301
https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js

Request Chain 266

https://sync.search.spotxchange.com/partner?source=pub_136839 HTTP 302
https://sync.search.spotxchange.com/partner?source=pub_136839&__user_check__=1&sync_id=6cff8e54-20b0-11e8-be65-1873cb630006 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_sc HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEPynktSjoTWTnBv19iWbKdg&google_cver=1 HTTP 302
https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Wp2i0QAAAHV6Mja8&img=1 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=spotx&ttd_puid=6cff8eb1-20b0-11e8-be65-1873cb630006 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7028&uid=196068f6-7675-4a2d-b6fe-d7797827bcd2&img=1 HTTP 302
https://sync.tidaltv.com/Spotx.ashx HTTP 302
https://sync.tidaltv.com/genericusersync.ashx?dpid=6512&s=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6512&uid=bd016b4f-e910-41fe-a52b-85c65fe50013&img=1 HTTP 302
https://sync.mathtag.com/sync/img?mt_exid=30&redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6653%26uid%3D%5BMM_UUID%5D HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6653&uid=ded75a97-0b22-4a00-84db-4f5c11da17f0 HTTP 302
https://log.adap.tv/spotx_sync HTTP 302
https://sync.adaptv.advertising.com/spotx_sync HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6920&uid=3437108335093224225-VB6b8be90a-20b0-11e8-9d8b-0acf033c15dc HTTP 302
https://dsp.adfarm1.adition.com/cookie/?ssp=14 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7577&uid=6529554070504077336

277 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/ 211 KB
42 KB 353ms
337ms Document
text/html 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL

https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx / WordPress.com VIP <https://vip.wordpress.com>

Resource Hash

5b521ba4f973ebc7db53634576a6ba801e41df2c84be5cd9c3ee50e9f2cda286

Security Headers

Name	Value
Content-Security-Policy	default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob:; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;

Request headers

:path: /2018/02/26/samsam-ransomware-virus-cdot/
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
:authority: www.denverpost.com
:scheme: https
:method: GET
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-rq: fra1 87 107 3080
server: nginx
age: 0
x-powered-by: WordPress.com VIP <https://vip.wordpress.com>
vary: Accept-Encoding
x-cache: miss
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=300, must-revalidate
content-security-policy: default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob:; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
accept-ranges: bytes
link: <https://www.denverpost.com/wp-json/>; rel="https://api.w.org/" <http://dpo.st/2F7Mk2o>; rel=shortlink

GET
H/1.1 200
OK 8276234126.js Show response
cdn.optimizely.com/js/ 180 KB
65 KB 31ms
7ms Script
text/javascript 2.18.233.186
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.optimizely.com/js/8276234126.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.233.186 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c158a2bcacfc15d0d404b9597a0d7c97f328c28aa3d4e53c483a4486289ca25a

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-amz-version-id: xSQblbM2KJL2A4sS5kSnVI1l5WdkDk_S
Content-Encoding: gzip
ETag: "7d46ea1040a78cb707d6c4d38ba8340c"
x-amz-request-id: B68D67AE36200735
x-amz-meta-revision: 10
x-amz-replication-status: COMPLETED
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 66032
x-amz-id-2: UAsBTj43oCgurP+2/8XbkT+kFZw1MNg2P/M8o9AzC37Jkio9yix5LbNa2d1DmnNnAM3/zmE0dJM=
Last-Modified: Wed, 28 Feb 2018 21:04:10 GMT
Server: AmazonS3
Date: Mon, 05 Mar 2018 20:04:31 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, HEAD
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: x-amz-meta-revision
Cache-Control: max-age=120
Accept-Ranges: bytes
Timing-Allow-Origin: *
Access-Control-Allow-Headers: *

GET
H/1.1 200
OK event Show response
8276234126.log.optimizely.com/ 2 B
684 B 476ms
113ms XHR
application/json 54.204.38.141
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://8276234126.log.optimizely.com/event?a=8276234126&d=3721770382&y=false&src=js&s8268781616=gc&s8267483531=false&s8262772133=none&s8268120246=direct&tsent=1520280271.1&n=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&u=oeu1520280271093r0.9388145189607271&wxhr=true&time=1520280271.1&f=10373463532&g=&cx2=4eebc4ba
Requested by: Host: cdn.optimizely.com
URL: https://cdn.optimizely.com/js/8276234126.js
Protocol: HTTP/1.1
Server: 54.204.38.141 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-204-38-141.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Origin: https://www.denverpost.com

Response headers

Date: Mon, 05 Mar 2018 20:04:31 GMT
Server: nginx
Access-Control-Allow-Methods: GET
P3P: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
Access-Control-Allow-Origin: https://www.denverpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Access-Control-Allow-Headers: Content-Type, X-Requested-With, X-TS-AJAX-Request
Content-Length: 2

GET
S 200 denverpost.446a000901728756fac9.css
assets.digitalfirstmedia.com/prod/static/css/ 310 KB
68 KB 164ms
141ms Stylesheet
text/css 151.101.113.53
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.digitalfirstmedia.com/prod/static/css/denverpost.446a000901728756fac9.css
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 151.101.113.53 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Apache /
Resource Hash: 95b6fcde6bda58219b57d536498f7b72f63da803f130feb7cdb57878cc204600

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
age: 128
x-cache: HIT, HIT
status: 200
content-length: 69285
x-served-by: cache-den6023-DEN, cache-hhn1542-HHN
last-modified: Mon, 26 Feb 2018 20:58:38 GMT
server: Apache
x-timer: S1520280271.134137,VS0,VE135
etag: "4d6a5-56623c62cf51d"
vary: Accept-Encoding
content-type: text/css
via: 1.1 varnish, 1.1 varnish
fastly-debug-digest: fffde95263f1c50035dc259a0e12eb2a4873844758b528c10adc75c2fe8f2763
accept-ranges: bytes
x-cache-hits: 5, 1

GET
H2 200 Connext.min.css
www.denverpost.com/wp-content/plugins/connext-wp-vip/public/css/ 134 KB
19 KB 7ms
5ms Stylesheet
text/css 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denverpost.com/wp-content/plugins/connext-wp-vip/public/css/Connext.min.css?m=1519664831g
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: e1b8e258788f759b3f38ba4bfee951217e59ac1a532c305ded9fdb7cdf8e918b

Request headers

:path: /wp-content/plugins/connext-wp-vip/public/css/Connext.min.css?m=1519664831g
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-rq: fra1 87 207 3085
last-modified: Mon, 26 Feb 2018 17:07:03 GMT
server: nginx
age: 615119
etag: W/"5a943eb7-2169c"
vary: Accept-Encoding
x-cache: hit
content-type: text/css
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 18873
expires: Tue, 05 Mar 2019 20:04:31 GMT

GET
S 200 appboy.min.css
js.appboycdn.com/web-sdk/1.6/ 42 KB
5 KB 41ms
12ms Stylesheet
text/css 104.20.50.244
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://js.appboycdn.com/web-sdk/1.6/appboy.min.css
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 104.20.50.244 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f5500bab5fdb15e1fa70b4c5e8bae7d20fed96dd8c5ae3615319922406da9b2

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 06 Oct 2017 18:19:54 GMT
server: cloudflare
x-amz-request-id: F1E4376B7E944EE5
etag: W/"3f4d7e756ec9b4609665da772b9cef98"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
status: 200
cache-control: public, max-age=14400
cf-ray: 3f6f312eecc92324-FRA
x-amz-id-2: M5kJHBUIhhwx97ux3aweLqVM8s80O4WHoU1Jvhzf8pqxFvsnXt6dYoYdZyOLOn5ZVf94LvftIxY=
expires: Tue, 06 Mar 2018 00:04:31 GMT

GET
H2 200 dfm-notifications.min.css
www.denverpost.com/wp-content/plugins/dfm-notifications/css/ 666 B
627 B 9ms
7ms Stylesheet
text/css 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denverpost.com/wp-content/plugins/dfm-notifications/css/dfm-notifications.min.css?ver=0.1.1
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 64c5e627d2faf4c759b23f188c25f2af79ea73e522d8b73b71242131c6d3534a

Request headers

:path: /wp-content/plugins/dfm-notifications/css/dfm-notifications.min.css?ver=0.1.1
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-rq: fra1 87 192 3137
last-modified: Wed, 30 Aug 2017 23:37:19 GMT
server: nginx
age: 6575144
etag: W/"59a74c2f-29a"
vary: Accept-Encoding
x-cache: hit
content-type: text/css
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 358
expires: Tue, 05 Mar 2019 20:04:31 GMT

GET
H2 200 ndn_plugin_public.css
www.denverpost.com/wp-content/plugins/inform-video-match/css/ 99 B
329 B 8ms
7ms Stylesheet
text/css 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denverpost.com/wp-content/plugins/inform-video-match/css/ndn_plugin_public.css?m=1519652683g
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 1614f0cef6ccd70588e729d301766ef768f1aeaa1d93c2299f0f7654e5baa6f0

Request headers

:path: /wp-content/plugins/inform-video-match/css/ndn_plugin_public.css?m=1519652683g
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
x-rq: fra1 87 133 3214
last-modified: Fri, 09 Feb 2018 15:43:42 GMT
server: nginx
age: 627051
etag: "5a7dc1ae-63"
x-cache: hit
content-type: text/css
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 99
expires: Tue, 05 Mar 2019 20:04:31 GMT

GET
S 200 css
fonts.googleapis.com/ 16 KB
1 KB 24ms
23ms Stylesheet
text/css 172.217.22.10
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Serif+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C700italic%7CSource+Sans+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C400italic&ver=4.9.4

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.22.10 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f10.1e100.net

Software

ESF /

Resource Hash

86e27f2a8a6f68f90a2c99a3f046c86cf1dc25adfd9b627b2a9be3ed4737c625

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
last-modified: Mon, 05 Mar 2018 20:04:31 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:31 GMT

GET
H2 200 /
www.denverpost.com/_static/ 92 KB
31 KB 9ms
8ms Stylesheet
text/css 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denverpost.com/_static/??-eJzTLy/QTc7PK0nNK9HPLdUtyClNz8wr1s9KLSlITM7Wj8/MS9Yvzk/OTMzRzclPzy9G4ejlZubpJRcX6+jjNwWoBMYGKbfPtTU0NbQwMDY1NrAEAFc6Lt4=
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: af39052168c97b7c55a3e184a79d70609abd2cf78f7dc808ea3584b1f7bc240a

Request headers

:path: /_static/??-eJzTLy/QTc7PK0nNK9HPLdUtyClNz8wr1s9KLSlITM7Wj8/MS9Yvzk/OTMzRzclPzy9G4ejlZubpJRcX6+jjNwWoBMYGKbfPtTU0NbQwMDY1NrAEAFc6Lt4=
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: www.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-rq: fra1 87 133 3214
last-modified: Wed, 07 Feb 2018 20:28:09 GMT
server: nginx
age: 1011742
vary: Accept-Encoding
x-cache: hit
content-type: text/css;charset=utf-8
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 31963

GET
S 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.3/ 94 KB
33 KB 7ms
6ms Script
text/javascript 216.58.214.42
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

216.58.214.42 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s09-in-f10.1e100.net

Software

sffe /

Resource Hash

aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Sat, 03 Feb 2018 15:06:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2609856
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 33507
x-xss-protection: 1; mode=block
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 03 Feb 2019 15:06:55 GMT

GET
H2 200 / Show response
www.denverpost.com/_static/ 8 KB
3 KB 12ms
11ms Script
application/x-javascript 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denverpost.com/_static/??-eJzTLy/QTc7PK0nNK9EvyClNz8wr1k9M0c1JrEwtKtbPQuLopqQV6GUV6+gTrQOo2j7X1tDU0NLM1MjMwjgLAKw5JsU=
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 486e7061a989cf1c6834390c0fdc9a8d181f9179efe68fe8c35c254ff2d49de6

Request headers

:path: /_static/??-eJzTLy/QTc7PK0nNK9EvyClNz8wr1k9M0c1JrEwtKtbPQuLopqQV6GUV6+gTrQOo2j7X1tDU0NLM1MjMwjgLAKw5JsU=
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-rq: fra1 86 199 3145
last-modified: Fri, 09 Feb 2018 11:44:41 GMT
server: nginx
age: 627051
vary: Accept-Encoding
x-cache: hit
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 2421

GET
H2 200 appboy.min.js Show response
www.denverpost.com/wp-content/plugins/dfm-notifications/js/ 4 KB
2 KB 8ms
7ms Script
application/x-javascript 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denverpost.com/wp-content/plugins/dfm-notifications/js/appboy.min.js?ver=0.2.2
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 218ed570a598ad8820ebf94fdb0c29243daee25a643490493dc72a0ff54c8051

Request headers

:path: /wp-content/plugins/dfm-notifications/js/appboy.min.js?ver=0.2.2
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-rq: fra1 86 175 3114
last-modified: Thu, 22 Feb 2018 20:17:26 GMT
server: nginx
age: 943686
etag: W/"5a8f2556-eb3"
vary: Accept-Encoding
x-cache: hit
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1373
expires: Tue, 05 Mar 2019 20:04:31 GMT

GET
H2 200 ndn_plugin_public.js Show response
www.denverpost.com/wp-content/plugins/inform-video-match/js/ 3 KB
1 KB 12ms
12ms Script
application/x-javascript 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denverpost.com/wp-content/plugins/inform-video-match/js/ndn_plugin_public.js?m=1519652683g
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: e29e9492510632ea5536cc7b835e38ec441095e03f836d82ffd28963a562d3b8

Request headers

:path: /wp-content/plugins/inform-video-match/js/ndn_plugin_public.js?m=1519652683g
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-rq: fra1 87 24 3113
last-modified: Mon, 12 Feb 2018 15:19:51 GMT
server: nginx
age: 627051
etag: W/"5a81b097-a80"
vary: Accept-Encoding
x-cache: hit
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1112
expires: Tue, 05 Mar 2019 20:04:31 GMT

GET
H/1.1 200
OK jstag Show response
digitalfirst-d.openx.net/w/1.0/ 161 KB
55 KB 90ms
37ms Script
text/javascript 173.241.240.220
OPENX TECHNOLOGIES

General

Check archive.org

Show headers Download Go to

Full URL: https://digitalfirst-d.openx.net/w/1.0/jstag?nc=8013-denverpost
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS: ox-173-241-240-220.xa.dc.openx.org
Software: OXGW/13.4.1 /
Resource Hash: 5c8c495016572ba460b4bf0099398fb114114a1f1ea52585cab4f5259bad751a

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:31 GMT
Content-Encoding: gzip
Server: OXGW/13.4.1
Vary: Accept-Encoding
P3P: CP="CUR ADM OUR NOR STA NID"
Cache-Control: max-age=3600
Content-Type: text/javascript
Content-Length: 56000
Expires: Mon, 05 Mar 2018 21:04:31 GMT

GET
S 200 gpt.js Show response
www.googletagservices.com/tag/js/ 13 KB
6 KB 58ms
40ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

sffe /

Resource Hash

8ba355d714c3387de480eaf201e6ea065f1466ce2f963fde40d34b6410087e32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "2 / 367 of 1000 / last-modified: 1520266333"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 5861
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:31 GMT

GET
H2 200 wp-emoji-release.min.js Show response
www.denverpost.com/wp-includes/js/ 11 KB
4 KB 6ms
6ms Script
application/x-javascript 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denverpost.com/wp-includes/js/wp-emoji-release.min.js?ver=4.9.4
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 3d8e94fed6cc8ea56ee5ec6174efb68cb7197d2e729149cb43e85505bf175779

Request headers

:path: /wp-includes/js/wp-emoji-release.min.js?ver=4.9.4
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-rq: fra1 89 108 3165
last-modified: Tue, 06 Feb 2018 21:10:35 GMT
server: nginx
age: 2313035
etag: W/"5a7a19cb-2dc9"
vary: Accept-Encoding
x-cache: hit
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 4261
expires: Tue, 05 Mar 2019 20:04:31 GMT

GET
H2 200 twp_denver_2018_aw.jpg
www.denverpost.com/wp-content/uploads/2017/09/ 51 KB
51 KB 6ms
3ms Image
image/jpeg 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.denverpost.com/wp-content/uploads/2017/09/twp_denver_2018_aw.jpg

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),

Reverse DNS

Software

nginx /

Resource Hash

65a01d4df9fe556adcbdfd0f5feeedcce739854cd808d46767eb02b095bc254b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /wp-content/uploads/2017/09/twp_denver_2018_aw.jpg
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.denverpost.com
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
x-rq: fra1 88 47 443
x-content-type-options: nosniff
last-modified: Thu, 28 Sep 2017 17:48:02 GMT
server: nginx
age: 1461418
etag: "c465457b2f84b59b"
x-cache: hit
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 51992
expires: Sat, 16 Feb 2019 22:07:32 GMT

GET
H/1.1 200
OK sp_sXPv48AD Show response
recirculation.spot.im/spot/ 327 KB
82 KB 1032ms
999ms Script
text/javascript 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://recirculation.spot.im/spot/sp_sXPv48AD
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 412a16c7fd20f47028cca3bfa3a60008d194b7bdcc44d838b29d56205f8cabc1

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Mar 2018 20:04:31 GMT
X-Spotim-U: spotGroup=NO_GROUP / /spot/sp_sXPv48AD
Etag: W/"51b60-Dw17Gce9USU7ShBHSiM6Uw"
X-Spotim-T: 20:04:31 5-3 / 13:49:30 1-3
X-Spotim-V: 485 / 3.3.13
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: s-maxage=60s
X-Spotim-Now: Mon Mar 05 2018 20:04:31 GMT+0000 (UTC)
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 83215
X-HW: 1520280271.dop004.fr8.t,1520280271.cds009.fr8.shn,1520280271.dop004.fr8.t,1520280271.cds042.fr8.e

GET
H/1.1 200
OK outbrain.js Show response
widgets.outbrain.com/ 63 KB
24 KB 40ms
11ms Script
application/x-javascript 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/outbrain.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: 7a0f7fb4389375f867dbe1a0b37c434225fd8902ec49c5de0416727e6ee31d45

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:31 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Mar 2018 15:03:34 GMT
Server: Apache
ETag: "c2b70493e7fd0b830e91cb83938712b7:1520262214"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *, *
Cache-Control: max-age=604800
Access-Control-Allow-Credentials: false
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 23658

GET
H2 200 loading.gif
www.denverpost.com/wp-content/mu-plugins/jetpack/modules/sharedaddy/images/ 2 KB
3 KB 15ms
11ms Image
image/gif 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.denverpost.com/wp-content/mu-plugins/jetpack/modules/sharedaddy/images/loading.gif
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82

Request headers

:path: /wp-content/mu-plugins/jetpack/modules/sharedaddy/images/loading.gif
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
x-rq: fra1 86 168 3248
last-modified: Fri, 07 Apr 2017 03:55:12 GMT
server: nginx
age: 14402812
etag: "58e70da0-9e2"
x-cache: hit
content-type: image/gif
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 2530
expires: Tue, 05 Mar 2019 20:04:31 GMT

GET
H/1.1 200
OK bundle.js Show response
www.spot.im/launcher/ 97 KB
32 KB 42ms
8ms Script
application/javascript 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.spot.im/launcher/bundle.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 30aad5d987fdb5c9a4aa104dd98d6e6a69d4dbe81d26716c98b6c466a2f3caef

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:31 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Mar 2018 13:59:45 GMT
ETag: 1520171985
X-HW: 1520280271.dop004.fr8.t,1520280271.cds034.fr8.shn,1520280271.dop004.fr8.t,1520280271.cds029.fr8.c
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=145
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 32661

GET
H2 200 / Show response
www.denverpost.com/_static/ 213 KB
60 KB 9ms
5ms Script
application/x-javascript 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denverpost.com/_static/??/wp-content/plugins/connext-wp-vip/public/js/Connext.min.js,/wp-content/client-mu-plugins/src/Paywall/static/js/connext-paywall-analytics.min.js?m=1519664843j
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: ff8789fd23d4f52bad228f345b4340e6d3d7ece437cf5d1e232ba1ea381204ee

Request headers

:path: /_static/??/wp-content/plugins/connext-wp-vip/public/js/Connext.min.js,/wp-content/client-mu-plugins/src/Paywall/static/js/connext-paywall-analytics.min.js?m=1519664843j
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-rq: fra1 87 133 3214
last-modified: Mon, 26 Feb 2018 17:07:21 GMT
server: nginx
age: 615116
vary: Accept-Encoding
x-cache: hit
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 61467

GET
H/1.1

200
OK

embed.js Show response
launch.newsinc.com/243/js/
Redirect Chain

https://launch.newsinc.com/js/embed.js?ver=4.9.4
https://launch.newsinc.com/243/js/embed.js?ver=4.9.4

264 KB
90 KB

19ms
18ms

Script
application/javascript

2.18.234.64
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://launch.newsinc.com/243/js/embed.js?ver=4.9.4
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.64 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 09af2f4683ff34575485ca709d03d5fc5ab6cf330aecb7e0f20bc077fe997af5

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:31 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Mar 2018 19:05:39 GMT
Server: AmazonS3
x-amz-request-id: AF546B2CD9721764
ETag: "52b497405a6e729a46874e30e8c9fa27"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *, *
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Accept-Ranges: bytes
x-amz-id-2: hDkaGtrD6lV8n4DvvQ2etdNdFbtQfeFDh/bthTpyOWTNfgcRcJQRchrMHqSSQ+BqSdk/+rrjDZk=
Expires: Mon, 12 Mar 2018 20:04:31 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:31 GMT
Server: Apache/2.4.16 (Amazon) mod_wsgi/3.5 Python/2.7.10
ETag: "d41d8cd98f00b204e9800998ecf8427e"
x-ndn-redirect-proxy: VersionDistributed cache Hit from: i-09b9f6398add9190f
Location: /243/js/embed.js?ver=4.9.4
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
Expires: Mon, 05 Mar 2018 20:04:31 GMT

GET
H2 200 / Show response
www.denverpost.com/_static/ 17 KB
8 KB 13ms
9ms Script
application/x-javascript 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denverpost.com/_static/??/wp-content/plugins/photonfill/js/picturefill.min.js,/wp-content/plugins/photonfill/js/lazysizes.min.js?m=1519652683j
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 52f35b7f628b93dd17c3e40714ecd702bcba145ef3f1a4b537c35d81d0c472fa

Request headers

:path: /_static/??/wp-content/plugins/photonfill/js/picturefill.min.js,/wp-content/plugins/photonfill/js/lazysizes.min.js?m=1519652683j
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-rq: fra1 87 107 3080
last-modified: Mon, 26 Feb 2018 13:44:43 GMT
server: nginx
age: 627051
vary: Accept-Encoding
x-cache: hit
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 7532

GET
H2 200 ads.js Show response
www.denverpost.com/wp-content/themes/wp-mason/static/js/ 87 B
328 B 13ms
10ms Script
application/x-javascript 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denverpost.com/wp-content/themes/wp-mason/static/js/ads.js?ver=1.0
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969

Request headers

:path: /wp-content/themes/wp-mason/static/js/ads.js?ver=1.0
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
x-rq: fra1 87 26 3098
last-modified: Wed, 24 Jan 2018 22:26:21 GMT
server: nginx
age: 3447166
etag: "5a69080d-57"
x-cache: hit
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 87
expires: Tue, 05 Mar 2019 20:04:31 GMT

GET
S 200 common.446a000901728756fac9.min.js Show response
assets.digitalfirstmedia.com/prod/static/js/ 348 KB
154 KB 10ms
6ms Script
application/javascript 151.101.113.53
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.digitalfirstmedia.com/prod/static/js/common.446a000901728756fac9.min.js?ver=1.0
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 151.101.113.53 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Apache /
Resource Hash: babf6bf06610b17476f36a9cc4ef902267a10ebba74946bf03f2c36b673b2013

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
age: 609
x-cache: HIT, HIT
status: 200
content-length: 157577
x-served-by: cache-den6021-DEN, cache-hhn1542-HHN
last-modified: Mon, 26 Feb 2018 20:58:38 GMT
server: Apache
x-timer: S1520280271.179831,VS0,VE0
etag: "56e66-56623c62cf51d"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
fastly-debug-digest: c1eaa7228ab908cad7f54f722909fa49ff64d5c8b73e70fecff4e8f6b3f29e7a
accept-ranges: bytes
x-cache-hits: 22, 3

GET
S 200 denverpost.446a000901728756fac9.min.js Show response
assets.digitalfirstmedia.com/prod/static/js/ 797 B
667 B 20ms
16ms Script
application/javascript 151.101.113.53
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.digitalfirstmedia.com/prod/static/js/denverpost.446a000901728756fac9.min.js?ver=1.0
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 151.101.113.53 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Apache /
Resource Hash: 0bfe338b42b2f3a8b4eddd75ab503ce19d504dfbb3c89703527658ae264261d5

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
age: 525
x-cache: HIT, HIT
status: 200
content-length: 501
x-served-by: cache-den6025-DEN, cache-hhn1542-HHN
last-modified: Mon, 26 Feb 2018 20:58:38 GMT
server: Apache
x-timer: S1520280271.179906,VS0,VE0
etag: "31d-56623c62cf51d"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
fastly-debug-digest: 771dd343c26a90dbab784888a94357f73285e7ed03889c613748a35262b34fe5
accept-ranges: bytes
x-cache-hits: 3, 1

GET
H2 200 global.min.js Show response
www.denverpost.com/wp-content/themes/wp-mason/static/js/ 1 KB
941 B 14ms
10ms Script
application/x-javascript 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denverpost.com/wp-content/themes/wp-mason/static/js/global.min.js?m=1519652683g
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 6eeb088fc5152383f9e6204063cd4da6a863a071c6b64ffbf5e979cd7b6bffae

Request headers

:path: /wp-content/themes/wp-mason/static/js/global.min.js?m=1519652683g
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-rq: fra1 86 199 3145
last-modified: Fri, 09 Feb 2018 11:44:41 GMT
server: nginx
age: 627051
etag: W/"5a7d89a9-4e0"
vary: Accept-Encoding
x-cache: hit
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 662
expires: Tue, 05 Mar 2019 20:04:31 GMT

GET
H/1.1 200
OK load.js Show response
s.ntv.io/serve/ 245 KB
74 KB 62ms
26ms Script
application/x-javascript 2.18.234.163
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s.ntv.io/serve/load.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.163 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 597a1d464d0f871e6d60e1689b29e0bb8bb6877086c2f45bcd68d516004f4fe9

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:31 GMT
Content-Encoding: gzip
x-amz-request-id: F4CEBDCB16717BEC
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
x-amz-id-2: t60e15mTnvfmHHfNpwLzO0q4xknpAKySCQUN7fWheFLUQ+2OQbwdG1w6y18+K8amBeP5octDzDQ=
Last-Modified: Thu, 01 Mar 2018 19:08:09 GMT
Server: AmazonS3
ETag: "ae08e5a840a758e30813e5728d6a2dae"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2 200 / Show response
www.denverpost.com/_static/ 10 KB
3 KB 14ms
11ms Script
application/x-javascript 192.0.66.2
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://www.denverpost.com/_static/??/wp-includes/js/wp-embed.min.js,/wp-content/mu-plugins/jetpack/_inc/build/sharedaddy/sharing.min.js?m=1517951435j
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: 562d5cfee4e51ada23bce977138975b55ebc5373e94674ba94610fca655d05f1

Request headers

:path: /_static/??/wp-includes/js/wp-embed.min.js,/wp-content/mu-plugins/jetpack/_inc/build/sharedaddy/sharing.min.js?m=1517951435j
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-rq: fra1 86 199 3145
last-modified: Tue, 06 Feb 2018 21:10:30 GMT
server: nginx
age: 1013484
vary: Accept-Encoding
x-cache: hit
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 3349

GET
S 200 e-201810.js Show response
stats.wp.com/ 8 KB
3 KB 36ms
6ms Script
application/x-javascript 192.0.76.3
Automattic

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-201810.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: aea0c8ddd84132838fcee935f9d827ec5f7ba116e443b25db7a5bcc944cbe914

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
server: nginx
etag: W/"5a0c8e17-3298"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=31536000
expires: Mon, 18 Feb 2019 14:01:36 GMT

GET
S 200 appboy.min.js Show response
js.appboycdn.com/web-sdk/2.0/ 148 KB
39 KB 20ms
20ms Script
application/javascript 104.20.50.244
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://js.appboycdn.com/web-sdk/2.0/appboy.min.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/wp-content/plugins/dfm-notifications/js/appboy.min.js?ver=0.2.2
Protocol: SPDY
Server: 104.20.50.244 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5f1b54da88912b1c3881a137cd47c0364ba9d742fe22ab71b0354bb6e625a17

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 31 Jan 2018 16:42:24 GMT
server: cloudflare
x-amz-request-id: EF5349F7A83A36ED
etag: W/"6d1e9feae7338ff9e67a3fd5bc0be72c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: public, max-age=14400
cf-ray: 3f6f312f3ced2324-FRA
x-amz-id-2: Qc7mATqbcFZEd/PhpLWmMNrPmV2T5XdmYe2fl2lZwSnHyMvy9HdQQRvsBhVzDJjRfIpPqeO9WnE=
expires: Tue, 06 Mar 2018 00:04:31 GMT

GET
H/1.1 200
OK apstag.js Show response
c.amazon-adsystem.com/aax2/ 37 KB
11 KB 66ms
30ms Script
application/javascript 54.230.92.79
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 54.230.92.79 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-92-79.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 86f892b2ffb50310d8240890df542d93557460b31f24e8d4dd7fe07cd1decec5

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 17:54:19 GMT
Content-Encoding: gzip
Server: Server
Age: 7811
ETag: 1602561408e364685656a17663bc1c8f
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 e72ed739d85b0c5633dfd1f214a1adca.cloudfront.net (CloudFront)
Cache-Control: public, max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
X-Amz-Cf-Id: GVDKRJmcWV-rYcNL5KHCBfqgruDG6xTyS5ahB54Px6Dv72MpuSxYHw==

GET
S 200 gtm.js Show response
www.googletagmanager.com/ 198 KB
49 KB 16ms
15ms Script
application/javascript 172.217.23.168
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.168 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f8.1e100.net

Software

Google Tag Manager (scaffolding) /

Resource Hash

37b9e02b97d23ed896aeca78b49babae4316f72db0b105d91b0e9712a580afcf

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
server: Google Tag Manager (scaffolding)
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 50257
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:31 GMT

GET
S 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/ 23 KB
6 KB 22ms
6ms Stylesheet
text/css 94.31.29.16
Zayo Bandwidth

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/font-awesome.min.css
Requested by: Host: js.appboycdn.com
URL: https://js.appboycdn.com/web-sdk/2.0/appboy.min.js
Protocol: SPDY
Server: 94.31.29.16 , United Kingdom, ASN6461 (ZAYO-6461 - Zayo Bandwidth, US),
Reverse DNS: 94.31.29.16.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
last-modified: Sat, 17 Feb 2018 21:46:17 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"04425bbdc6243fc6e54bf8984fe50330"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31104000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
expires: Thu, 28 Feb 2019 20:04:31 GMT

OPTIONS
H/1.1 200
OK / Show response
dev.appboy.com/api/v3/data/ 0
733 B 124ms
100ms XHR
text/plain 151.101.113.130

General

Check archive.org

Show headers Download Go to

Full URL

https://dev.appboy.com/api/v3/data/

Requested by

Host: js.appboycdn.com
URL: https://js.appboycdn.com/web-sdk/2.0/appboy.min.js

Protocol

HTTP/1.1

Server

151.101.113.130 San Francisco, United States, ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Access-Control-Request-Method: POST
Origin: https://www.denverpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Access-Control-Request-Headers: content-type,x-braze-api-key,x-braze-datarequest,x-braze-triggersrequest,x-requested-with

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: MISS
Connection: keep-alive
Content-Length: 20
Via: 1.1 varnish
X-Served-By: cache-hhn1538-HHN
Server: nginx
X-Timer: S1520280271.352378,VS0,VE94
Date: Mon, 05 Mar 2018 20:04:31 GMT
Access-Control-Max-Age: 1728000
Access-Control-Allow-Methods: POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.denverpost.com
Access-Control-Expose-Headers
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: content-type,x-braze-api-key,x-braze-datarequest,x-braze-triggersrequest,x-requested-with
X-Cache-Hits: 0

GET
S 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v11/ 12 KB
12 KB 7ms
6ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v11/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

a0066433a645f196eb0ece299c86dc27a5c74dbe2cae7ae6d9211c1549a92085

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Source+Serif+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C700italic%7CSource+Sans+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C400italic&ver=4.9.4
Origin: https://www.denverpost.com

Response headers

date: Thu, 08 Feb 2018 18:01:43 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 18:26:10 GMT
server: sffe
age: 2167368
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 12600
x-xss-protection: 1; mode=block
expires: Fri, 08 Feb 2019 18:01:43 GMT

GET
DATA 200
OK truncated
/ 9 KB
0 Font
font/truetype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 182abb62bdb40059dbda691bf6631cf6b471499a85971a5fd04832453d7b4141

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Origin: https://www.denverpost.com

Response headers

Access-Control-Allow-Origin: *
Content-Type: font/truetype

GET
S 200 neIXzD-0qpwxpaWvjeD0X88SAOeasasatSyqxKcsdrM.woff2
fonts.gstatic.com/s/sourceserifpro/v5/ 15 KB
15 KB 9ms
9ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourceserifpro/v5/neIXzD-0qpwxpaWvjeD0X88SAOeasasatSyqxKcsdrM.woff2

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

29001964c73b80381ab43142b3d2371025e8ce2a43b1b8d4630d5db19f3b4ff0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Source+Serif+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C700italic%7CSource+Sans+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C400italic&ver=4.9.4
Origin: https://www.denverpost.com

Response headers

date: Mon, 12 Feb 2018 15:56:24 GMT
x-content-type-options: nosniff
last-modified: Tue, 10 Oct 2017 23:06:45 GMT
server: sffe
age: 1829287
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 15556
x-xss-protection: 1; mode=block
expires: Tue, 12 Feb 2019 15:56:24 GMT

GET
S 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
fonts.gstatic.com/s/sourcesanspro/v11/ 13 KB
13 KB 7ms
7ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v11/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

547ea67155dac1c27efb550426c4848b7364357ed040fd531719c4797e356a1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Source+Serif+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C700italic%7CSource+Sans+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C400italic&ver=4.9.4
Origin: https://www.denverpost.com

Response headers

date: Thu, 08 Feb 2018 18:01:43 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 18:25:48 GMT
server: sffe
age: 2167368
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 12960
x-xss-protection: 1; mode=block
expires: Fri, 08 Feb 2019 18:01:43 GMT

GET
S 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v11/ 13 KB
13 KB 6ms
6ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v11/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu3cOWxw.woff2

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

4a58441133d85539974e4b136c25eaa5512ac1b018d4f6d53124a08c6f19b55e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Source+Serif+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C700italic%7CSource+Sans+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C400italic&ver=4.9.4
Origin: https://www.denverpost.com

Response headers

date: Thu, 08 Feb 2018 18:35:41 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 18:25:50 GMT
server: sffe
age: 2165330
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 12916
x-xss-protection: 1; mode=block
expires: Fri, 08 Feb 2019 18:35:41 GMT

GET
S 200 neIXzD-0qpwxpaWvjeD0X88SAOeasc8btSyqxKcsdrM.woff2
fonts.gstatic.com/s/sourceserifpro/v5/ 14 KB
15 KB 7ms
7ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourceserifpro/v5/neIXzD-0qpwxpaWvjeD0X88SAOeasc8btSyqxKcsdrM.woff2

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

7cf9f1b809e02b135c7d88f5aca64d40a4bbea3cc31bf3aa9433cf3f6e03adb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Source+Serif+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C700italic%7CSource+Sans+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C400italic&ver=4.9.4
Origin: https://www.denverpost.com

Response headers

date: Thu, 08 Feb 2018 23:04:49 GMT
x-content-type-options: nosniff
last-modified: Tue, 10 Oct 2017 23:07:55 GMT
server: sffe
age: 2149182
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 14780
x-xss-protection: 1; mode=block
expires: Fri, 08 Feb 2019 23:04:49 GMT

GET
S 200 neIQzD-0qpwxpaWvjeD0X88SAOeauXQ-oAGIyY0.woff2
fonts.gstatic.com/s/sourceserifpro/v5/ 15 KB
15 KB 8ms
8ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourceserifpro/v5/neIQzD-0qpwxpaWvjeD0X88SAOeauXQ-oAGIyY0.woff2

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

858c43f311dc3adb895f69ee9e3fbed55e6dc98c83ac0f2af877ad43ce23b017

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Source+Serif+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C700italic%7CSource+Sans+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C400italic&ver=4.9.4
Origin: https://www.denverpost.com

Response headers

date: Mon, 12 Feb 2018 17:23:12 GMT
x-content-type-options: nosniff
last-modified: Tue, 10 Oct 2017 23:08:06 GMT
server: sffe
age: 1824079
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 15356
x-xss-protection: 1; mode=block
expires: Tue, 12 Feb 2019 17:23:12 GMT

GET
DATA 200
OK truncated
/ 10 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2590d66919bcebebcab8820a8e98a672c795c718f39f53d1c62cdd26ced8660b

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/svg+xml

GET
S 200 integrator.js Show response
adservice.google.de/adsid/ 108 B
174 B 19ms
17ms Script
application/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.denverpost.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 integrator.js Show response
adservice.google.com/adsid/ 108 B
174 B 19ms
17ms Script
application/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.denverpost.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 pubads_impl_184.js Show response
securepubads.g.doubleclick.net/gpt/ 183 KB
65 KB 79ms
41ms Script
text/javascript 172.217.23.162

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

SPDY

Server

172.217.23.162 Mountain View, United States, ASN (),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

sffe /

Resource Hash

1561317977e581c66b370d63a2b3a33cd4dd012b572867960f06c541ffac9064

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 02 Mar 2018 02:33:46 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 65676
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:31 GMT

GET
H/1.1 200
OK bid Show response
aax.amazon-adsystem.com/e/dtb/ 129 B
455 B 206ms
96ms XHR
text/javascript 52.94.218.7

General

Check archive.org

Show headers Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=3391&u=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&pid=333049217831520280271455&cb=6732359385371520280271456&ws=1600x1200&v=6.3.2&t=2000&slots=%5B%7B%22sd%22%3A%22div-gpt-ad-interstitial%22%2C%22s%22%3A%5B%221x1%22%5D%7D%2C%7B%22sd%22%3A%22div-gpt-ad-top_leaderboard%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%2C%22970x30%22%2C%22300x50%22%2C%22320x50%22%2C%22320x100%22%5D%7D%2C%7B%22sd%22%3A%22div-gpt-ad-Cube1_RRail_ATF%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%2C%22300x1050%22%5D%7D%2C%7B%22sd%22%3A%22div-gpt-ad-Cube2_RRail_mid%22%2C%22s%22%3A%5B%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22div-gpt-ad-Cube3_RRail_lower%22%2C%22s%22%3A%5B%22300x250%22%5D%7D%2C%7B%22sd%22%3A%22div-gpt-ad-bottom_leaderboard%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%2C%22320x50%22%2C%22320x100%22%5D%7D%5D&cfgv=0
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: HTTP/1.1
Server: 52.94.218.7 Dublin, Ireland, ASN (),
Reverse DNS
Software: Server /
Resource Hash: fe4b3126024ae26e4dd61ff70ca74e4f38a4523958eaf987021f7f4ba7ea0f81

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Origin: https://www.denverpost.com

Response headers

Date: Mon, 05 Mar 2018 20:04:31 GMT
Content-Encoding: gzip
Server: Server
Vary: Accept-Encoding,User-Agent
Content-Type: text/javascript;charset=UTF-8
Access-Control-Allow-Origin: https://www.denverpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 138

GET
H2 200 app-promo.html Show response
extras.denverpost.com/app/mailer-rules/ Frame (58E 4 KB
2 KB 124ms
11ms Document
text/html 151.101.113.53
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://extras.denverpost.com/app/mailer-rules/app-promo.html
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.53 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 5e64ac0eae117c38b3a8efb18ec4655a2226a35ee6db7e207d062c8cd5934b1c

Request headers

:path: /app/mailer-rules/app-promo.html
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: extras.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Upgrade-Insecure-Requests: 1
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
via: AX-CACHE-2.7:141 1.1 varnish 1.1 varnish
age: 883
x-powered-by: ASP.NET
x-cache: HIT, HIT
status: 200
content-encoding: gzip
content-length: 1536
x-served-by: cache-den6026-DEN, cache-hhn1542-HHN
last-modified: Mon, 18 Dec 2017 17:25:37 GMT
server: Microsoft-IIS/8.5
x-timer: S1520280271.398984,VS0,VE6
vary: Accept-encoding, Accept-Encoding
content-type: text/html
fastly-debug-digest: 5a4811eaa86649d5a46b92e46a5ceb10786562e6beaf599de520fbaa6b4c3936
accept-ranges: bytes
x-cache-hits: 7, 1

GET
H2 200 business-1.html Show response
extras.denverpost.com/app/in-article-promo/ Frame (DF3 3 KB
1 KB 125ms
11ms Document
text/html 151.101.113.53
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://extras.denverpost.com/app/in-article-promo/business-1.html
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.53 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 2b91cdc25ce3367fcb582096d46f67158300f452b14b5975c02bd071799937d8

Request headers

:path: /app/in-article-promo/business-1.html
pragma: no-cache
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: extras.denverpost.com
referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
:scheme: https
:method: GET
Upgrade-Insecure-Requests: 1
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
age: 142
x-powered-by: ASP.NET
x-cache: HIT, HIT
status: 200
content-length: 1255
x-served-by: cache-den6022-DEN, cache-hhn1542-HHN
last-modified: Mon, 05 Mar 2018 19:50:15 GMT
server: Microsoft-IIS/8.5
x-timer: S1520280271.399000,VS0,VE6
vary: Accept-encoding, Accept-Encoding
content-type: text/html
via: 1.1 varnish 1.1 varnish
fastly-debug-digest: 5520e51e5dab2e84e13b71decd40d744d0f1b469d512653c96d1dbcda60c2f54
accept-ranges: bytes
x-cache-hits: 3, 1

POST
H/1.1 201
Created / Show response
dev.appboy.com/api/v3/data/ 294 B
1 KB 117ms
117ms XHR
application/json 151.101.113.130

General

Check archive.org

Show headers Download Go to

Full URL

https://dev.appboy.com/api/v3/data/

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

HTTP/1.1

Server

151.101.113.130 San Francisco, United States, ASN (),

Reverse DNS

Software

nginx /

Resource Hash

c838662f89269e6862c0d4c69e78f9485ab1fe5cd0bf60a5f76d06057afde667

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains, max-age=31536000; includeSubDomains

Request headers

X-Braze-Api-Key: 8432b72c-1a46-4208-9152-78c3a255ead8
Origin: https://www.denverpost.com
X-Braze-TriggersRequest: true
X-Braze-DataRequest: true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-type: application/json
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
X-Requested-With: XMLHttpRequest

Response headers

Strict-Transport-Security: max-age=0; includeSubDomains, max-age=31536000; includeSubDomains
Content-Encoding: gzip
ETag: W/"c838662f89269e6862c0d4c69e78f948"
Access-Control-Allow-Origin: https://www.denverpost.com
X-Cache: MISS
Access-Control-Max-Age: 1728000
Connection: keep-alive
Content-Length: 256
X-Request-Id: 1243536c-c8e9-4d25-befe-97d0ebc62be9
X-Served-By: cache-hhn1538-HHN
X-Runtime: 0.009784
Server: nginx
X-Timer: S1520280272.529369,VS0,VE110
Date: Mon, 05 Mar 2018 20:04:31 GMT
Vary: Origin,Accept-Encoding
Access-Control-Allow-Methods: POST
Content-Type: application/json
Via: 1.1 varnish
Access-Control-Expose-Headers
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
X-Cache-Hits: 0

GET
S 200 analytics.js Show response
www.google-analytics.com/ 35 KB
14 KB 6ms
6ms Script
text/javascript 172.217.22.14
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R

Protocol

SPDY

Server

172.217.22.14 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

f8ef655ef916e39713ede9c6db56d7ca5618bd82cf5ac991dcd013f05e0fdfc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 13 Nov 2017 20:19:12 GMT
server: Golfe2
age: 4944
date: Mon, 05 Mar 2018 18:42:07 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 14597
expires: Mon, 05 Mar 2018 20:42:07 GMT

GET
H/1.1 200
OK atrk.js Show response
d31qbv1cthcecs.cloudfront.net/ 3 KB
2 KB 34ms
10ms Script
text/javascript 52.85.184.15

General

Check archive.org

Show headers Download Go to

Full URL: https://d31qbv1cthcecs.cloudfront.net/atrk.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.85.184.15 Seattle, United States, ASN (),
Reverse DNS: server-52-85-184-15.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 47550fb9f11c96bd159a2a7247dcb5556ede4e104052dec014f95f61e0696dd9

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 16 Jan 2018 18:20:53 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Jan 2018 21:24:43 GMT
Server: AmazonS3
Age: 6212
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 6558236a06004e2e5ed43d07e2124e70.cloudfront.net (CloudFront)
Transfer-Encoding: chunked
Connection: keep-alive
X-Amz-Cf-Id: M7hn-Dr58Ze__d2wOnpOGqssq54fIc8JqdALLJCDRR9P61wl5h_LTg==

GET
H/1.1 200
OK quant.js Show response
secure.quantserve.com/ 11 KB
5 KB 60ms
12ms Script
application/x-javascript 95.172.94.21

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Protocol: HTTP/1.1
Server: 95.172.94.21 , United Kingdom, ASN (),
Reverse DNS: pixel.quantserve.com
Software: QS /
Resource Hash: 23a1a8123c5cfb9df1063c6cfbab2b7bb80fe645d6e7158baacbea022a81e2a0

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:31 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05-Mar-2018 20:04:31 GMT
Server: QS
ETag: M0-8af1d7b9
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=604800
Connection: close
Content-Length: 4786
Expires: Mon, 12 Mar 2018 20:04:31 GMT

GET
S

200

sp.gz.js Show response
js.matheranalytics.com/static/2_2_16-c/
Redirect Chain

https://js.matheranalytics.com/s/ma23578/239876503/sp.js?cb=1466
https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js

72 KB
26 KB

7ms
6ms

Script
application/x-javascript

107.178.250.234
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 107.178.250.234 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6a404f237f78fc8eefdc0e09e61ef8cec67226b3627f3dc338afaf380745b188

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 08:06:02 GMT
content-encoding: gzip
last-modified: Fri, 29 Jul 2016 15:32:30 GMT
server: nginx
age: 43109
etag: "527f836cbc28a94db8199152abb3505c"
vary: Accept-Encoding
x-cache: HIT Thu, 01 Mar 2018 00:06:25 GMT
content-type: application/x-javascript
status: 200
cache-control: public, max-age=269200
alt-svc: clear
content-length: 26220
via: 1.1 google

Redirect headers

date: Mon, 05 Mar 2018 20:04:31 GMT
via: 1.1 google
server: nginx
status: 301
vary: Accept-Encoding
location: https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js
cache-control: public, max-age=269200
alt-svc: clear
x-served-by: 6-gc-useast4-10908

GET
S 200 fbevents.js Show response
connect.facebook.net/en_US/ 39 KB
13 KB 20ms
6ms Script
application/x-javascript 185.60.216.19
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

29451fb716c05b025bfb8a468767f7112baad0112dbc512d1610f64dbbad4bc0

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* .akamaihd.net wss://.facebook.com:* https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
content-length: 12439
x-xss-protection: 0
pragma: public
x-fb-debug: vu+pxUIQTwozVxrw8HPWyKpor7nT31UZzpnWZ1TRzlNXAxmUjbT4dBnDtJRMokcLCKmSd8XosBnH2su5stp3Eg==
x-frame-options: DENY
date: Mon, 05 Mar 2018 20:04:31 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK Bootstrap.js Show response
nexus.ensighten.com/choozle/2867/ 28 KB
9 KB 32ms
7ms Script
application/javascript 35.157.8.66

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/2867/Bootstrap.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Protocol: HTTP/1.1
Server: 35.157.8.66 Frankfurt, Germany, ASN (),
Reverse DNS: ec2-35-157-8-66.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 163e7e45661d055db356a58996759599ebbd1618f759d72910758b6c75d81cfa

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:31 GMT
Content-Encoding: gzip
Last-Modified: Thu, 27 Oct 2016 22:20:13 GMT
Server: nginx
ETag: W/"58127d9d-6fa9"
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=300
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1

204
No Content

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=6035443&ns__t=1520280271550&ns_c=UTF-8&c8=CDOT%20employees%20still%20offline%20after%20SamSam%20ransomware%20virus%20attack&c7=https%3A%2F%2Fwww.denverpos...
https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1520280271550&ns_c=UTF-8&c8=CDOT%20employees%20still%20offline%20after%20SamSam%20ransomware%20virus%20attack&c7=https%3A%2F%2Fwww.denverpo...

0
248 B

9ms
7ms

Image
text/plain

2.19.43.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1520280271550&ns_c=UTF-8&c8=CDOT%20employees%20still%20offline%20after%20SamSam%20ransomware%20virus%20attack&c7=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&c9=
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.19.43.224 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:31 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1520280271550&ns_c=UTF-8&c8=CDOT%20employees%20still%20offline%20after%20SamSam%20ransomware%20virus%20attack&c7=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&c9=
Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:31 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

sync
sync.adaptv.advertising.com/
Redirect Chain

https://insight.adsrvr.org/track/evnt/?adv=wvvvz6x&ct=0:75j4cjk&fmt=3
https://sync.adap.tv/sync?type=gif&key=thetradedesk&uid=196068f6-7675-4a2d-b6fe-d7797827bcd2
https://sync.adaptv.advertising.com/sync?type=gif&key=thetradedesk&uid=196068f6-7675-4a2d-b6fe-d7797827bcd2

42 B
492 B

425ms
104ms

Image
image/gif

34.226.60.227
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.adaptv.advertising.com/sync?type=gif&key=thetradedesk&uid=196068f6-7675-4a2d-b6fe-d7797827bcd2
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 34.226.60.227 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-34-226-60-227.compute-1.amazonaws.com
Software: ribs2.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Server: ribs2.0
Connection: keep-alive
Content-Length: 42
Content-Type: image/gif

Redirect headers

Location: //sync.adaptv.advertising.com/sync?type=gif&key=thetradedesk&uid=196068f6-7675-4a2d-b6fe-d7797827bcd2
Server: ribs2.0
Connection: keep-alive
Content-Length: 0
Content-Type: text/plain

GET
S 200 css
fonts.googleapis.com/ Frame (58E 18 KB
1 KB 16ms
15ms Stylesheet
text/css 172.217.22.10
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,300,400,600,700,900|Source+Serif+Pro:400,600,700

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/mailer-rules/app-promo.html

Protocol

SPDY

Server

172.217.22.10 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f10.1e100.net

Software

ESF /

Resource Hash

d45a16ca8762ec5e2a69b5caedbb437b59bf2072814a0ac61103fe7cbcae9054

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://extras.denverpost.com/app/mailer-rules/app-promo.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
last-modified: Mon, 05 Mar 2018 20:04:31 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:31 GMT

GET
H2 200 dp-app.png
extras.denverpost.com/newsletter/ Frame (58E 6 KB
6 KB 6ms
6ms Image
image/png 151.101.113.53
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://extras.denverpost.com/newsletter/dp-app.png
Requested by: Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/mailer-rules/app-promo.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.53 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 79a00e3f660aa62e7380afa42b0053b2e4f96e85da42b3079440d4ad844eb5d2

Request headers

:path: /newsletter/dp-app.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: extras.denverpost.com
cookie: optimizelyEndUserId=oeu1520280271093r0.9388145189607271; optimizelySegments=%7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D; optimizelyBuckets=%7B%7D; optimizelyPendingLogEvents=%5B%22n%3Dhttps%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F%26u%3Doeu1520280271093r0.9388145189607271%26wxhr%3Dtrue%26time%3D1520280271.1%26f%3D10373463532%26g%3D%22%5D; ab.storage.sessionId.8432b72c-1a46-4208-9152-78c3a255ead8=%7B%22g%22%3A%226bbba8e7-24d9-26b4-5944-fd327674e176%22%2C%22e%22%3A1520282071318%2C%22c%22%3A1520280271319%2C%22l%22%3A1520280271319%7D; ab.storage.deviceId.8432b72c-1a46-4208-9152-78c3a255ead8=%7B%22g%22%3A%22cb3f1ce2-7211-d6c4-64fc-287d7b1e7f16%22%2C%22c%22%3A1520280271320%2C%22l%22%3A1520280271320%7D
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
via: AX-CACHE-2.7:141 1.1 varnish 1.1 varnish
last-modified: Thu, 17 Aug 2017 21:58:45 GMT
server: Microsoft-IIS/8.5
age: 939
x-powered-by: ASP.NET
x-served-by: cache-den6027-DEN, cache-hhn1542-HHN
x-cache: HIT, HIT
content-type: image/png
status: 200
fastly-debug-digest: 23523be5e12748165c0a865f4edb370abb1ee76b4f855a9563ff648a95ae8d82
accept-ranges: bytes
x-timer: S1520280272.562756,VS0,VE0
content-length: 6146
x-cache-hits: 16, 1

GET
S 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
952 B 6ms
6ms Script
text/javascript 172.217.22.14
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

SPDY

Server

172.217.22.14 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f14.1e100.net

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 19:29:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 21 Apr 2016 03:17:22 GMT
server: sffe
age: 2078
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 856
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:29:53 GMT

GET
S 200 css
fonts.googleapis.com/ Frame (DF3 16 KB
1 KB 16ms
16ms Stylesheet
text/css 172.217.22.10
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Serif+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C700italic%7CSource+Sans+Pro%3A400%2C400italic%2C600%2C600italic%2C700%2C400italic&ver=4.6

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/in-article-promo/business-1.html

Protocol

SPDY

Server

172.217.22.10 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f10.1e100.net

Software

ESF /

Resource Hash

86e27f2a8a6f68f90a2c99a3f046c86cf1dc25adfd9b627b2a9be3ed4737c625

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://extras.denverpost.com/app/in-article-promo/business-1.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
last-modified: Mon, 05 Mar 2018 20:04:31 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:31 GMT

GET
S 200 collect
www.google-analytics.com/ 35 B
109 B 7ms
6ms Image
image/gif 172.217.22.14
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j66&a=1145802074&t=pageview&_s=1&dl=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&ul=en-us&de=UTF-8&dt=CDOT%20employees%20still%20offline%20after%20SamSam%20ransomware%20virus%20attack&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGBAgEAj~&jid=935295173&gjid=110481180&cid=1585394644.1520280272&tid=UA-61435456-7&_gid=670420000.1520280272&gtm=G2rTLFP4R&cd2=denverpost.com&cd3=denverpost.com&cd4=&cd5=2018-02-26T11%3A59%3A11%2B00%3A00&cd6=2018-02-26T11%3A59%3A11%2B00%3A00&cd7=2018-02-26T15%3A45%3A14%2B00%3A00&cd8=&cd9=no&cd10=Colorado%20News&cd11=4.9.4&cd12=&cd13=WP&cd14=Colorado%20News&cd15=Colorado%20News&cd16=&cd17=&cd18=&cd19=&cd20=&cd21=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&cd22=samsam-ransomware-virus-cdot&cd23=2965047&cd24=article&cd25=COLORADO&cd26=Tamara%20Chuang&cd27=SamSam%20ransomware%20virus%20keeps%20CDOT%20employees%20offline%20for%20fourth%20day&cd28=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&cd29=SamSam%20ransomware%20virus%20keeps%20CDOT%20employees%20offline%20for%20fourth%20day&cd30=&cd32=p-4ctCQwtnNBNs2&cd33=Denver&cd34=true&cd35=ransomware%2C%20SamSam%2C%20CDOT%2C%20Amy%20Ford%2C%20malware%2C%20cybersecurity%2C&cd36=2440&cd37=345&cd38=Tamara%20Chuang&cd50=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_12_6)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F63.0.3239.84%20Safari%2F537.36&z=1595150973

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.22.14 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Feb 2018 17:16:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1824483
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
S

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j66&tid=UA-61435456-7&cid=1585394644.1520280272&jid=935295173&gjid=110481180&_gid=670420000.1520280272&_u=aGBAgEAj~&z=1851648959
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-61435456-7&cid=1585394644.1520280272&jid=935295173&_v=j66&z=1851648959
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-61435456-7&cid=1585394644.1520280272&jid=935295173&_v=j66&z=1851648959&slf_rd=1&random=1710405933

42 B
109 B

15ms
15ms

Image
image/gif

172.217.22.3
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-61435456-7&cid=1585394644.1520280272&jid=935295173&_v=j66&z=1851648959&slf_rd=1&random=1710405933

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.22.3 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Mar 2018 20:04:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Mar 2018 20:04:31 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-61435456-7&cid=1585394644.1520280272&jid=935295173&_v=j66&z=1851648959&slf_rd=1&random=1710405933
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j66&a=1145802074&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&ul=en-us&de=UTF-8&dt=CDOT...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-61435456-7&cid=1585394644.1520280272&jid=1154489413&_gid=670420000.1520280272&gjid=398561928&_v=j66&z=1798990604
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-61435456-7&cid=1585394644.1520280272&jid=1154489413&_v=j66&z=1798990604
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-61435456-7&cid=1585394644.1520280272&jid=1154489413&_v=j66&z=1798990604&slf_rd=1&random=3932948487

42 B
109 B

16ms
16ms

Image
image/gif

172.217.22.3
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-61435456-7&cid=1585394644.1520280272&jid=1154489413&_v=j66&z=1798990604&slf_rd=1&random=3932948487

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.22.3 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Mar 2018 20:04:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 05 Mar 2018 20:04:31 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-61435456-7&cid=1585394644.1520280272&jid=1154489413&_v=j66&z=1798990604&slf_rd=1&random=3932948487
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 collect
www.google-analytics.com/ 35 B
103 B 7ms
7ms Image
image/gif 172.217.22.14
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j66&a=1145802074&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&ul=en-us&de=UTF-8&dt=CDOT%20employees%20still%20offline%20after%20SamSam%20ransomware%20virus%20attack&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Scroll%20Tracking&ea=60&el=%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&_u=aGDACEAjB~&jid=&gjid=&cid=1585394644.1520280272&tid=UA-61435456-7&_gid=670420000.1520280272&gtm=G2rTLFP4R&cd2=denverpost.com&cd3=denverpost.com&cd4=&cd5=2018-02-26T11%3A59%3A11%2B00%3A00&cd6=2018-02-26T11%3A59%3A11%2B00%3A00&cd7=2018-02-26T15%3A45%3A14%2B00%3A00&cd8=&cd9=no&cd10=Colorado%20News&cd11=4.9.4&cd12=&cd13=WP&cd14=Colorado%20News&cd15=Colorado%20News&cd16=&cd17=&cd18=&cd19=&cd20=&cd21=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&cd22=samsam-ransomware-virus-cdot&cd23=2965047&cd24=article&cd25=COLORADO&cd26=Tamara%20Chuang&cd27=SamSam%20ransomware%20virus%20keeps%20CDOT%20employees%20offline%20for%20fourth%20day&cd28=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&cd29=SamSam%20ransomware%20virus%20keeps%20CDOT%20employees%20offline%20for%20fourth%20day&cd30=&cd32=p-4ctCQwtnNBNs2&cd33=Denver&cd34=true&cd35=ransomware%2C%20SamSam%2C%20CDOT%2C%20Amy%20Ford%2C%20malware%2C%20cybersecurity%2C&cd36=2440&cd37=345&cd38=Tamara%20Chuang&z=645242504

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.22.14 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Feb 2018 17:16:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1824483
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
S 200 333738300301153 Show response
connect.facebook.net/signals/config/ 56 KB
15 KB 6ms
6ms Script
application/x-javascript 185.60.216.19
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/333738300301153?v=2.8.12&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

SPDY

Server

185.60.216.19 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

c3877658122025a9863287cce38aefe65e886847551c5c745c7d225ab3eebc34

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net .atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com:* .akamaihd.net wss://.facebook.com:* https://fb.scanandcleanlocal.com:* .atlassolutions.com attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' fbstatic-a.akamaihd.net fbcdn-static-b-a.akamaihd.net *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* *.akamaihd.net wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Origin, Accept-Encoding
content-length: 15232
x-xss-protection: 0
pragma: public
x-fb-debug: llg6/a1K/fcFOMGb2990e1bPtkxNmcWTrSAH46dGM6qSqC3PwSDcdiZE+kO57+JWeuzBuEmpGwUuFG7zNeyPsQ==
x-frame-options: DENY
date: Mon, 05 Mar 2018 20:04:31 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://connect.facebook.net
access-control-expose-headers: X-FB-Debug, X-Loader-Length
cache-control: public, max-age=1200
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK atrk.gif
certify.alexametrics.com/ 43 B
528 B 48ms
7ms Image
image/gif 52.85.184.252
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://certify.alexametrics.com/atrk.gif?frame_height=1200&frame_width=1600&iframe=0&title=CDOT%20employees%20still%20offline%20after%20SamSam%20ransomware%20virus%20attack&time=1520280271611&time_zone_offset=0&screen_params=1600x1200x24&java_enabled=0&cookie_enabled=1&ref_url=&host_url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&random_number=9246880841&sess_cookie=a4a70a4e161f7c3fafbe1f28774&sess_cookie_flag=1&user_cookie=a4a70a4e161f7c3fafbe1f28774&user_cookie_flag=1&dynamic=true&domain=denverpost.com&account=NJsqn1QolK10uW&jsv=20130128&user_lang=en-US
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.85.184.252 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-52-85-184-252.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Fri, 22 Sep 2017 00:34:15 GMT
Via: 1.1 28edd995979e84232ebdb595b33d9deb.cloudfront.net (CloudFront)
Last-Modified: Mon, 17 Jan 2011 20:41:40 GMT
Server: AmazonS3
Age: 30421
ETag: "221d8352905f2c38b3cb2bd191d630b0"
X-Cache: Hit from cloudfront
Content-Type: image/gif
Accept-Ranges: bytes
Connection: keep-alive
x-amz-meta-alexa-last-modified: 20110117123941
Content-Length: 43
X-Amz-Cf-Id: ms_wsIkz3s4E2re8KYxz87lIelaygQkjBnpQupDeZXjBz2kynFG5rg==

GET
H/1.1

302
Moved Temporarily

acj Show response
digitalfirst-d.openx.net/w/1.0/
Redirect Chain

https://digitalfirst-d.openx.net/w/1.0/acj?ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537064&aus=728x90%...
https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537064&aus=72...

0
-1 B

16ms
15ms

XHR

173.241.240.220
OPENX TECHNOLOGIES

General

Check archive.org

Show headers Download Go to

Full URL: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537064&aus=728x90%2C970x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=-7%2C192&c.pos=top_leaderboard&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS: ox-173-241-240-220.xa.dc.openx.org
Software: OXGW/13.4.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Location: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537064&aus=728x90%2C970x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=-7%2C192&c.pos=top_leaderboard&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Date: Mon, 05 Mar 2018 20:04:31 GMT
Access-Control-Allow-Credentials: true
Server: OXGW/13.4.1
Access-Control-Allow-Origin: https://www.denverpost.com
Content-Length: 0
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

Location: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537064&aus=728x90%2C970x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=-7%2C192&c.pos=top_leaderboard&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Date: Mon, 05 Mar 2018 20:04:31 GMT
Access-Control-Allow-Credentials: true
Server: OXGW/13.4.1
Access-Control-Allow-Origin: https://www.denverpost.com
Content-Length: 0
P3P: CP="CUR ADM OUR NOR STA NID"

GET
H/1.1

302
Moved Temporarily

acj Show response
digitalfirst-d.openx.net/w/1.0/
Redirect Chain

https://digitalfirst-d.openx.net/w/1.0/acj?ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537066&aus=300x600...
https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537066&aus=30...

0
-1 B

22ms
13ms

XHR

173.241.240.220
OPENX TECHNOLOGIES

General

Check archive.org

Show headers Download Go to

Full URL: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537066&aus=300x600%2C300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=1120%2C435&c.pos=Cube1_RRail_ATF&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS: ox-173-241-240-220.xa.dc.openx.org
Software: OXGW/13.4.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Location: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537066&aus=300x600%2C300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=1120%2C435&c.pos=Cube1_RRail_ATF&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Date: Mon, 05 Mar 2018 20:04:31 GMT
Access-Control-Allow-Credentials: true
Server: OXGW/13.4.1
Access-Control-Allow-Origin: https://www.denverpost.com
Content-Length: 0
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

Location: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537066&aus=300x600%2C300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=1120%2C435&c.pos=Cube1_RRail_ATF&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Date: Mon, 05 Mar 2018 20:04:31 GMT
Access-Control-Allow-Credentials: true
Server: OXGW/13.4.1
Access-Control-Allow-Origin: https://www.denverpost.com
Content-Length: 0
P3P: CP="CUR ADM OUR NOR STA NID"

GET
H/1.1

302
Moved Temporarily

acj Show response
digitalfirst-d.openx.net/w/1.0/
Redirect Chain

https://digitalfirst-d.openx.net/w/1.0/acj?ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537067&aus=300x250...
https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537067&aus=30...

0
-1 B

32ms
13ms

XHR

173.241.240.220
OPENX TECHNOLOGIES

General

Check archive.org

Show headers Download Go to

Full URL: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537067&aus=300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=1120%2C1720&c.pos=Cube2_RRail_mid&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS: ox-173-241-240-220.xa.dc.openx.org
Software: OXGW/13.4.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Location: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537067&aus=300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=1120%2C1720&c.pos=Cube2_RRail_mid&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Date: Mon, 05 Mar 2018 20:04:31 GMT
Access-Control-Allow-Credentials: true
Server: OXGW/13.4.1
Access-Control-Allow-Origin: https://www.denverpost.com
Content-Length: 0
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

Location: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537067&aus=300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=1120%2C1720&c.pos=Cube2_RRail_mid&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Date: Mon, 05 Mar 2018 20:04:31 GMT
Access-Control-Allow-Credentials: true
Server: OXGW/13.4.1
Access-Control-Allow-Origin: https://www.denverpost.com
Content-Length: 0
P3P: CP="CUR ADM OUR NOR STA NID"

GET
H/1.1

302
Moved Temporarily

acj Show response
digitalfirst-d.openx.net/w/1.0/
Redirect Chain

https://digitalfirst-d.openx.net/w/1.0/acj?ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537068&aus=300x250...
https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537068&aus=30...

0
-1 B

43ms
14ms

XHR

173.241.240.220
OPENX TECHNOLOGIES

General

Check archive.org

Show headers Download Go to

Full URL: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537068&aus=300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=327%2C1856&c.pos=Cube_Article&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS: ox-173-241-240-220.xa.dc.openx.org
Software: OXGW/13.4.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Location: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537068&aus=300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=327%2C1856&c.pos=Cube_Article&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Date: Mon, 05 Mar 2018 20:04:31 GMT
Access-Control-Allow-Credentials: true
Server: OXGW/13.4.1
Access-Control-Allow-Origin: https://www.denverpost.com
Content-Length: 0
P3P: CP="CUR ADM OUR NOR STA NID"

Redirect headers

Location: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537068&aus=300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=327%2C1856&c.pos=Cube_Article&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Date: Mon, 05 Mar 2018 20:04:31 GMT
Access-Control-Allow-Credentials: true
Server: OXGW/13.4.1
Access-Control-Allow-Origin: https://www.denverpost.com
Content-Length: 0
P3P: CP="CUR ADM OUR NOR STA NID"

GET
H/1.1 200
OK acj Show response
digitalfirst-d.openx.net/w/1.0/ 435 B
853 B 57ms
27ms XHR
application/json 173.241.240.220
OPENX TECHNOLOGIES

General

Check archive.org

Show headers Download Go to

Full URL: https://digitalfirst-d.openx.net/w/1.0/acj?ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537065&aus=728x90%2C970x250&bc=hb_2&bt=2000&c.pos=bottom_leaderboard&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Requested by: Host: digitalfirst-d.openx.net
URL: https://digitalfirst-d.openx.net/w/1.0/jstag?nc=8013-denverpost
Protocol: HTTP/1.1
Server: 173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS: ox-173-241-240-220.xa.dc.openx.org
Software: OXGW/13.4.1 /
Resource Hash: 4250093df42f46cf162116438da0d35481c9a3c54ec34cbb7ddb3e6b7a1ae20e

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Origin: https://www.denverpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:31 GMT
Content-Encoding: gzip
Server: OXGW/13.4.1
Vary: Accept
P3P: CP="CUR ADM OUR NOR STA NID"
Access-Control-Allow-Origin: https://www.denverpost.com
Cache-Control: private, max-age=0, no-cache
Access-Control-Allow-Credentials: true
Content-Type: application/json
Transfer-Encoding: chunked
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
fonts.gstatic.com/s/sourcesanspro/v11/ Frame (58E 13 KB
0 7ms
7ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v11/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/mailer-rules/app-promo.html

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

547ea67155dac1c27efb550426c4848b7364357ed040fd531719c4797e356a1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Thu, 08 Feb 2018 18:01:43 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 18:25:48 GMT
server: sffe
age: 2167368
content-type: font/woff2
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 12960
x-xss-protection: 1; mode=block
expires: Fri, 08 Feb 2019 18:01:43 GMT

GET
S 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v11/ Frame (58E 13 KB
0 6ms
6ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v11/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu3cOWxw.woff2

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/mailer-rules/app-promo.html

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

4a58441133d85539974e4b136c25eaa5512ac1b018d4f6d53124a08c6f19b55e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Thu, 08 Feb 2018 18:35:41 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 18:25:50 GMT
server: sffe
age: 2165330
content-type: font/woff2
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 12916
x-xss-protection: 1; mode=block
expires: Fri, 08 Feb 2019 18:35:41 GMT

GET
S 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v11/ Frame (58E 12 KB
0 7ms
6ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v11/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/mailer-rules/app-promo.html

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

a0066433a645f196eb0ece299c86dc27a5c74dbe2cae7ae6d9211c1549a92085

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Thu, 08 Feb 2018 18:01:43 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 18:26:10 GMT
server: sffe
age: 2167368
content-type: font/woff2
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 12600
x-xss-protection: 1; mode=block
expires: Fri, 08 Feb 2019 18:01:43 GMT

GET
S 200 neIQzD-0qpwxpaWvjeD0X88SAOeauXQ-oAGIyY0.woff2
fonts.gstatic.com/s/sourceserifpro/v5/ Frame (58E 15 KB
0 8ms
8ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourceserifpro/v5/neIQzD-0qpwxpaWvjeD0X88SAOeauXQ-oAGIyY0.woff2

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/mailer-rules/app-promo.html

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

858c43f311dc3adb895f69ee9e3fbed55e6dc98c83ac0f2af877ad43ce23b017

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 12 Feb 2018 17:23:12 GMT
x-content-type-options: nosniff
last-modified: Tue, 10 Oct 2017 23:08:06 GMT
server: sffe
age: 1824079
content-type: font/woff2
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 15356
x-xss-protection: 1; mode=block
expires: Tue, 12 Feb 2019 17:23:12 GMT

GET
S 200 neIXzD-0qpwxpaWvjeD0X88SAOeasasatSyqxKcsdrM.woff2
fonts.gstatic.com/s/sourceserifpro/v5/ Frame (58E 15 KB
0 9ms
9ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourceserifpro/v5/neIXzD-0qpwxpaWvjeD0X88SAOeasasatSyqxKcsdrM.woff2

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/mailer-rules/app-promo.html

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

29001964c73b80381ab43142b3d2371025e8ce2a43b1b8d4630d5db19f3b4ff0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 12 Feb 2018 15:56:24 GMT
x-content-type-options: nosniff
last-modified: Tue, 10 Oct 2017 23:06:45 GMT
server: sffe
age: 1829287
content-type: font/woff2
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 15556
x-xss-protection: 1; mode=block
expires: Tue, 12 Feb 2019 15:56:24 GMT

GET
S 200 neIXzD-0qpwxpaWvjeD0X88SAOeasc8btSyqxKcsdrM.woff2
fonts.gstatic.com/s/sourceserifpro/v5/ Frame (58E 14 KB
0 7ms
7ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourceserifpro/v5/neIXzD-0qpwxpaWvjeD0X88SAOeasc8btSyqxKcsdrM.woff2

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/mailer-rules/app-promo.html

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

7cf9f1b809e02b135c7d88f5aca64d40a4bbea3cc31bf3aa9433cf3f6e03adb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Thu, 08 Feb 2018 23:04:49 GMT
x-content-type-options: nosniff
last-modified: Tue, 10 Oct 2017 23:07:55 GMT
server: sffe
age: 2149182
content-type: font/woff2
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 14780
x-xss-protection: 1; mode=block
expires: Fri, 08 Feb 2019 23:04:49 GMT

GET
S 200 6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v11/ Frame (58E 12 KB
12 KB 7ms
6ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v11/6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdu3cOWxw.woff2

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/mailer-rules/app-promo.html

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

fe1fd2390971d20586c515c99cbdf53ed0f3a9e4ddb091222dfafeae3a5eabff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:200,300,400,600,700,900|Source+Serif+Pro:400,600,700
Origin: https://extras.denverpost.com

Response headers

date: Mon, 12 Feb 2018 17:38:38 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 18:26:12 GMT
server: sffe
age: 1823153
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 12148
x-xss-protection: 1; mode=block
expires: Tue, 12 Feb 2019 17:38:38 GMT

GET
S 200 rules-p-4ctCQwtnNBNs2.js Show response
rules.quantcount.com/ 3 B
338 B 31ms
9ms Script
application/x-javascript 52.85.184.73
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-4ctCQwtnNBNs2.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: SPDY
Server: 52.85.184.73 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-52-85-184-73.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Fri, 22 Sep 2017 11:17:46 GMT
via: 1.1 d41256fff4c52560b6f36cf42caee95d.cloudfront.net (CloudFront)
last-modified: Sat, 04 Mar 2017 19:57:14 GMT
server: AmazonS3
age: 44995
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=86400
accept-ranges: bytes
content-length: 3
x-amz-cf-id: TM1o3F43gcQiQ1e0ZYDDhtop5WI7GrMF4RcKEAXJWhx_Ee9sBeOBfw==

GET
H/1.1 200
OK acj Show response
digitalfirst-d.openx.net/w/1.0/ 436 B
854 B 40ms
27ms XHR
application/json 173.241.240.220
OPENX TECHNOLOGIES

General

Check archive.org

Show headers Download Go to

Full URL: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537064&aus=728x90%2C970x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=-7%2C192&c.pos=top_leaderboard&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS: ox-173-241-240-220.xa.dc.openx.org
Software: OXGW/13.4.1 /
Resource Hash: 6b3efc350a2371caf6924eab9feda1db394ab5111373adb75227426da4e88405

Request headers

X-DevTools-Emulate-Network-Conditions-Client-Id: (377E8C5EAD5DEB584B0FAE93B4541D43)
Origin: https://www.denverpost.com
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:31 GMT
Content-Encoding: gzip
Server: OXGW/13.4.1
Vary: Accept
P3P: CP="CUR ADM OUR NOR STA NID"
Access-Control-Allow-Origin: https://www.denverpost.com
Cache-Control: private, max-age=0, no-cache
Access-Control-Allow-Credentials: true
Content-Type: application/json
Transfer-Encoding: chunked
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
S 200 /
www.facebook.com/tr/ 44 B
294 B 21ms
6ms Image
image/gif 185.60.216.35
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/tr/?id=333738300301153&ev=PageView&dl=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&rl=&if=false&ts=1520280271747&sw=1600&sh=1200&v=2.8.12&r=stable&ec=0&o=28&it=1520280271608
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 185.60.216.35 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software: proxygen-bolt /
Resource Hash: 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Mon, 05 Mar 2018 20:04:31 GMT

GET
S 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
fonts.gstatic.com/s/sourcesanspro/v11/ Frame (DF3 13 KB
0 7ms
7ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v11/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/in-article-promo/business-1.html

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

547ea67155dac1c27efb550426c4848b7364357ed040fd531719c4797e356a1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Thu, 08 Feb 2018 18:01:43 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 18:25:48 GMT
server: sffe
age: 2167368
content-type: font/woff2
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 12960
x-xss-protection: 1; mode=block
expires: Fri, 08 Feb 2019 18:01:43 GMT

GET
S 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v11/ Frame (DF3 13 KB
0 6ms
6ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v11/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu3cOWxw.woff2

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/in-article-promo/business-1.html

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

4a58441133d85539974e4b136c25eaa5512ac1b018d4f6d53124a08c6f19b55e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Thu, 08 Feb 2018 18:35:41 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 18:25:50 GMT
server: sffe
age: 2165330
content-type: font/woff2
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 12916
x-xss-protection: 1; mode=block
expires: Fri, 08 Feb 2019 18:35:41 GMT

GET
S 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v11/ Frame (DF3 12 KB
0 7ms
6ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v11/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/in-article-promo/business-1.html

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

a0066433a645f196eb0ece299c86dc27a5c74dbe2cae7ae6d9211c1549a92085

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Thu, 08 Feb 2018 18:01:43 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 18:26:10 GMT
server: sffe
age: 2167368
content-type: font/woff2
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 12600
x-xss-protection: 1; mode=block
expires: Fri, 08 Feb 2019 18:01:43 GMT

GET
S 200 neIQzD-0qpwxpaWvjeD0X88SAOeauXQ-oAGIyY0.woff2
fonts.gstatic.com/s/sourceserifpro/v5/ Frame (DF3 15 KB
0 8ms
8ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourceserifpro/v5/neIQzD-0qpwxpaWvjeD0X88SAOeauXQ-oAGIyY0.woff2

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/in-article-promo/business-1.html

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

858c43f311dc3adb895f69ee9e3fbed55e6dc98c83ac0f2af877ad43ce23b017

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 12 Feb 2018 17:23:12 GMT
x-content-type-options: nosniff
last-modified: Tue, 10 Oct 2017 23:08:06 GMT
server: sffe
age: 1824079
content-type: font/woff2
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 15356
x-xss-protection: 1; mode=block
expires: Tue, 12 Feb 2019 17:23:12 GMT

GET
S 200 neIXzD-0qpwxpaWvjeD0X88SAOeasasatSyqxKcsdrM.woff2
fonts.gstatic.com/s/sourceserifpro/v5/ Frame (DF3 15 KB
0 9ms
9ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourceserifpro/v5/neIXzD-0qpwxpaWvjeD0X88SAOeasasatSyqxKcsdrM.woff2

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/in-article-promo/business-1.html

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

29001964c73b80381ab43142b3d2371025e8ce2a43b1b8d4630d5db19f3b4ff0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 12 Feb 2018 15:56:24 GMT
x-content-type-options: nosniff
last-modified: Tue, 10 Oct 2017 23:06:45 GMT
server: sffe
age: 1829287
content-type: font/woff2
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 15556
x-xss-protection: 1; mode=block
expires: Tue, 12 Feb 2019 15:56:24 GMT

GET
S 200 neIXzD-0qpwxpaWvjeD0X88SAOeasc8btSyqxKcsdrM.woff2
fonts.gstatic.com/s/sourceserifpro/v5/ Frame (DF3 14 KB
0 7ms
7ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourceserifpro/v5/neIXzD-0qpwxpaWvjeD0X88SAOeasc8btSyqxKcsdrM.woff2

Requested by

Host: extras.denverpost.com
URL: https://extras.denverpost.com/app/in-article-promo/business-1.html

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

7cf9f1b809e02b135c7d88f5aca64d40a4bbea3cc31bf3aa9433cf3f6e03adb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Thu, 08 Feb 2018 23:04:49 GMT
x-content-type-options: nosniff
last-modified: Tue, 10 Oct 2017 23:07:55 GMT
server: sffe
age: 2149182
content-type: font/woff2
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 14780
x-xss-protection: 1; mode=block
expires: Fri, 08 Feb 2019 23:04:49 GMT

GET
H/1.1 200
OK acj Show response
digitalfirst-d.openx.net/w/1.0/ 436 B
854 B 18ms
18ms XHR
application/json 173.241.240.220
OPENX TECHNOLOGIES

General

Check archive.org

Show headers Download Go to

Full URL: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537066&aus=300x600%2C300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=1120%2C435&c.pos=Cube1_RRail_ATF&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS: ox-173-241-240-220.xa.dc.openx.org
Software: OXGW/13.4.1 /
Resource Hash: 704e5b4e16a03a815bc09d24b6dfc267ba8bdc2ecdbdc57b60bb0b71ff46e077

Request headers

X-DevTools-Emulate-Network-Conditions-Client-Id: (377E8C5EAD5DEB584B0FAE93B4541D43)
Origin: https://www.denverpost.com
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:31 GMT
Content-Encoding: gzip
Server: OXGW/13.4.1
Vary: Accept
P3P: CP="CUR ADM OUR NOR STA NID"
Access-Control-Allow-Origin: https://www.denverpost.com
Cache-Control: private, max-age=0, no-cache
Access-Control-Allow-Credentials: true
Content-Type: application/json
Transfer-Encoding: chunked
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK serverComponent.php Show response
nexus.ensighten.com/choozle/2867/ 332 B
552 B 13ms
13ms Script
text/javascript 35.157.8.66

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/2867/serverComponent.php?r=6.660074361416111&ClientID=923&PageID=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/2867/Bootstrap.js
Protocol: HTTP/1.1
Server: 35.157.8.66 Frankfurt, Germany, ASN (),
Reverse DNS: ec2-35-157-8-66.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: fc2fa9c1c783bc0db2e22ac096ea88744498c19a202d7d44eecb78a951f492d3

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:31 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: no-cache, no-store
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Mon, 05 Mar 2018 20:04:30 GMT

GET
H/1.1 200
OK acj Show response
digitalfirst-d.openx.net/w/1.0/ 436 B
854 B 18ms
17ms XHR
application/json 173.241.240.220
OPENX TECHNOLOGIES

General

Check archive.org

Show headers Download Go to

Full URL: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537067&aus=300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=1120%2C1720&c.pos=Cube2_RRail_mid&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS: ox-173-241-240-220.xa.dc.openx.org
Software: OXGW/13.4.1 /
Resource Hash: de6a4a38d6998a17e74b00606a650dc0de1e1a33878bb381badcff1d4b95d67d

Request headers

X-DevTools-Emulate-Network-Conditions-Client-Id: (377E8C5EAD5DEB584B0FAE93B4541D43)
Origin: https://www.denverpost.com
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:31 GMT
Content-Encoding: gzip
Server: OXGW/13.4.1
Vary: Accept
P3P: CP="CUR ADM OUR NOR STA NID"
Access-Control-Allow-Origin: https://www.denverpost.com
Cache-Control: private, max-age=0, no-cache
Access-Control-Allow-Credentials: true
Content-Type: application/json
Transfer-Encoding: chunked
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK acj Show response
digitalfirst-d.openx.net/w/1.0/ 436 B
854 B 23ms
22ms XHR
application/json 173.241.240.220
OPENX TECHNOLOGIES

General

Check archive.org

Show headers Download Go to

Full URL: https://digitalfirst-d.openx.net/w/1.0/acj?cc=1&ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&be=1&prf=0&auid=538537068&aus=300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=327%2C1856&c.pos=Cube_Article&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS: ox-173-241-240-220.xa.dc.openx.org
Software: OXGW/13.4.1 /
Resource Hash: 2bdc6c730d94a6bc1ea01da4299b3ee21fd8c2fb663e9db57369b78c902c0b7d

Request headers

X-DevTools-Emulate-Network-Conditions-Client-Id: (377E8C5EAD5DEB584B0FAE93B4541D43)
Origin: https://www.denverpost.com
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:31 GMT
Content-Encoding: gzip
Server: OXGW/13.4.1
Vary: Accept
P3P: CP="CUR ADM OUR NOR STA NID"
Access-Control-Allow-Origin: https://www.denverpost.com
Cache-Control: private, max-age=0, no-cache
Access-Control-Allow-Credentials: true
Content-Type: application/json
Transfer-Encoding: chunked
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK pixel;r=2144607273;labels=Denver;rf=0;a=p-4ctCQwtnNBNs2;url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F;fpan=1;fpa=P0-575419576-1520280271784;ns=0;ce=1;cm=;r...
pixel.quantserve.com/ 35 B
474 B 54ms
11ms Image
image/gif 95.172.94.35
Internap European...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.quantserve.com/pixel;r=2144607273;labels=Denver;rf=0;a=p-4ctCQwtnNBNs2;url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F;fpan=1;fpa=P0-575419576-1520280271784;ns=0;ce=1;cm=;ref=;je=0;sr=1600x1200x24;enc=n;dst=0;et=1520280271784;tzo=0;ogl=type.article%2Ctitle.SamSam%20ransomware%20virus%20keeps%20CDOT%20employees%20offline%20for%20fourth%20day%2Curl.https%3A%2F%2Fwww%252Edenverpost%252Ecom%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F%2Cdescription.Nasty%20ransomware%20took%20its%20toll%20on%20Colorado%20Department%20of%20Transportation%20workers%20%2Csite_name.The%20Denver%20Post%2Cimage.https%3A%2F%2Fwww%252Edenverpost%252Ecom%2Fwp-content%2Fuploads%2F2016%2F10%2Fcover%252Ejpg%3Fw%3D1024%26h%3D576%2Cimage%3Awidth.1024%2Cimage%3Aheight.576%2Clocale.en_US
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 95.172.94.35 , United Kingdom, ASN15570 (Internap European Autonomous System, GB),
Reverse DNS: pixel.quantserve.com
Software: QS /
Resource Hash: a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:31 GMT
Server: QS
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
Cache-Control: private, no-cache, no-store, proxy-revalidate
Connection: close
Content-Type: image/gif
Content-Length: 35
Expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
338 B 451ms
111ms Image
image/gif 52.5.12.45
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pv&url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&page=CDOT%20employees%20still%20offline%20after%20SamSam%20ransomware%20virus%20attack&tv=js-2.2.16-c&tna=Mather&aid=v1&p=web&tz=UTC&lang=en-US&cs=UTF-8&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_nolocalstorage=1&tid=fed27f87-f104-423c-9051-420e1e545fd6&pid=a8687a73-7722-4973-b451-4542168111c3&dtm=1520280271797&qnm=_snaq&vp=1600x1200&ds=1585x1946&vid=1&duid=3cc46bb633deb4bf&fp=1684409236&cid=ma23578&mrk=239876503&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTUyMDI4MDI3MDY2OSIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiIxNi4xbWIiLCJoZWFwVCI6IjIxLjdtYiIsImZldGNoUyI6IjEiLCJkb21haW5TIjoiMSIsImRvbWFpbkUiOiIxIiwiY29ublMiOiIxIiwiY29ubkUiOiIxNyIsInNzbFMiOiI2IiwicmVxdVMiOiIxNyIsInJlc3BTIjoiMzU0IiwicmVzcEUiOiI0ODIiLCJkb21Mb2FkIjoiMzU2In0sImtleXdvcmRzIjpbInJhbnNvbXdhcmUiLCJTYW1TYW0iLCJDRE9UIiwiQW15IEZvcmQiLCJtYWx3YXJlIiwiY3liZXJzZWN1cml0eSJdfQ
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.5.12.45 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-5-12-45.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK c7e492a9fdb268ee1298106913c79f98.js Show response
nexus.ensighten.com/choozle/2867/code/ 668 B
961 B 6ms
6ms Script
application/javascript 35.157.8.66

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/2867/code/c7e492a9fdb268ee1298106913c79f98.js?conditionId0=469797
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/2867/Bootstrap.js
Protocol: HTTP/1.1
Server: 35.157.8.66 Frankfurt, Germany, ASN (),
Reverse DNS: ec2-35-157-8-66.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 15bd316b58cb6d60f70ee592ff5e60b43d1375149c69d6946da4d5bd0a677d19

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:31 GMT
Last-Modified: Thu, 27 Oct 2016 22:20:13 GMT
Server: nginx
ETag: "58127d9d-29c"
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 668

GET
S 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 36 KB
9 KB 377ms
377ms XHR
text/javascript 172.217.23.162

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=4064857403957377&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&json_a=1&eid=21061724%2C21060555%2C21061149&sc=1&sfv=1-0-16&iu_parts=8013%2Cdenverpost.com%2Cbusiness&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=728x90%7C970x90%7C970x250%7C970x30%2C300x250%7C300x600%7C300x1050%2C300x250%2C300x250%2C728x90%7C970x250%7C970x90%2C1x1%2C300x251&prev_scp=POS%3Dtop_leaderboard%26kv%3Dcolorado-department-of-transportation%2Ccybersecurity%2Cmalware%2Cmore-business-news%2Cransomware%26page%3Darticle%26RPN%3D61%26rurl%3D%26articleid%3D2965047%26optimizely%3D%26amznbid%3D2%26amznp%3D2%26oxb%3D728x90_0%252Chb-bid-8da16c281a75cc%7CPOS%3DCube1_RRail_ATF%26kv%3Dcolorado-department-of-transportation%2Ccybersecurity%2Cmalware%2Cmore-business-news%2Cransomware%26page%3Darticle%26RPN%3D61%26rurl%3D%26articleid%3D2965047%26optimizely%3D%26amznbid%3D2%26amznp%3D2%26oxb%3D300x600_0%252Chb-bid-9342dcbbedae5a%7CPOS%3DCube2_RRail_mid%26kv%3Dcolorado-department-of-transportation%2Ccybersecurity%2Cmalware%2Cmore-business-news%2Cransomware%26page%3Darticle%26RPN%3D61%26rurl%3D%26articleid%3D2965047%26optimizely%3D%26amznbid%3D2%26amznp%3D2%26oxb%3D300x250_0%252Chb-bid-106bfd06229579c%7CPOS%3DCube_Article%26kv%3Dcolorado-department-of-transportation%2Ccybersecurity%2Cmalware%2Cmore-business-news%2Cransomware%26page%3Darticle%26RPN%3D61%26rurl%3D%26articleid%3D2965047%26optimizely%3D%26oxb%3D300x250_0%252Chb-bid-11a2e5650f47054%7CPOS%3Dbottom_leaderboard%26kv%3Dcolorado-department-of-transportation%2Ccybersecurity%2Cmalware%2Cmore-business-news%2Cransomware%26page%3Darticle%26RPN%3D61%26rurl%3D%26articleid%3D2965047%26optimizely%3D%26amznbid%3D2%26amznp%3D2%26oxb%3D728x90_0%252Chb-bid-706aef63e7e682%7CPOS%3Dinterstitial%26kv%3Dcolorado-department-of-transportation%2Ccybersecurity%2Cmalware%2Cmore-business-news%2Cransomware%26page%3Darticle%26RPN%3D61%26rurl%3D%26articleid%3D2965047%26optimizely%3D%26amznbid%3D2%26amznp%3D2%7CPOS%3DSlideshow_1%26kv%3Dcolorado-department-of-transportation%2Ccybersecurity%2Cmalware%2Cmore-business-news%2Cransomware%26page%3Darticle%26RPN%3D61%26rurl%3D%26articleid%3D2965047%26optimizely%3D&eri=1&cookie_enabled=1&abxe=1&lmt=1520280271&dt=1520280271836&frm=20&biw=1585&bih=1200&oid=3&adxs=429%2C1120%2C1120%2C484%2C-9%2C792%2C-9&adys=218%2C541%2C2076%2C1962%2C-9%2C207%2C-9&adks=685209867%2C779411635%2C3761832310%2C1096742112%2C2036989%2C3825197355%2C1883405259&gut=v2&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&dssz=50&icsg=13621280&mso=4&std=0&vrg=184&vis=1&dmc=8&scr_x=0&scr_y=0&ga_vid=1585394644.1520280272&ga_sid=1520280272&ga_hid=1145802074

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.23.162 Mountain View, United States, ASN (),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

78ea7db0363e798c2a6f5ee4790d673892e43ecbf84e5eab1ab44fdb23a934b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Origin: https://www.denverpost.com

Response headers

date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 8478
x-xss-protection: 1; mode=block
google-lineitem-id: 379223054,379222454,379222694,379222574,379223174,4448327181,4492956232
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 78911076374,78911063894,78911084654,78911077934,78911099294,138213241724,138217377299
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.denverpost.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 pubads_impl_rendering_184.js Show response
securepubads.g.doubleclick.net/gpt/ 40 KB
14 KB 40ms
40ms Script
text/javascript 172.217.23.162

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_184.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.23.162 Mountain View, United States, ASN (),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

sffe /

Resource Hash

6c1ea45333a28a1704889705502fb72cb581e3f572fe42fc3e54fd8c295918f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 02 Mar 2018 02:33:46 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 14306
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:31 GMT

GET
S 200 container.html
tpc.googlesyndication.com/safeframe/1-0-16/html/ 0
0 22ms
6ms Other
text/html 172.217.23.161
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-16/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.23.161 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f1.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Purpose: prefetch
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Thu, 22 Feb 2018 19:15:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 953337
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 1453
x-xss-protection: 1; mode=block
last-modified: Wed, 21 Feb 2018 21:58:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/html
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Feb 2019 19:15:34 GMT

GET
S 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame (74A 53 KB
20 KB 67ms
45ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

ac4e30b367a727a36c9c5f3f66053539a155ccbb0b935da5cd8fd34019d018e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
etag: 4343604296547922425
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=3600
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 20727
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20180228/r20110914/activeview/ Frame (74A 71 KB
26 KB 6ms
6ms Script
text/javascript 172.217.23.161
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180228/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.23.161 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f1.1e100.net

Software

cafe /

Resource Hash

95a2b3352f45ad7a28052ba8a142b8694e52cef35865312161bcd9cc73bbeccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Wed, 28 Feb 2018 14:01:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 453782
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 26517
x-xss-protection: 1; mode=block
server: cafe
etag: 9587303592933190018
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Mar 2018 14:01:30 GMT

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/ 73 KB
27 KB 29ms
7ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

c875abb472a9f41c06aaa1dec92ff397185f65b49a2ece9259263d64b4f77f3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 19:18:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2744
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 27467
x-xss-protection: 1; mode=block
server: cafe
etag: 11784303078778526260
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 05 Mar 2018 20:18:48 GMT

GET
S 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame (70B 53 KB
20 KB 69ms
50ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

ac4e30b367a727a36c9c5f3f66053539a155ccbb0b935da5cd8fd34019d018e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
etag: 4343604296547922425
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=3600
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 20727
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20180228/r20110914/activeview/ Frame (70B 71 KB
26 KB 8ms
8ms Script
text/javascript 172.217.23.161
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180228/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.23.161 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f1.1e100.net

Software

cafe /

Resource Hash

95a2b3352f45ad7a28052ba8a142b8694e52cef35865312161bcd9cc73bbeccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Wed, 28 Feb 2018 14:01:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 453782
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 26517
x-xss-protection: 1; mode=block
server: cafe
etag: 9587303592933190018
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Mar 2018 14:01:30 GMT

GET
S 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame (76E 53 KB
20 KB 63ms
47ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

ac4e30b367a727a36c9c5f3f66053539a155ccbb0b935da5cd8fd34019d018e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
etag: 4343604296547922425
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=3600
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 20727
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20180228/r20110914/activeview/ Frame (76E 71 KB
26 KB 8ms
8ms Script
text/javascript 172.217.23.161
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180228/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.23.161 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f1.1e100.net

Software

cafe /

Resource Hash

95a2b3352f45ad7a28052ba8a142b8694e52cef35865312161bcd9cc73bbeccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Wed, 28 Feb 2018 14:01:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 453782
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 26517
x-xss-protection: 1; mode=block
server: cafe
etag: 9587303592933190018
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Mar 2018 14:01:30 GMT

GET
S 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame (C73 53 KB
20 KB 59ms
45ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

ac4e30b367a727a36c9c5f3f66053539a155ccbb0b935da5cd8fd34019d018e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
etag: 4343604296547922425
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=3600
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 20727
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20180228/r20110914/activeview/ Frame (C73 71 KB
26 KB 9ms
8ms Script
text/javascript 172.217.23.161
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180228/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.23.161 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f1.1e100.net

Software

cafe /

Resource Hash

95a2b3352f45ad7a28052ba8a142b8694e52cef35865312161bcd9cc73bbeccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Wed, 28 Feb 2018 14:01:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 453782
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 26517
x-xss-protection: 1; mode=block
server: cafe
etag: 9587303592933190018
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Mar 2018 14:01:30 GMT

GET
H/1.1 200
OK tag Show response
a.teads.tv/page/50428/ Frame (CD7 2 KB
1 KB 135ms
41ms Script
application/javascript 54.77.82.250

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/page/50428/tag
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 54.77.82.250 Dublin, Ireland, ASN (),
Reverse DNS: ec2-54-77-82-250.eu-west-1.compute.amazonaws.com
Software: teads-ssp /
Resource Hash: 6b0b4a47e143da5c4a268e87b4dd52673f7a9694c7a24aac104b0d74051b3470

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:32 GMT
Content-Encoding: gzip
Server: teads-ssp
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: no-cache, must-revalidate, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 725
Expires: 0

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20180228/r20110914/activeview/ Frame (CD7 71 KB
26 KB 6ms
6ms Script
text/javascript 172.217.23.161
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180228/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.23.161 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f1.1e100.net

Software

cafe /

Resource Hash

95a2b3352f45ad7a28052ba8a142b8694e52cef35865312161bcd9cc73bbeccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Wed, 28 Feb 2018 14:01:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 453782
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 26517
x-xss-protection: 1; mode=block
server: cafe
etag: 9587303592933190018
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Mar 2018 14:01:30 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame (74A 0
296 B 23ms
15ms Image
text/html 172.217.23.162

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstHF9OpJszdPIO94q0czIcKOXskMKgggz6nRU-vslN5VbuwxUjUnzGVZp1E-XURrPht9Y7P4MfMgSnl8pb5-J-hRZqhuQFF0PowzDJCCTx8BC9JdNDdamTZJrVmlB5Cg--7jp8hJ3h23m_DAoy-12jcvcrEtefCLyrB_zUp6mU-r-ZiVNXntTcKRrS5XHcvQYpMemPXecLcyYu4km7oXfdcTkQ5aOWVXrgqM6GVJFs2airyxss-twQLw_t3Pkq8rxQNLBJn9ajt&sig=Cg0ArKJSzA_odlOeLGkIEAE&urlfix=1&adurl=

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.162 Mountain View, United States, ASN (),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
content-type: text/html; charset=UTF-8
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 0
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame (70B 0
245 B 26ms
17ms Image
text/html 172.217.23.162

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuPRKHIY2KAEeiCeoddFWfCZ9yWxo3_TB3JQcTdkIswJ3XabqN0ePwX1ZbwU_LrXGe3hTUrspwuN_XM7kIzeU9uoH1b_hV3r5H2GiIoOvGih9lLoTcPmfe0QgE8zw04Jv2d4pgAzhRrcHkIHj5dGjxUA2l-BeD1VQd9N_eVq78hXVGoykCmKWaXt9enkFZxiOsowLbOYx0MMk52Slf9s81QPrtuQSuWd5ndT1_X3DiIsudj9ha_UjrytwDyvjRhX_rTa5JijwwE&sig=Cg0ArKJSzJJr-4-vKjh7EAE&urlfix=1&adurl=

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.162 Mountain View, United States, ASN (),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
content-type: text/html; charset=UTF-8
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 0
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame (76E 0
244 B 31ms
22ms Image
text/html 172.217.23.162

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvfPwv9BfhFrlL_MIcIyzhoSr8DEnAMUF4K8JcYdLdCaMmH6rFbuwWbo5C-rgp5ha6RjidCAtPuzxAlZtteJP9RVWg03ciI_lR0Wn2ZqB-L5PL4b1mxvMRMcoFHyifgLAQdguMoVaBsUwuzxKFek6u7_yczyilRW9Hivb0LTj6qlQ1qmeSx4nRA00vMjLBLp2ow02hZUzBQc2-pWo_9crzaMK4wA9GQPqizLAqovQlDGMZKfRhEGZyqrpAFi8ghPbeDgv9bgjaP&sig=Cg0ArKJSzMcJlnwkOeklEAE&urlfix=1&adurl=

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.162 Mountain View, United States, ASN (),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
content-type: text/html; charset=UTF-8
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 0
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame (C73 0
245 B 31ms
22ms Image
text/html 172.217.23.162

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu_1YhjpZHTYccFzp0ia3vE3Qw3Q7JeRaG8_bbolouSelmdB8pCSsTL_s0_tJiqB2Zj9HSmVl5Fv_p_0qoqtx5MjnGBb4B3Nw0TP5vKhJSwq4CzhvPi7ITjR_T66urOfAUOM8SSSUtd_DEot4WCRpEymfFSJN1ZoEqxxTkYrtrrZWYgJwYW-adtR5g8GrWu4Ltc2BK1ZH_S0_MItz7RLrdHmEgspjMJi5XxSuQl_avE9Hmr278EJ1JympK8yUQyXQKyo-wgM8ZL&sig=Cg0ArKJSzK-cHQW9nSIlEAE&urlfix=1&adurl=

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.162 Mountain View, United States, ASN (),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
content-type: text/html; charset=UTF-8
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 0
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame (CD7 0
254 B 27ms
18ms Image
text/html 172.217.23.162

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssjRjhicRhT8MefNjWwfGoHm9TH5kuy82oErJX66uy26uOK8AD5BjjnXmeB4YmYdOoSvP_1IA3JaAH8QsIA-rxNokDVUJ4nW9RQPRVFrofViTZe_f3jUQQoKfETJjrAqBGtSEBDdNBQQTaY60cRNYqP9vUeQpoyjCJ9PgiM503oZxsSsxLmF4xEGEwX5u7m65wOtyAPTgTJjhmkg-MnzAw1rG_18uP0cyfA2Eu0Lt6lEhc_QROKHvQawXOsFfSgmCV4pwqQwO4S7JZ-CVq_XqmfEc3cpgg&sig=Cg0ArKJSzHK9a7yDR9h2EAE&urlfix=1&adurl=

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.162 Mountain View, United States, ASN (),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
content-type: text/html; charset=UTF-8
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 0
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 /
www.facebook.com/tr/ 44 B
144 B 10ms
7ms Image
image/gif 185.60.216.35
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/tr/?id=333738300301153&ev=Microdata&dl=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&rl=&if=false&ts=1520280272252&cd[Schema.org]=%5B%5D&cd[OpenGraph]=%7B%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22SamSam%20ransomware%20virus%20keeps%20CDOT%20employees%20offline%20for%20fourth%20day%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F%22%2C%22og%3Adescription%22%3A%22Nasty%20ransomware%20took%20its%20toll%20on%20Colorado%20Department%20of%20Transportation%20workers%20for%20the%20fourth%20full%20work%20day%20as%20investigators%20scrambled%20to%20search%20every%20single%20employee%20computer%20for%20damage%20done%20by%20t%E2%80%A6%22%2C%22article%3Apublished_time%22%3A%222018-02-26T18%3A59%3A11%2B00%3A00%22%2C%22article%3Amodified_time%22%3A%222018-02-26T22%3A45%3A14%2B00%3A00%22%2C%22og%3Asite_name%22%3A%22The%20Denver%20Post%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fwww.denverpost.com%2Fwp-content%2Fuploads%2F2016%2F10%2Fcover.jpg%3Fw%3D1024%26h%3D576%22%2C%22og%3Aimage%3Awidth%22%3A%221024%22%2C%22og%3Aimage%3Aheight%22%3A%22576%22%2C%22og%3Alocale%22%3A%22en_US%22%7D&cd[Meta]=%7B%22title%22%3A%22CDOT%20employees%20still%20offline%20after%20SamSam%20ransomware%20virus%20attack%22%2C%22meta%3Adescription%22%3A%22Critical%20systems%2C%20like%20road%20alerts%2C%20not%20affected.%20But%20if%20you%20do%20business%20with%20CDOT%2C%20there%20could%20be%20delays%22%2C%22meta%3Akeywords%22%3A%22ransomware%2C%20SamSam%2C%20CDOT%2C%20Amy%20Ford%2C%20malware%2C%20cybersecurity%2C%22%7D&cd[DataLayer]=%5B%5D&sw=1600&sh=1200&v=2.8.12&r=stable&ec=1&o=28&it=1520280271608
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 185.60.216.35 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software: proxygen-bolt /
Resource Hash: 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:32 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S

200

sp.gz.js Show response
js.matheranalytics.com/static/2_2_16-c/ Frame (CD7
Redirect Chain

https://js.matheranalytics.com/s/ma23578/239876503/sp.js?cb=1466
https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js

72 KB
26 KB

7ms
6ms

Script
application/x-javascript

107.178.250.234
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 107.178.250.234 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6a404f237f78fc8eefdc0e09e61ef8cec67226b3627f3dc338afaf380745b188

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 08:06:02 GMT
content-encoding: gzip
last-modified: Fri, 29 Jul 2016 15:32:30 GMT
server: nginx
age: 43110
etag: "527f836cbc28a94db8199152abb3505c"
vary: Accept-Encoding
x-cache: HIT Thu, 01 Mar 2018 00:06:25 GMT
content-type: application/x-javascript
status: 200
cache-control: public, max-age=269200
alt-svc: clear
content-length: 26220
via: 1.1 google

Redirect headers

date: Mon, 05 Mar 2018 20:04:32 GMT
via: 1.1 google
server: nginx
status: 301
vary: Accept-Encoding
location: https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js
cache-control: public, max-age=269200
alt-svc: clear
x-served-by: 3-gc-useast4-10909

GET
S 200 integrator.js Show response
adservice.google.de/adsid/ Frame (76E 108 B
174 B 14ms
14ms Script
application/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.denverpost.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 integrator.js Show response
adservice.google.com/adsid/ Frame (76E 108 B
174 B 15ms
15ms Script
application/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.denverpost.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 ca-pub-5831866191128057.js Show response
pagead2.googlesyndication.com/pub-config/r20160913/ Frame (76E 133 B
289 B 7ms
6ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-5831866191128057.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

sffe /

Resource Hash

7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 08:24:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sat, 03 Mar 2018 23:03:56 GMT
server: sffe
age: 41991
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=43200
accept-ranges: bytes
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 125
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:24:41 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/ Frame (618 178 KB
66 KB 52ms
51ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

0517c66a6ea7f6838297f943858762cc1e6aee028daca5f09ab3a51ba874ed7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
etag: 12438865884920658202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 67842
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S

200

sp.gz.js Show response
js.matheranalytics.com/static/2_2_16-c/ Frame (76E
Redirect Chain

https://js.matheranalytics.com/s/ma23578/239876503/sp.js?cb=1466
https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js

72 KB
26 KB

6ms
6ms

Script
application/x-javascript

107.178.250.234
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 107.178.250.234 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6a404f237f78fc8eefdc0e09e61ef8cec67226b3627f3dc338afaf380745b188

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 08:06:02 GMT
content-encoding: gzip
last-modified: Fri, 29 Jul 2016 15:32:30 GMT
server: nginx
age: 43110
etag: "527f836cbc28a94db8199152abb3505c"
vary: Accept-Encoding
x-cache: HIT Thu, 01 Mar 2018 00:06:25 GMT
content-type: application/x-javascript
status: 200
cache-control: public, max-age=269200
alt-svc: clear
content-length: 26220
via: 1.1 google

Redirect headers

date: Mon, 05 Mar 2018 20:04:32 GMT
via: 1.1 google
server: nginx
status: 301
vary: Accept-Encoding
location: https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js
cache-control: public, max-age=269200
alt-svc: clear
x-served-by: 9-gc-useast4-10906

GET
S 200 integrator.js Show response
adservice.google.de/adsid/ Frame (C73 108 B
174 B 15ms
14ms Script
application/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.denverpost.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 integrator.js Show response
adservice.google.com/adsid/ Frame (C73 108 B
174 B 15ms
14ms Script
application/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.denverpost.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 ca-pub-5831866191128057.js Show response
pagead2.googlesyndication.com/pub-config/r20160913/ Frame (C73 133 B
185 B 7ms
6ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-5831866191128057.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

sffe /

Resource Hash

7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 08:24:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sat, 03 Mar 2018 23:03:56 GMT
server: sffe
age: 41991
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=43200
accept-ranges: bytes
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 125
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:24:41 GMT

GET
S

200

sp.gz.js Show response
js.matheranalytics.com/static/2_2_16-c/ Frame (C73
Redirect Chain

https://js.matheranalytics.com/s/ma23578/239876503/sp.js?cb=1466
https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js

72 KB
26 KB

6ms
6ms

Script
application/x-javascript

107.178.250.234
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 107.178.250.234 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6a404f237f78fc8eefdc0e09e61ef8cec67226b3627f3dc338afaf380745b188

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 08:06:02 GMT
content-encoding: gzip
last-modified: Fri, 29 Jul 2016 15:32:30 GMT
server: nginx
age: 43110
etag: "527f836cbc28a94db8199152abb3505c"
vary: Accept-Encoding
x-cache: HIT Thu, 01 Mar 2018 00:06:25 GMT
content-type: application/x-javascript
status: 200
cache-control: public, max-age=269200
alt-svc: clear
content-length: 26220
via: 1.1 google

Redirect headers

date: Mon, 05 Mar 2018 20:04:32 GMT
via: 1.1 google
server: nginx
status: 301
vary: Accept-Encoding
location: https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js
cache-control: public, max-age=269200
alt-svc: clear
x-served-by: 4-gc-useast4-10903

GET
S 200 integrator.js Show response
adservice.google.de/adsid/ Frame (74A 108 B
174 B 17ms
15ms Script
application/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.denverpost.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 integrator.js Show response
adservice.google.com/adsid/ Frame (74A 108 B
174 B 16ms
14ms Script
application/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.denverpost.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 ca-pub-5831866191128057.js Show response
pagead2.googlesyndication.com/pub-config/r20160913/ Frame (74A 133 B
185 B 7ms
5ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-5831866191128057.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

sffe /

Resource Hash

7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 08:24:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sat, 03 Mar 2018 23:03:56 GMT
server: sffe
age: 41991
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=43200
accept-ranges: bytes
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 125
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:24:41 GMT

GET
S

200

sp.gz.js Show response
js.matheranalytics.com/static/2_2_16-c/ Frame (74A
Redirect Chain

https://js.matheranalytics.com/s/ma23578/239876503/sp.js?cb=1466
https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js

72 KB
26 KB

6ms
6ms

Script
application/x-javascript

107.178.250.234
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 107.178.250.234 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6a404f237f78fc8eefdc0e09e61ef8cec67226b3627f3dc338afaf380745b188

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 08:06:02 GMT
content-encoding: gzip
last-modified: Fri, 29 Jul 2016 15:32:30 GMT
server: nginx
age: 43110
etag: "527f836cbc28a94db8199152abb3505c"
vary: Accept-Encoding
x-cache: HIT Thu, 01 Mar 2018 00:06:25 GMT
content-type: application/x-javascript
status: 200
cache-control: public, max-age=269200
alt-svc: clear
content-length: 26220
via: 1.1 google

Redirect headers

date: Mon, 05 Mar 2018 20:04:32 GMT
via: 1.1 google
server: nginx
status: 301
vary: Accept-Encoding
location: https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js
cache-control: public, max-age=269200
alt-svc: clear
x-served-by: 1-gc-useast4-10901

GET
S 200 integrator.js Show response
adservice.google.de/adsid/ Frame (70B 108 B
174 B 18ms
17ms Script
application/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.denverpost.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 integrator.js Show response
adservice.google.com/adsid/ Frame (70B 108 B
174 B 16ms
16ms Script
application/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.denverpost.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 ca-pub-5831866191128057.js Show response
pagead2.googlesyndication.com/pub-config/r20160913/ Frame (70B 133 B
0 7ms
5ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-5831866191128057.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

sffe /

Resource Hash

7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 05 Mar 2018 08:24:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sat, 03 Mar 2018 23:03:56 GMT
server: sffe
age: 41991
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=43200
accept-ranges: bytes
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 125
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:24:41 GMT

GET
S

200

sp.gz.js Show response
js.matheranalytics.com/static/2_2_16-c/ Frame (70B
Redirect Chain

https://js.matheranalytics.com/s/ma23578/239876503/sp.js?cb=1466
https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js

72 KB
26 KB

8ms
7ms

Script
application/x-javascript

107.178.250.234
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 107.178.250.234 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6a404f237f78fc8eefdc0e09e61ef8cec67226b3627f3dc338afaf380745b188

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 08:06:02 GMT
content-encoding: gzip
last-modified: Fri, 29 Jul 2016 15:32:30 GMT
server: nginx
age: 43110
etag: "527f836cbc28a94db8199152abb3505c"
vary: Accept-Encoding
x-cache: HIT Thu, 01 Mar 2018 00:06:25 GMT
content-type: application/x-javascript
status: 200
cache-control: public, max-age=269200
alt-svc: clear
content-length: 26220
via: 1.1 google

Redirect headers

date: Mon, 05 Mar 2018 20:04:32 GMT
via: 1.1 google
server: nginx
status: 301
vary: Accept-Encoding
location: https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js
cache-control: public, max-age=269200
alt-svc: clear
x-served-by: 2-gc-useast4-10904

GET
S 200 css
fonts.googleapis.com/ 12 KB
919 B 18ms
18ms Stylesheet
text/css 172.217.22.10
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700,800&subweset=latin,cyrillic-ext,cyrillic,greek-ext,greek,vietnamese,latin-ext

Requested by

Host: recirculation.spot.im
URL: https://recirculation.spot.im/spot/sp_sXPv48AD

Protocol

SPDY

Server

172.217.22.10 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f10.1e100.net

Software

ESF /

Resource Hash

d133ba6c3606f15996eaecffe9eb3ac1341711db1f4a1851a72b7c619d6b95b9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
last-modified: Mon, 05 Mar 2018 20:04:32 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

OPTIONS
H/1.1 200
OK sp_sXPv48AD Show response
www.spot.im/api/tracker/spot/ 0
784 B 412ms
387ms XHR
application/json 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.spot.im/api/tracker/spot/sp_sXPv48AD

Requested by

Host: recirculation.spot.im
URL: https://recirculation.spot.im/spot/sp_sXPv48AD

Protocol

HTTP/1.1

Server

209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),

Reverse DNS

vip0x03f.map2.ssl.hwcdn.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Access-Control-Request-Method: GET
Origin: https://www.denverpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
X-Content-Type-Options: nosniff
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, HEAD, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: https://www.denverpost.com
Access-Control-Expose-Headers: x-spotim-bid, x-spotim-rid, x-spotim-token, x-spotim-networkid, x-spotim-spotid, x-spotim-vid
Access-Control-Allow-Credentials: true
x-spotim-bid
Connection: Keep-Alive
x-spotim-rid
Access-Control-Allow-Headers: x-spotim-bid, x-spotim-rid, x-spotim-token, x-spotim-networkid, x-spotim-spotid, x-spotim-vid, Content-Type
Content-Length: 0
X-HW: 1520280272.dop009.fr8.t,1520280272.cds008.fr8.shn,1520280272.cds008.fr8.sc,1520280272.cds008.fr8.p
x-spotim-vid

GET prebid_loader.min.js
cdn.spotim.market/prebid/ Frame (2D2 0
0

GET
S 200 gpt.js Show response
www.googletagservices.com/tag/js/ Frame (2D2 13 KB
0 58ms
40ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: recirculation.spot.im
URL: https://recirculation.spot.im/spot/sp_sXPv48AD

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

sffe /

Resource Hash

8ba355d714c3387de480eaf201e6ea065f1466ce2f963fde40d34b6410087e32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 05 Mar 2018 20:04:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "2 / 367 of 1000 / last-modified: 1520266333"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 5861
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:31 GMT

GET
H/1.1 200
OK t
track.spots.im/ 2 B
473 B 3751ms
102ms Image
application/json 52.5.76.191

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.spots.im/t?m=eyJ2aXNpdF9pZCI6IjFiMDMyYTI2NjU5N2ViNWE1MTc2ZGRlZDNjMTM4NzA3IiwiaWJfYnJvd3Nlcl9pZCI6ImQyNzlhNzc4NTkzYzk1MDI2NTFiN2E4MGNjYmI4MzlkIiwidiI6NiwidGltZV9kZWx0YSI6MTQxNSwidWlkIjoiOTgwY2FkM2RmMjdiMWZmMTk0ZDE2NWI0ZGVmYzQ3NzQiLCJzcG90X2lkIjoic3Bfc1hQdjQ4QUQiLCJzb3VyY2UiOiJyZWNpcmN1bGF0aW9uIiwic291cmNlX3ZlcnNpb24iOiI0ODUiLCJjbGllbnRfcGxhdGZvcm0iOiJEZXNrdG9wIiwiZG9tYWluIjoid3d3LmRlbnZlcnBvc3QuY29tIiwidXJsIjoiaHR0cHM6Ly93d3cuZGVudmVycG9zdC5jb20vMjAxOC8wMi8yNi9zYW1zYW0tcmFuc29td2FyZS12aXJ1cy1jZG90LyIsInJlZmVycmVyIjoiIiwibGFuZyI6ImVuLVVTIiwidHlwZSI6ImxvYWRlZCIsImVuZ2luZV9zdGF0dXMiOiJhdmFpbGFibGUifQ%3D%3D&rnd=0.5229346127468537
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.5.76.191 Ashburn, United States, ASN (),
Reverse DNS: ec2-52-5-76-191.compute-1.amazonaws.com
Software: iris /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:35 GMT
Server: iris
Access-Control-Max-Age: 3600
Access-Control-Allow-Methods: GET, OPTIONS
Content-Type: application/json;charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: content-type, x-ironsource-atom-sdk-type, x-ironsource-atom-sdk-version
Content-Length: 2

GET
H/1.1 200
OK t
track.spots.im/ 2 B
473 B 3751ms
103ms Image
application/json 52.5.76.191

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.spots.im/t?m=eyJ2aXNpdF9pZCI6IjFiMDMyYTI2NjU5N2ViNWE1MTc2ZGRlZDNjMTM4NzA3IiwiaWJfYnJvd3Nlcl9pZCI6ImQyNzlhNzc4NTkzYzk1MDI2NTFiN2E4MGNjYmI4MzlkIiwidiI6NiwidGltZV9kZWx0YSI6MTQyNCwidWlkIjoiODNjMWI2Y2NjYmE1NTEyZDVjNmY4NWZkNjZiMDI5YWEiLCJzcG90X2lkIjoic3Bfc1hQdjQ4QUQiLCJzb3VyY2UiOiJyZWNpcmN1bGF0aW9uIiwic291cmNlX3ZlcnNpb24iOiI0ODUiLCJjbGllbnRfcGxhdGZvcm0iOiJEZXNrdG9wIiwiZG9tYWluIjoid3d3LmRlbnZlcnBvc3QuY29tIiwidXJsIjoiaHR0cHM6Ly93d3cuZGVudmVycG9zdC5jb20vMjAxOC8wMi8yNi9zYW1zYW0tcmFuc29td2FyZS12aXJ1cy1jZG90LyIsInJlZmVycmVyIjoiIiwibGFuZyI6ImVuLVVTIiwidHlwZSI6ImVuZ2luZV9zdGF0dXMiLCJlbmdpbmVfc3RhdHVzIjoiZW5naW5lLW1vbmV0aXphdGlvbi1sb2FkIiwiY291bnQiOjF9&rnd=0.9886086095540678
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.5.76.191 Ashburn, United States, ASN (),
Reverse DNS: ec2-52-5-76-191.compute-1.amazonaws.com
Software: iris /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:35 GMT
Server: iris
Access-Control-Max-Age: 3600
Access-Control-Allow-Methods: GET, OPTIONS
Content-Type: application/json;charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: content-type, x-ironsource-atom-sdk-type, x-ironsource-atom-sdk-version
Content-Length: 2

GET
H/1.1 200
OK t
track.spots.im/ 2 B
473 B 3764ms
107ms Image
application/json 52.5.76.191

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.spots.im/t?m=eyJ2aXNpdF9pZCI6IjFiMDMyYTI2NjU5N2ViNWE1MTc2ZGRlZDNjMTM4NzA3IiwiaWJfYnJvd3Nlcl9pZCI6ImQyNzlhNzc4NTkzYzk1MDI2NTFiN2E4MGNjYmI4MzlkIiwidiI6NiwidGltZV9kZWx0YSI6MTQyNSwidWlkIjoiYmZmYmVkY2NhY2MyOGY0ODZhNDIwMDFkMjc1NTJlNjQiLCJzcG90X2lkIjoic3Bfc1hQdjQ4QUQiLCJzb3VyY2UiOiJyZWNpcmN1bGF0aW9uIiwic291cmNlX3ZlcnNpb24iOiI0ODUiLCJlbmdpbmVfdmVuZG9yX25hbWUiOiJERlAiLCJlbmdpbmVfdGFnX2lkIjoidGFnX0xFQklYU200dUdXOSIsImNsaWVudF9wbGF0Zm9ybSI6IkRlc2t0b3AiLCJkb21haW4iOiJ3d3cuZGVudmVycG9zdC5jb20iLCJ1cmwiOiJodHRwczovL3d3dy5kZW52ZXJwb3N0LmNvbS8yMDE4LzAyLzI2L3NhbXNhbS1yYW5zb213YXJlLXZpcnVzLWNkb3QvIiwicmVmZXJyZXIiOiIiLCJsYW5nIjoiZW4tVVMiLCJ0eXBlIjoiZW5naW5lX3N0YXR1cyIsImVuZ2luZV9zdGF0dXMiOiJlbmdpbmUtd2lsbC1pbml0aWFsaXplIiwiY291bnQiOjF9&rnd=0.6562883715402938
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.5.76.191 Ashburn, United States, ASN (),
Reverse DNS: ec2-52-5-76-191.compute-1.amazonaws.com
Software: iris /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:35 GMT
Server: iris
Access-Control-Max-Age: 3600
Access-Control-Allow-Methods: GET, OPTIONS
Content-Type: application/json;charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: content-type, x-ironsource-atom-sdk-type, x-ironsource-atom-sdk-version
Content-Length: 2

GET
H/1.1 200
OK t
track.spots.im/ 2 B
473 B 3767ms
107ms Image
application/json 52.5.76.191

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.spots.im/t?m=eyJ2aXNpdF9pZCI6IjFiMDMyYTI2NjU5N2ViNWE1MTc2ZGRlZDNjMTM4NzA3IiwiaWJfYnJvd3Nlcl9pZCI6ImQyNzlhNzc4NTkzYzk1MDI2NTFiN2E4MGNjYmI4MzlkIiwidiI6NiwidGltZV9kZWx0YSI6MTQyNSwidWlkIjoiNmQ1YTJkMmJlMWE3MjA5ZWJhNzFhMWU2MWU0ZjNjZTEiLCJzcG90X2lkIjoic3Bfc1hQdjQ4QUQiLCJzb3VyY2UiOiJyZWNpcmN1bGF0aW9uIiwic291cmNlX3ZlcnNpb24iOiI0ODUiLCJlbmdpbmVfdmVuZG9yX25hbWUiOiJERlAiLCJlbmdpbmVfdGFnX2lkIjoidGFnX0xFQklYU200dUdXOSIsImNsaWVudF9wbGF0Zm9ybSI6IkRlc2t0b3AiLCJkb21haW4iOiJ3d3cuZGVudmVycG9zdC5jb20iLCJ1cmwiOiJodHRwczovL3d3dy5kZW52ZXJwb3N0LmNvbS8yMDE4LzAyLzI2L3NhbXNhbS1yYW5zb213YXJlLXZpcnVzLWNkb3QvIiwicmVmZXJyZXIiOiIiLCJsYW5nIjoiZW4tVVMiLCJ0eXBlIjoiZW5naW5lX3N0YXR1cyIsImVuZ2luZV9zdGF0dXMiOiJlbmdpbmUtaW5pdGlhbGl6ZWQiLCJjb3VudCI6MX0%3D&rnd=0.8162746192304171
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.5.76.191 Ashburn, United States, ASN (),
Reverse DNS: ec2-52-5-76-191.compute-1.amazonaws.com
Software: iris /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:35 GMT
Server: iris
Access-Control-Max-Age: 3600
Access-Control-Allow-Methods: GET, OPTIONS
Content-Type: application/json;charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: content-type, x-ironsource-atom-sdk-type, x-ironsource-atom-sdk-version
Content-Length: 2

GET
H/1.1 200
OK xvcjigfikhk2axpfanvx
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/ 9 KB
10 KB 33ms
8ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/xvcjigfikhk2axpfanvx
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: eb87a730f99fe7cdee95a385a3dc62fbf5d67ff25b5564772ce4052f5c8c138c

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Mon, 05 Mar 2018 16:18:08 GMT
ETag: 1520266688
X-HW: 1520280272.dop009.fr8.t,1520280272.cds002.fr8.shn,1520280272.dop009.fr8.t,1520280272.cds003.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=72844
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 9594

GET
H/1.1 200
OK npidf8flcqqtymgx1xze
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/ 26 KB
26 KB 33ms
8ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/npidf8flcqqtymgx1xze
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: aeab0cb3b2befe450ee7ac64e48ace5ade48bfb66e5cf227384f490fbe69630c

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Mon, 05 Mar 2018 02:37:14 GMT
ETag: 1520217434
X-HW: 1520280272.dop004.fr8.t,1520280272.cds046.fr8.shn,1520280272.dop004.fr8.t,1520280272.cds039.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=24012
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 26502

GET
H/1.1 200
OK oc5ovvd1mejbwpwaznbh
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_34,w_34,c_thumb,r_max,g_face/v200/p/u/ 410 B
758 B 35ms
8ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_34,w_34,c_thumb,r_max,g_face/v200/p/u/oc5ovvd1mejbwpwaznbh
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 0ec04bfe055b86ca4c19144f81aebc2aecef5a07ce707faa46af08991ef6809e

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Sun, 14 Jan 2018 21:20:03 GMT
ETag: 1515964803
X-HW: 1520280272.dop004.fr8.t,1520280272.cds032.fr8.shn,1520280272.dop004.fr8.t,1520280272.cds008.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=68178
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 410

GET
H/1.1 200
OK fvhjqankbnicstx6pnjz
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/ 14 KB
14 KB 35ms
9ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/fvhjqankbnicstx6pnjz
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: d4dcf0e52bfc6fe5b8c7e58ebb65e54ae23bc46674943ac4ae48d6b53a032bb4

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Sun, 04 Mar 2018 02:12:38 GMT
ETag: 1520129558
X-HW: 1520280272.dop009.fr8.t,1520280272.cds020.fr8.shn,1520280272.dop009.fr8.t,1520280272.cds019.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=25479
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 13848

GET
H/1.1 200
OK gnieioccwqjc9pfnb1ju
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_34,w_34,c_thumb,r_max,g_face/v200/p/u/ 566 B
914 B 8ms
8ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_34,w_34,c_thumb,r_max,g_face/v200/p/u/gnieioccwqjc9pfnb1ju
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 90971b5abba8fb8482d192a07c1b51397eeacf3351e01bcf58fec3f0b8775cd0

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Sat, 20 Jan 2018 18:21:34 GMT
ETag: 1516472494
X-HW: 1520280272.dop009.fr8.t,1520280272.cds002.fr8.shn,1520280272.dop009.fr8.t,1520280272.cds017.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=14432
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 566

GET
H/1.1 200
OK jdkh7vcujrwbcgf1v0ay
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/ 15 KB
15 KB 154ms
154ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/jdkh7vcujrwbcgf1v0ay
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 9646f432a47705aeb0df4e23a0b13a94c205b366ca544dd3f0b7061339881e6f

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Mon, 05 Mar 2018 20:03:02 GMT
ETag: 1520280182
X-HW: 1520280272.dop004.fr8.t,1520280272.cds046.fr8.shn,1520280272.dop004.fr8.t,1520280272.cds041.fr8.p
Content-Type: image/jpeg
Cache-Control: max-age=86400
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 15135

GET
H/1.1 200
OK dugmyxl0upryekfnazeg
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/ 17 KB
17 KB 7ms
7ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/dugmyxl0upryekfnazeg
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: a0f7ad40a8b8b9df70709defea63709286ca0b6d6c2efe903bcf1aca308fedaf

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Sun, 04 Mar 2018 21:49:30 GMT
ETag: 1520200170
X-HW: 1520280272.dop004.fr8.t,1520280272.cds032.fr8.shn,1520280272.dop004.fr8.t,1520280272.cds043.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=6353
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 17053

GET
H/1.1 200
OK 7dc4ff8c6ea1dbcbf9fa347efd527d4b
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_34,w_34,c_thumb,r_max,g_face/v200/ 687 B
1 KB 8ms
8ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_34,w_34,c_thumb,r_max,g_face/v200/7dc4ff8c6ea1dbcbf9fa347efd527d4b
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 52067cb8c17e70aa0eb89ee87e2156579df49e376fc2450af85e3964b3c953a2

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Tue, 09 Jan 2018 18:08:37 GMT
ETag: 1515521317
X-HW: 1520280272.dop009.fr8.t,1520280272.cds020.fr8.shn,1520280272.dop009.fr8.t,1520280272.cds008.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=75515
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 687

GET
H/1.1 200
OK z4r4fhe6gfhbqy3hqxre
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/ 10 KB
10 KB 7ms
7ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/z4r4fhe6gfhbqy3hqxre
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 2e62791314793c102e9950724a89245d603380c83d42cc2785378e6bc0078672

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Mon, 05 Mar 2018 19:49:51 GMT
ETag: 1520279391
X-HW: 1520280272.dop009.fr8.t,1520280272.cds002.fr8.shn,1520280272.dop009.fr8.t,1520280272.cds028.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=85576
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 10392

GET
H/1.1 200
OK m7dxut1lllrnu8yvwzzp
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/ 12 KB
12 KB 8ms
8ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/m7dxut1lllrnu8yvwzzp
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 08ca8cc0a09b2fc94fc1b7189f7cdc31716ce0d0694e9cfdb63ce941137d65c4

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Mon, 05 Mar 2018 19:25:27 GMT
ETag: 1520277927
X-HW: 1520280272.dop004.fr8.t,1520280272.cds032.fr8.shn,1520280272.dop004.fr8.t,1520280272.cds014.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=84106
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 12174

GET
H/1.1 200
OK f8d938a2fe113f57755564f664890fa2
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_34,w_34,c_thumb,r_max,g_face/v200/ 838 B
1 KB 8ms
8ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_34,w_34,c_thumb,r_max,g_face/v200/f8d938a2fe113f57755564f664890fa2
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 43a5480be163a10c4036b989e340a168aaea8a3ad062d95d589ec3e9651d340f

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Wed, 10 Jan 2018 01:30:03 GMT
ETag: 1515547803
X-HW: 1520280272.dop009.fr8.t,1520280272.cds020.fr8.shn,1520280272.dop009.fr8.t,1520280272.cds026.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=86273
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 838

GET
H/1.1 200
OK pfxnvatkumvv2j0wglsx
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/ 21 KB
22 KB 7ms
7ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/pfxnvatkumvv2j0wglsx
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 81751d6c2faecdb9f793f25b2417277a01dcbae6d147622b8b6fcad7a4835af9

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Mon, 05 Mar 2018 10:36:11 GMT
ETag: 1520246171
X-HW: 1520280272.dop009.fr8.t,1520280272.cds002.fr8.shn,1520280272.dop009.fr8.t,1520280272.cds007.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=52375
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 21846

GET
H/1.1 200
OK ce35361550cea6d6eaa1068ca8609da8
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_34,w_34,c_thumb,r_max,g_face/v200/ 748 B
1 KB 8ms
7ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_34,w_34,c_thumb,r_max,g_face/v200/ce35361550cea6d6eaa1068ca8609da8
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: a103eebda6a5fd876ce289fea770859bddb5f68f8aa5aa10a656a8aaac5a49ac

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Tue, 30 Jan 2018 21:42:59 GMT
ETag: 1517348579
X-HW: 1520280272.dop004.fr8.t,1520280272.cds032.fr8.shn,1520280272.dop004.fr8.t,1520280272.cds046.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=85261
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 748

GET
H/1.1 200
OK wroypuopckhjzhjiid4v
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/ 17 KB
17 KB 7ms
7ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/wroypuopckhjzhjiid4v
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 29682278a8e5675c8cda93d2bf3debc501059652c3c7479490e33786d5b295bb

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Mon, 05 Mar 2018 19:59:59 GMT
ETag: 1520279999
X-HW: 1520280272.dop009.fr8.t,1520280272.cds020.fr8.shn,1520280272.dop009.fr8.t,1520280272.cds015.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=86272
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 17066

GET
H/1.1 200
OK xoc3infniryun5kpxyx5
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_34,w_34,c_thumb,r_max,g_face/v200/p/u/ 831 B
1 KB 6ms
6ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_34,w_34,c_thumb,r_max,g_face/v200/p/u/xoc3infniryun5kpxyx5
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 2ee2237bac85687238733d5bba227eb04b9c34ed4d817c21527cb7012316aa38

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Fri, 12 Jan 2018 02:55:42 GMT
ETag: 1515725742
X-HW: 1520280272.dop009.fr8.t,1520280272.cds002.fr8.shn,1520280272.dop009.fr8.t,1520280272.cds007.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=75319
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 831

GET
H/1.1 200
OK ulqlejcdltopq5n3r7jf
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/ 24 KB
25 KB 8ms
7ms Image
image/jpeg 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_300,w_320,c_fill,g_face/v200/production/ulqlejcdltopq5n3r7jf
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 69db17c06068efb64040c2e98d0b2c5359d294fa37475dcef9e828a6a3f05ac2

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Mon, 05 Mar 2018 18:56:18 GMT
ETag: 1520276178
X-HW: 1520280272.dop004.fr8.t,1520280272.cds032.fr8.shn,1520280272.dop004.fr8.t,1520280272.cds015.fr8.c
Content-Type: image/jpeg
Cache-Control: max-age=82460
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 24974

GET
H/1.1 200
OK e697103b9a0c8ef0f9603ee86260581b
images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_34,w_34,c_thumb,r_max,g_face/v200/ 3 KB
3 KB 7ms
7ms Image
image/png 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.spot.im/image/upload/q_70,fl_lossy,dpr_1.0,h_34,w_34,c_thumb,r_max,g_face/v200/e697103b9a0c8ef0f9603ee86260581b
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/osd.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: ca19741acaa61449f33108c4210ac2abf832b5e2daf9e6bc1af928f788ac9044

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Last-Modified: Fri, 12 Jan 2018 22:13:42 GMT
ETag: 1515795222
X-HW: 1520280272.dop009.fr8.t,1520280272.cds020.fr8.shn,1520280272.dop009.fr8.t,1520280272.cds039.fr8.c
Content-Type: image/png
Cache-Control: max-age=70914
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 3138

GET
H/1.1 200
OK teads-format.min.js Show response
cdn.teads.tv/media/format/v3/ 659 KB
159 KB 25ms
6ms Script
text/javascript 2.18.234.227

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.teads.tv/media/format/v3/teads-format.min.js
Requested by: Host: a.teads.tv
URL: https://a.teads.tv/page/50428/tag
Protocol: HTTP/1.1
Server: 2.18.234.227 , European Union, ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 730bc7510aefdabb4124b6bb3942ab8e3aba39b30a5f5af425545d8eefbc5e4e

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Content-Encoding: gzip
Last-Modified: Mon, 05 Mar 2018 13:39:34 GMT
Server: AmazonS3
x-amz-request-id: 30220CC654ABF03D
ETag: "b2409978602a89b243983d6e1bd3bacd"
Vary: Accept-Encoding
Content-Type: text/javascript;charset=utf-8
Cache-Control: max-age=167
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 161853
x-amz-id-2: RAtdOCZ5D+5+W6SeMSTKPV1Ha6JyxzBbOBUoDP+bjt6yVIpCAUmlbKzwNcufMWMMyUoFexHBscA=

GET
S 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v15/ 9 KB
9 KB 7ms
6ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v15/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

8868d2a2f803ea6802d54a11564b5b96c7d8be56117a328c8f605539d6dee167

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700,800&subweset=latin,cyrillic-ext,cyrillic,greek-ext,greek,vietnamese,latin-ext
Origin: https://www.denverpost.com

Response headers

date: Mon, 12 Feb 2018 18:56:46 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 21:49:46 GMT
server: sffe
age: 1818466
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 8892
x-xss-protection: 1; mode=block
expires: Tue, 12 Feb 2019 18:56:46 GMT

GET
S 200 mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/ 9 KB
9 KB 7ms
7ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

fe32c9921874b35b87acb0a3b558784ca7b9fed91ed34c1d2a68b6566c9d09be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700,800&subweset=latin,cyrillic-ext,cyrillic,greek-ext,greek,vietnamese,latin-ext
Origin: https://www.denverpost.com

Response headers

date: Mon, 12 Feb 2018 17:57:46 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 21:49:39 GMT
server: sffe
age: 1822006
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 8800
x-xss-protection: 1; mode=block
expires: Tue, 12 Feb 2019 17:57:46 GMT

GET
S 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame (49F 53 KB
0 59ms
45ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

ac4e30b367a727a36c9c5f3f66053539a155ccbb0b935da5cd8fd34019d018e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 4343604296547922425
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=3600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 20727
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 integrator.js Show response
adservice.google.de/adsid/ Frame (49F 108 B
174 B 28ms
28ms Script
application/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.denverpost.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 integrator.js Show response
adservice.google.com/adsid/ Frame (49F 108 B
174 B 18ms
18ms Script
application/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.denverpost.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 107
x-xss-protection: 1; mode=block

GET
S 200 ca-pub-5831866191128057.js Show response
pagead2.googlesyndication.com/pub-config/r20160913/ Frame (49F 133 B
0 7ms
5ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pub-config/r20160913/ca-pub-5831866191128057.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

sffe /

Resource Hash

7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 05 Mar 2018 08:24:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sat, 03 Mar 2018 23:03:56 GMT
server: sffe
age: 41991
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=43200
accept-ranges: bytes
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 125
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:24:41 GMT

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20180228/r20110914/activeview/ Frame (49F 71 KB
0 6ms
6ms Script
text/javascript 172.217.23.161
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180228/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js

Protocol

SPDY

Server

172.217.23.161 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f1.1e100.net

Software

cafe /

Resource Hash

95a2b3352f45ad7a28052ba8a142b8694e52cef35865312161bcd9cc73bbeccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Wed, 28 Feb 2018 14:01:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 453782
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 26517
x-xss-protection: 1; mode=block
server: cafe
etag: 9587303592933190018
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Mar 2018 14:01:30 GMT

GET
S

200

sp.gz.js Show response
js.matheranalytics.com/static/2_2_16-c/ Frame (49F
Redirect Chain

https://js.matheranalytics.com/s/ma23578/239876503/sp.js?cb=1466
https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js

72 KB
26 KB

6ms
6ms

Script
application/x-javascript

107.178.250.234
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 107.178.250.234 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 234.250.178.107.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6a404f237f78fc8eefdc0e09e61ef8cec67226b3627f3dc338afaf380745b188

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 08:06:02 GMT
content-encoding: gzip
last-modified: Fri, 29 Jul 2016 15:32:30 GMT
server: nginx
age: 43110
etag: "527f836cbc28a94db8199152abb3505c"
vary: Accept-Encoding
x-cache: HIT Thu, 01 Mar 2018 00:06:25 GMT
content-type: application/x-javascript
status: 200
cache-control: public, max-age=269200
alt-svc: clear
content-length: 26220
via: 1.1 google

Redirect headers

date: Mon, 05 Mar 2018 20:04:32 GMT
via: 1.1 google
server: nginx
status: 301
vary: Accept-Encoding
location: https://js.matheranalytics.com/static/2_2_16-c/sp.gz.js
cache-control: public, max-age=269200
alt-svc: clear
x-served-by: 9-gc-useast4-10904

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame (49F 0
47 B 345ms
345ms Image
text/html 172.217.23.162

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstARvab_LG-6QKkysOmcnQFQ_vWyT_h-ILLXsFuVhf74WZbEeaEn_Af-Fmwygsp5YBexGrn80IJSU7y6z4SlE5_itw-A5ibGCUpAG2HZ0JM1jB38bk88VxiAEYaKCtrTHnmj8Z-9giCEQ68fEEwP1ZHD9M0FcyLoWTjEYY6xk2gS9LzZZMrgj-9vXxVlWcIikkK986Jlw5BEdSXr6rQVcJLMiaFBc9802rd9r1Omqc7dYTdjZnmzv6g9Ezld6Ezm-j1y92Emqkb&sig=Cg0ArKJSzCyNjKl_AtTREAE&urlfix=1&adurl=

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.162 Mountain View, United States, ASN (),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
content-type: text/html; charset=UTF-8
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 0
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ Frame (CD7 43 B
338 B 109ms
109ms Image
image/gif 52.5.12.45
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNDQ0ODMyNzE4MSIsImVidXkiOiI1NzEzMjk2MTQiLCJlYWR2IjoiMzI5OTkyMjE0IiwiZWNpZCI6IjEzODIxMzI0MTcyNCIsImVlbnYiOiJqIiwiZXBpZCI6IjUzNDYxMDk0IiwiZXNpZCI6IjUzNDYwODU0In0&tv=js-2.2.16-c&tna=Mather&aid=v1&p=web&tz=UTC&lang=en-US&cs=UTF-8&res=1600x1200&cd=24&cookie=1&f_nolocalstorage=1&tid=fa07fa13-e3be-4137-aec3-38f671477434&pid=a8687a73-7722-4973-b451-4542168111c3&dtm=1520280272730&qnm=_snaq&vp=1x1&ds=1x1&vid=1&duid=3cc46bb633deb4bf&fp=1684409236&cid=ma23578&mrk=239876503&url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.5.12.45 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-5-12-45.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/ Frame (618 73 KB
27 KB 6ms
6ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/osd.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

c875abb472a9f41c06aaa1dec92ff397185f65b49a2ece9259263d64b4f77f3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Wed, 28 Feb 2018 15:21:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 448994
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 27467
x-xss-protection: 1; mode=block
server: cafe
etag: 11784303078778526260
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Mar 2018 15:21:18 GMT

GET
H/1.1 200
OK p.js Show response
d1z2jf7jlzjs58.cloudfront.net/ 6 KB
3 KB 29ms
9ms Script
application/x-javascript 216.137.61.227
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 216.137.61.227 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-216-137-61-227.fra2.r.cloudfront.net
Software: nginx /
Resource Hash: 725913eab3460e2955a8ac4ec176f902c7d8d2db60757248b735cbf8698b0749

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: public
Date: Fri, 08 Sep 2017 23:34:48 GMT
Content-Encoding: gzip
Last-Modified: Fri, 07 Mar 2014 00:45:07 GMT
Server: nginx
Age: 73268
ETag: W/"53191693-19c1"
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 9f37c8b999ae2d6018396fda48773445.cloudfront.net (CloudFront)
Cache-Control: max-age=86400, public
Connection: keep-alive
X-Amz-Cf-Id: UKufiJJNfB_wIFVDV5BOAVc4jV_aMmwrm137PCH67DtcZUm8_KkXKQ==
Expires: Sat, 09 Sep 2017 23:34:48 GMT

GET
H/1.1 200
OK script.js Show response
cdn.listrakbi.com/scripts/ 58 KB
19 KB 47ms
25ms Script
text/javascript 54.230.93.112
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.listrakbi.com/scripts/script.js?m=tUxHTINGb1zW&v=1
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 54.230.93.112 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-54-230-93-112.fra2.r.cloudfront.net
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 1bd07598a025bc051a20af4f9ebbbbf7cd6b48f9d4044cc00260289d21f08ecf

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 10 Jan 2018 06:02:19 GMT
Content-Encoding: gzip
X-AspNet-Version: 4.0.30319
Age: 34
X-Powered-By: ASP.NET
X-Cache: Hit from cloudfront
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND PHY ONL UNI COM NAV INT DEM CNT PRE LOC"
Connection: keep-alive
Content-Length: 18505
Last-Modified: Thu, 30 Nov 2017 23:06:48 GMT
Server: Microsoft-IIS/8.5
X-ltk: 1/10/2018 1:02:20 AM
ETag: "hfy70KdYfyRzEdKFJRrgSQ=="
Vary: Accept-encoding
Content-Type: text/javascript
Via: 1.1 bd785324d865b594e6f1838b58cb0dae.cloudfront.net (CloudFront)
Cache-Control: public, no-transform, max-age=3600, s-maxage=600, no-cache="set-cookie"
Accept-Ranges: bytes
X-Amz-Cf-Id: DH77QWsNAbHi0lFdVCx5xQsd6UmnDXABTlkyikcW4HPn8f657gM_lw==
Expires: Wed, 10 Jan 2018 07:02:20 GMT

GET
S 200 common-async.446a000901728756fac9.chunk.min.js Show response
assets.digitalfirstmedia.com/prod/static/js/ 44 KB
7 KB 6ms
5ms Script
application/javascript 151.101.113.53
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.digitalfirstmedia.com/prod/static/js/common-async.446a000901728756fac9.chunk.min.js
Requested by: Host: assets.digitalfirstmedia.com
URL: https://assets.digitalfirstmedia.com/prod/static/js/common.446a000901728756fac9.min.js?ver=1.0
Protocol: SPDY
Server: 151.101.113.53 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Apache /
Resource Hash: f989559987f22456d88cea6c4f9cdb00f6921a23de45b217fd98000a51045dbc

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
age: 87
x-cache: HIT, HIT
status: 200
content-length: 7296
x-served-by: cache-den6023-DEN, cache-hhn1542-HHN
last-modified: Mon, 26 Feb 2018 20:58:38 GMT
server: Apache
x-timer: S1520280273.832847,VS0,VE0
etag: "b060-56623c62cf51d"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
fastly-debug-digest: 0ff4252f6da51c74a21655765c78b4b7d77e741656dea901cd59c06d3a848f7d
accept-ranges: bytes
x-cache-hits: 2, 2

GET
S 200 denverpost-async.446a000901728756fac9.chunk.min.js Show response
assets.digitalfirstmedia.com/prod/static/js/ 4 KB
2 KB 10ms
10ms Script
application/javascript 151.101.113.53
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.digitalfirstmedia.com/prod/static/js/denverpost-async.446a000901728756fac9.chunk.min.js
Requested by: Host: assets.digitalfirstmedia.com
URL: https://assets.digitalfirstmedia.com/prod/static/js/common.446a000901728756fac9.min.js?ver=1.0
Protocol: SPDY
Server: 151.101.113.53 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Apache /
Resource Hash: 53fb71cd471c609fb8ac9e06dcf3f337b79d3c3eeb92666b5de1d16c72023b04

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
age: 1047
x-cache: HIT, HIT
status: 200
content-length: 1422
x-served-by: cache-den6023-DEN, cache-hhn1542-HHN
last-modified: Mon, 26 Feb 2018 20:58:38 GMT
server: Apache
x-timer: S1520280273.833630,VS0,VE4
etag: "ead-56623c62cf51d"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
fastly-debug-digest: a690fd613e150c1fef51838221a34dbf08db8188ebd319b9356ed7beb7005606
accept-ranges: bytes
x-cache-hits: 53, 1

GET
S 200 1f3b5.svg
s.w.org/images/core/emoji/2.4/svg/ 1 KB
936 B 31ms
5ms Image
image/svg+xml 192.0.77.48

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/2.4/svg/1f3b5.svg

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

192.0.77.48 San Francisco, United States, ASN (),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

eae1bcf059a36b33197a3211a7c97df71d65ed8c59623447cb80314d128f9991

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 48
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 24 Jan 2018 05:33:40 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
S 200 1f3b6.svg
s.w.org/images/core/emoji/2.4/svg/ 2 KB
997 B 30ms
6ms Image
image/svg+xml 192.0.77.48

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/2.4/svg/1f3b6.svg

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

192.0.77.48 San Francisco, United States, ASN (),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

8594a0441a676da2f70511fa1b19ffcf7643ec6fb3fb2bb37a9528ef64d89ff8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-nc: HIT fra 48
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 24 Jan 2018 05:33:21 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: max-age=315360000
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
S 200 / Show response
freegeoip.net/json/ 194 B
566 B 264ms
237ms XHR
application/json 104.25.149.25
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://freegeoip.net/json/
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js
Protocol: SPDY
Server: 104.25.149.25 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e2b48061f14ab4b9f7cef3f8f4de4da920c65cf1a9b59a7bde6f9c36c7ca0d24

Request headers

Accept: */*
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Origin: https://www.denverpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:33 GMT
content-encoding: gzip
server: cloudflare
status: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: application/json
access-control-allow-origin: https://www.denverpost.com
access-control-allow-credentials: true
x-database-date: Fri, 16 Feb 2018 08:41:25 GMT
cf-ray: 3f6f31399bbe96a0-FRA

GET
S 200 pubads_impl_183.js Show response
securepubads.g.doubleclick.net/gpt/ Frame (2D2 177 KB
63 KB 40ms
39ms Script
text/javascript 172.217.23.162

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_183.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

SPDY

Server

172.217.23.162 Mountain View, United States, ASN (),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

sffe /

Resource Hash

8fb45fa7cbce9e96b885cd517f799ab1f68b2e37ca11c5cfcc234849c0d5961a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 26 Feb 2018 14:12:02 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 63868
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 integrator.sync.js Show response
adservice.google.de/adsid/ Frame (2D2 112 B
181 B 15ms
15ms Script
application/javascript 172.217.22.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.sync.js?domain=www.denverpost.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

SPDY

Server

172.217.22.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

57b4db8e04f917ceebdda97a6edcc37ccaa415f5a948cf522d7f58457c1128b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 111
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK sp_sXPv48AD Show response
www.spot.im/api/init/spot/ 2 KB
3 KB 401ms
400ms XHR
application/json 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.spot.im/api/init/spot/sp_sXPv48AD
Requested by: Host: www.spot.im
URL: https://www.spot.im/launcher/bundle.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: bd359961893d4b15ab12208619238cb7049df9932f9c3a64318f3fb1b8211620

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Origin: https://www.denverpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 05 Mar 2018 20:04:33 GMT
Last-Modified: Mon, 05 Mar 2018 20:04:33 GMT
ETag: 1520280273
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, HEAD, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: x-spotim-bid, x-spotim-rid, x-spotim-token, x-spotim-networkid, x-spotim-spotid, x-spotim-vid
Cache-Control: public, max-age=60, no-transform
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: x-spotim-bid, x-spotim-rid, x-spotim-token, x-spotim-networkid, x-spotim-spotid, x-spotim-vid, Content-Type
Content-Length: 2140
X-HW: 1520280272.dop009.fr8.t,1520280272.cds008.fr8.shn,1520280272.dop009.fr8.t,1520280273.cds013.fr8.e

GET
H/1.1 200
OK bundle.js Show response
app-cdn.spot.im/modules/essential/3.1.426/ 369 KB
110 KB 42ms
8ms Script
application/javascript 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://app-cdn.spot.im/modules/essential/3.1.426/bundle.js
Requested by: Host: www.spot.im
URL: https://www.spot.im/launcher/bundle.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: f8cfbc9e5f7ee24d999fcb6402b0ca7fec7977a0fe629ee2c6d189d57e657edb

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Mar 2018 13:59:49 GMT
ETag: 1520171989
X-HW: 1520280272.dop009.fr8.t,1520280272.cds022.fr8.shn,1520280272.dop009.fr8.t,1520280272.cds018.fr8.c
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=31427777
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 111758

GET
H/1.1 200
OK host-bundle.js Show response
app-cdn.spot.im/modules/prerender/3.1.426/conversation/host/ 353 KB
101 KB 41ms
9ms Script
application/javascript 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://app-cdn.spot.im/modules/prerender/3.1.426/conversation/host/host-bundle.js
Requested by: Host: www.spot.im
URL: https://www.spot.im/launcher/bundle.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 953cb1f9b05c01dd9777e4823dcd66730cac5298f574ad907308791a96255b9c

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Mar 2018 13:59:58 GMT
ETag: 1520171998
X-HW: 1520280272.dop009.fr8.t,1520280272.cds003.fr8.shn,1520280272.dop009.fr8.t,1520280272.cds033.fr8.c
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=31427777
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 102706

GET
H/1.1 200
OK t
track.spots.im/ 2 B
473 B 3310ms
108ms Image
application/json 52.5.76.191

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.spots.im/t?m=eyJ1aWQiOiJkMWVhYzdjZTNiOGEwNGNjNzdhNjA4NWIyY2VjNzY3MiIsInRpbWVfZGVsdGEiOjE4ODQsInZpc2l0X2lkIjoiMWIwMzJhMjY2NTk3ZWI1YTUxNzZkZGVkM2MxMzg3MDciLCJpYl9icm93c2VyX2lkIjoiZDI3OWE3Nzg1OTNjOTUwMjY1MWI3YTgwY2NiYjgzOWQiLCJzb3VyY2UiOiJsYXVuY2hlciIsInNvdXJjZV92ZXJzaW9uIjoiMy4xLjQyNiIsInR5cGUiOiJsb2FkZWQiLCJkb21haW4iOiJ3d3cuZGVudmVycG9zdC5jb20iLCJ1cmwiOiJodHRwczovL3d3dy5kZW52ZXJwb3N0LmNvbS8yMDE4LzAyLzI2L3NhbXNhbS1yYW5zb213YXJlLXZpcnVzLWNkb3QvIiwicmVmZXJyZXIiOiIiLCJsYW5nIjoiZW4tVVMiLCJzcG90X2lkIjoic3Bfc1hQdjQ4QUQifQ%3D%3D&rnd=0.6306029090581167
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.5.76.191 Ashburn, United States, ASN (),
Reverse DNS: ec2-52-5-76-191.compute-1.amazonaws.com
Software: iris /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:35 GMT
Server: iris
Access-Control-Max-Age: 3600
Access-Control-Allow-Methods: GET, OPTIONS
Content-Type: application/json;charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: content-type, x-ironsource-atom-sdk-type, x-ironsource-atom-sdk-version
Content-Length: 2

GET
S 200 t Show response
jadserve.postrelease.com/ 1 KB
1 KB 397ms
182ms Script
text/javascript 52.7.208.137

General

Check archive.org

Show headers Download Go to

Full URL: https://jadserve.postrelease.com/t?ntv_url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F
Requested by: Host: s.ntv.io
URL: https://s.ntv.io/serve/load.js
Protocol: SPDY
Server: 52.7.208.137 Ashburn, United States, ASN (),
Reverse DNS: ec2-52-7-208-137.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: 77d110c320f166ae8e2ab66a60edf193290b9b6bd778ef118ea088b508ff4214

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Mar 2018 20:04:33 GMT
content-encoding: gzip
server: nginx/1.12.1
status: 200
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: text/javascript;charset=UTF-8
content-length: 697
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
S 200 g.gif
pixel.wp.com/ 50 B
130 B 7ms
5ms Image
image/gif 192.0.76.3
Automattic

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A5.8&blog=111738712&post=2965047&tz=-7&srv=www.denverpost.com&host=www.denverpost.com&ref=&rand=0.27498075231415453
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC - Automattic, Inc, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

status: 200
date: Mon, 05 Mar 2018 20:04:32 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H/1.1 200
OK sp_sXPv48AD Show response
www.spot.im/api/tracker/spot/ 0
828 B 392ms
391ms XHR
application/javascript 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.spot.im/api/tracker/spot/sp_sXPv48AD

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

HTTP/1.1

Server

209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),

Reverse DNS

vip0x03f.map2.ssl.hwcdn.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Origin: https://www.denverpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type: application/json

Response headers

Date: Mon, 05 Mar 2018 20:04:33 GMT
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, HEAD, OPTIONS
Content-Type: application/javascript
Access-Control-Allow-Origin: https://www.denverpost.com
Access-Control-Expose-Headers: x-spotim-bid, x-spotim-rid, x-spotim-token, x-spotim-networkid, x-spotim-spotid, x-spotim-vid
Access-Control-Allow-Credentials: true
x-spotim-bid
Access-Control-Max-Age: 86400
Connection: Keep-Alive
x-spotim-rid
Access-Control-Allow-Headers: x-spotim-bid, x-spotim-rid, x-spotim-token, x-spotim-networkid, x-spotim-spotid, x-spotim-vid, Content-Type
X-HW: 1520280271.dop004.fr8.t,1520280271.cds034.fr8.shn,1520280272.dop004.fr8.t,1520280272.cds023.fr8.sc,1520280273.cds023.fr8.p
x-spotim-vid

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ Frame (76E 43 B
338 B 110ms
109ms Image
image/gif 52.5.12.45
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiMzc5MjIyNjk0IiwiZWJ1eSI6IjM1MjU2MjQxNCIsImVhZHYiOiIzNTYyOTkzNCIsImVjaWQiOiI3ODkxMTA4NDY1NCIsImVlbnYiOiJqIiwiZXBpZCI6IjUzNDYxMDk0IiwiZXNpZCI6IjUzNDYwODU0In0&tv=js-2.2.16-c&tna=Mather&aid=v1&p=web&tz=UTC&lang=en-US&cs=UTF-8&res=1600x1200&cd=24&cookie=1&f_nolocalstorage=1&tid=d679f9ce-fd6b-4f0b-8e98-8bea5f3cd6e6&pid=a8687a73-7722-4973-b451-4542168111c3&dtm=1520280272952&qnm=_snaq&vp=300x250&ds=300x254&vid=1&duid=3cc46bb633deb4bf&fp=1684409236&cid=ma23578&mrk=239876503&url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.5.12.45 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-5-12-45.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:33 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ Frame (C73 43 B
338 B 213ms
109ms Image
image/gif 52.5.12.45
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiMzc5MjIyNTc0IiwiZWJ1eSI6IjM1MjU2MjQxNCIsImVhZHYiOiIzNTYyOTkzNCIsImVjaWQiOiI3ODkxMTA3NzkzNCIsImVlbnYiOiJqIiwiZXBpZCI6IjUzNDYxMDk0IiwiZXNpZCI6IjUzNDYwODU0In0&tv=js-2.2.16-c&tna=Mather&aid=v1&p=web&tz=UTC&lang=en-US&cs=UTF-8&res=1600x1200&cd=24&cookie=1&f_nolocalstorage=1&tid=8c06d2c1-cd41-4cf8-b8dc-bc4faf403162&pid=a8687a73-7722-4973-b451-4542168111c3&dtm=1520280272967&qnm=_snaq&vp=300x250&ds=300x254&vid=1&duid=3cc46bb633deb4bf&fp=1684409236&cid=ma23578&mrk=239876503&url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.5.12.45 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-5-12-45.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:33 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ Frame (74A 43 B
338 B 310ms
110ms Image
image/gif 52.5.12.45
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiMzc5MjIzMDU0IiwiZWJ1eSI6IjM1MjU2MjQxNCIsImVhZHYiOiIzNTYyOTkzNCIsImVjaWQiOiI3ODkxMTA3NjM3NCIsImVlbnYiOiJqIiwiZXBpZCI6IjUzNDYxMDk0IiwiZXNpZCI6IjUzNDYwODU0In0&tv=js-2.2.16-c&tna=Mather&aid=v1&p=web&tz=UTC&lang=en-US&cs=UTF-8&res=1600x1200&cd=24&cookie=1&f_nolocalstorage=1&tid=2b0b4519-8e6a-44bf-9411-414a4127e74d&pid=a8687a73-7722-4973-b451-4542168111c3&dtm=1520280272981&qnm=_snaq&vp=728x90&ds=728x94&vid=1&duid=3cc46bb633deb4bf&fp=1684409236&cid=ma23578&mrk=239876503&url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.5.12.45 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-5-12-45.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:33 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ Frame (70B 43 B
338 B 234ms
107ms Image
image/gif 52.5.12.45
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiMzc5MjIyNDU0IiwiZWJ1eSI6IjM1MjU2MjQxNCIsImVhZHYiOiIzNTYyOTkzNCIsImVjaWQiOiI3ODkxMTA2Mzg5NCIsImVlbnYiOiJqIiwiZXBpZCI6IjUzNDYxMDk0IiwiZXNpZCI6IjUzNDYwODU0In0&tv=js-2.2.16-c&tna=Mather&aid=v1&p=web&tz=UTC&lang=en-US&cs=UTF-8&res=1600x1200&cd=24&cookie=1&f_nolocalstorage=1&tid=4ca245ca-6497-49c8-b6b5-bfcab4318c39&pid=a8687a73-7722-4973-b451-4542168111c3&dtm=1520280272986&qnm=_snaq&vp=300x250&ds=300x254&vid=1&duid=3cc46bb633deb4bf&fp=1684409236&cid=ma23578&mrk=239876503&url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.5.12.45 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-5-12-45.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:33 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK getids Show response
c.newsinc.com/ 140 B
687 B 445ms
108ms Script
application/javascript 34.239.50.116

General

Check archive.org

Show headers Download Go to

Full URL: https://c.newsinc.com/getids?uid=&callback=jQuery19104972401522553487_1520280272803&_=1520280272804
Requested by: Host: launch.newsinc.com
URL: https://launch.newsinc.com/243/js/embed.js?ver=4.9.4
Protocol: HTTP/1.1
Server: 34.239.50.116 Ashburn, United States, ASN (),
Reverse DNS: ec2-34-239-50-116.compute-1.amazonaws.com
Software: nginx /
Resource Hash: daeb0d0d8a07b94afc37fbcda2fa218ce20eeec575dfb1b3a8859017a3aeec5e

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:10:40 GMT
Server: nginx
ETag: 47101b90-20b1-11e8-8a19-024c3e8e3b03
Access-Control-Allow-Methods: GET, POST
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Alternate-Protocol: 443:ndn-spdy/3
Cache-Control: private, max-age=0, no-cache, must-revalidate
Connection: keep-alive
Content-Length: 140
Expires: Thu, 01 Dec 1970 00:00:00 GMT

GET
H/1.1 200
OK getIds Show response
s1.listrakbi.com/tUxHTINGb1zW/session/ 155 B
962 B 428ms
107ms Script
application/x-javascript 52.3.86.250

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.listrakbi.com/tUxHTINGb1zW/session/getIds?callback=ltkCallback5592&gsid=&_sid=&_tid=
Requested by: Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=tUxHTINGb1zW&v=1
Protocol: HTTP/1.1
Server: 52.3.86.250 Ashburn, United States, ASN (),
Reverse DNS: ec2-52-3-86-250.compute-1.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 81063cc513fedda9f3ab6efa9de827e22909f2cc59dacb2177348b19603cb381

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:33 GMT
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND PHY ONL UNI COM NAV INT DEM CNT PRE LOC"
Cache-Control: no-cache, no-cache="set-cookie"
Connection: keep-alive
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 155
Expires: -1

GET
H/1.1 200
OK tUxHTINGb1zW.js Show response
onescript-recscont.listrakbi.com/ 2 KB
2 KB 465ms
116ms Script
text/javascript 52.5.130.242

General

Check archive.org

Show headers Download Go to

Full URL: https://onescript-recscont.listrakbi.com/tUxHTINGb1zW.js
Requested by: Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=tUxHTINGb1zW&v=1
Protocol: HTTP/1.1
Server: 52.5.130.242 Ashburn, United States, ASN (),
Reverse DNS: ec2-52-5-130-242.compute-1.amazonaws.com
Software: nginx/1.11.3 / ASP.NET
Resource Hash: 6a52dd58d7afae1b6bb657cbe920e39e8bad4b789b9f7a726bb499ffa34c966b

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:33 GMT
Server: nginx/1.11.3
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=300
Connection: keep-alive
Content-Length: 2040

GET
H/1.1 200
OK tUxHTINGb1zW Show response
at1.listrakbi.com/activity/ 111 B
703 B 424ms
105ms Script
text/javascript 52.6.36.75
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://at1.listrakbi.com/activity/tUxHTINGb1zW
Requested by: Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=tUxHTINGb1zW&v=1
Protocol: HTTP/1.1
Server: 52.6.36.75 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-6-36-75.compute-1.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: bc9ff628bc157259ffe80521c6748edbb30b7fc2abaa40d6c8f3c7983f6d03e1

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:32 GMT
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: text/javascript; charset=utf-8
Cache-Control: private, no-cache="set-cookie"
Connection: keep-alive
Content-Length: 111

GET
H/1.1 200
OK acj Show response
digitalfirst-d.openx.net/w/1.0/ 436 B
854 B 18ms
18ms XHR
application/json 173.241.240.220
OPENX TECHNOLOGIES

General

Check archive.org

Show headers Download Go to

Full URL: https://digitalfirst-d.openx.net/w/1.0/acj?ai=887bcac2-a450-4098-81c6-5a27d20e11c5&ju=https%3A//www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/&jr=&nl=57&ul=61%252C91%252C90%252C88%252C82&be=1&prf=0&auid=538544332&aus=300x250&bc=hb_2&bt=2000&dims=1600x1200&adxy=1120%2C2350&c.pos=Cube3_RRail_lower&res=1600x1200x24&plg=pm&ch=UTF-8&tz=0&ws=1600x1200&ifr=0&tws=1600x1200&vmt=1&sd=1
Requested by: Host: digitalfirst-d.openx.net
URL: https://digitalfirst-d.openx.net/w/1.0/jstag?nc=8013-denverpost
Protocol: HTTP/1.1
Server: 173.241.240.220 New York, United States, ASN36089 (OPENX-AS1 - OPENX TECHNOLOGIES, INC., US),
Reverse DNS: ox-173-241-240-220.xa.dc.openx.org
Software: OXGW/13.4.1 /
Resource Hash: 8dad82bedbd4c26f75940481e5d3c8ffd1c086e45dd59b227168e96b51d0e5cc

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Origin: https://www.denverpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:33 GMT
Content-Encoding: gzip
Server: OXGW/13.4.1
Vary: Accept
P3P: CP="CUR ADM OUR NOR STA NID"
Access-Control-Allow-Origin: https://www.denverpost.com
Cache-Control: private, max-age=0, no-cache
Access-Control-Allow-Credentials: true
Content-Type: application/json
Transfer-Encoding: chunked
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK esf.js Show response
d2lv4zbk7v5f93.cloudfront.net/ 223 KB
42 KB 28ms
8ms Script
application/javascript 216.137.61.62
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d2lv4zbk7v5f93.cloudfront.net/esf.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Protocol: HTTP/1.1
Server: 216.137.61.62 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-216-137-61-62.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 323075a1922843a6c7f5371bc7fa55500b77944f1268d83461964e3906942141

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 06 Feb 2018 14:41:37 GMT
Content-Encoding: gzip
Last-Modified: Tue, 06 Feb 2018 14:39:56 GMT
Server: AmazonS3
Age: 19355
ETag: "e817b0f323fb2559fcb2e5701865527a"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 ea71ce4ac4724c3ed76f4816ddddaa6c.cloudfront.net (CloudFront)
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 42771
X-Amz-Cf-Id: uCVa0I4HVCeFyqkG4EE2qJvCwEIpKstctTv44ae7HBDhPgkw24TvnQ==

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/ Frame (2CF 178 KB
0 52ms
51ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

0517c66a6ea7f6838297f943858762cc1e6aee028daca5f09ab3a51ba874ed7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 12438865884920658202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 67842
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/ Frame (2CF 73 KB
0 6ms
6ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/osd.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

c875abb472a9f41c06aaa1dec92ff397185f65b49a2ece9259263d64b4f77f3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Wed, 28 Feb 2018 15:21:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 448994
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 27467
x-xss-protection: 1; mode=block
server: cafe
etag: 11784303078778526260
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Mar 2018 15:21:18 GMT

GET
S 200 get Show response
odb.outbrain.com/utils/ 32 KB
12 KB 172ms
143ms Script
text/x-json 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://odb.outbrain.com/utils/get?url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&srcUrl=https%3A%2F%2Fwww.denverpost.com%2Ffeed%2F&settings=true&recs=true&widgetJSId=AR_1&key=NANOWDGT01&idx=0&version=01002300&ref=&apv=false&sig=9ST5ofwd&format=html&rand=17632&winW=1600&winH=1200&adblck=false&secured=true

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js

Protocol

SPDY

Server

151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

Resource Hash

a04a6a31c8b13c7820942e036b00df1c4d59ef54f7892f5a0427c80ee78e8729

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:33 GMT
content-encoding: gzip
traffic-path: NYDC1, JFK, HHN, Europe1
x-cache: MISS, MISS
p3p: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status: 200
x-cache-hits: 0, 0
strict-transport-security: max-age=0; includeSubDomains;
x-served-by: cache-jfk8142-JFK, cache-hhn1546-HHN
pragma: no-cache
x-timer: S1520280274.696049,VS0,VE138
vary: Accept-Encoding, User-Agent
content-type: text/x-json; charset=UTF-8
via: 1.1 varnish, 1.1 varnish
cache-control: no-cache
backend-ip: 104.156.90.42
accept-ranges: bytes, bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK denverpost.com Show response
srv-2018-03-05-20.config.parsely.com/config/ 386 B
804 B 427ms
105ms Script
text/javascript 54.164.16.198

General

Check archive.org

Show headers Download Go to

Full URL: https://srv-2018-03-05-20.config.parsely.com/config/denverpost.com
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Protocol: HTTP/1.1
Server: 54.164.16.198 Ashburn, United States, ASN (),
Reverse DNS: ec2-54-164-16-198.compute-1.amazonaws.com
Software: / Express
Resource Hash: 5b58353c6803afc16620ea7acab92824f084e8a93e2dffb18a53c10dcb89ca30

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Cache-Control: private, no-cache
ETag: W/"182-C3RIfKcjBQR5jkQw3njW9w"
Connection: keep-alive
X-Powered-By: Express
Content-Length: 386
Content-Type: text/javascript; charset=utf-8

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/ Frame (A1D 178 KB
0 52ms
51ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

0517c66a6ea7f6838297f943858762cc1e6aee028daca5f09ab3a51ba874ed7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 12438865884920658202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 67842
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/ Frame (A1D 73 KB
0 6ms
6ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/osd.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

c875abb472a9f41c06aaa1dec92ff397185f65b49a2ece9259263d64b4f77f3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Wed, 28 Feb 2018 15:21:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 448994
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 27467
x-xss-protection: 1; mode=block
server: cafe
etag: 11784303078778526260
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Mar 2018 15:21:18 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ Frame (49F 43 B
338 B 108ms
108ms Image
image/gif 52.5.12.45
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiMzc5MjIzMTc0IiwiZWJ1eSI6IjM1MjU2MjQxNCIsImVhZHYiOiIzNTYyOTkzNCIsImVjaWQiOiI3ODkxMTA5OTI5NCIsImVlbnYiOiJqIiwiZXBpZCI6IjUzNDYxMDk0IiwiZXNpZCI6IjUzNDYwODU0In0&tv=js-2.2.16-c&tna=Mather&aid=v1&p=web&tz=UTC&lang=en-US&cs=UTF-8&res=1600x1200&cd=24&cookie=1&f_nolocalstorage=1&tid=0a33687e-3422-4dca-8302-c230e79afd1e&pid=a8687a73-7722-4973-b451-4542168111c3&dtm=1520280273188&qnm=_snaq&vp=728x90&ds=728x90&vid=1&duid=3cc46bb633deb4bf&fp=1684409236&cid=ma23578&mrk=239876503&url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.5.12.45 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-5-12-45.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:33 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/ Frame (6C1 178 KB
0 52ms
51ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

0517c66a6ea7f6838297f943858762cc1e6aee028daca5f09ab3a51ba874ed7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 12438865884920658202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 67842
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/ Frame (6C1 73 KB
0 6ms
6ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/osd.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

c875abb472a9f41c06aaa1dec92ff397185f65b49a2ece9259263d64b4f77f3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Wed, 28 Feb 2018 15:21:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 448994
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 27467
x-xss-protection: 1; mode=block
server: cafe
etag: 11784303078778526260
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Mar 2018 15:21:18 GMT

GET
S 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame (2D2 10 KB
4 KB 135ms
135ms XHR
text/javascript 172.217.23.162

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=40879236694030&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fifs&adsid=NT&json_a=1&eid=21061214%2C108809132%2C21061149&sc=1&sfv=1-0-16&iu_parts=39694909%2CTest%2CDenverpost_HBSM&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&prev_scp=spotId%3Dsp_sXPv48AD&eri=4&cookie=ID%3D0a31ac0eff60bffb%3AT%3D1520280271%3AS%3DALNI_MbmN9tDllpUUAX8yjZ3TJ2Y-yJg8A&cdm=www.denverpost.com&lmt=1520280273&dt=1520280273258&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=251&oid=3&adxs=334&adys=2322&adks=1715189677&gut=v2&sps=url,,www.denverpost.com&ifi=1&ifk=1000036877&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&iag=3&url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&top=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&dssz=8&icsg=40&std=0&csl=86&vrg=183&vis=1&dmc=8&scr_x=0&scr_y=0&ga_vid=1585394644.1520280272&ga_sid=1520280273&ga_hid=187646839

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_183.js

Protocol

SPDY

Server

172.217.23.162 Mountain View, United States, ASN (),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

4837d45d900563b337ae12af4698866274b7ac82098754cebc591be8835d2e6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Origin: https://www.denverpost.com

Response headers

date: Mon, 05 Mar 2018 20:04:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 4219
x-xss-protection: 1; mode=block
google-lineitem-id: 4582901689
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138221594668
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.denverpost.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 pubads_impl_rendering_183.js Show response
securepubads.g.doubleclick.net/gpt/ Frame (2D2 40 KB
14 KB 40ms
40ms Script
text/javascript 172.217.23.162

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_183.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_183.js

Protocol

SPDY

Server

172.217.23.162 Mountain View, United States, ASN (),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

sffe /

Resource Hash

083d35e9cedf55e27713ed31f05f0a0a3c6e10b57a58863d7db7308983d529d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 26 Feb 2018 14:12:02 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 14214
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:33 GMT

GET
S 200 container.html
tpc.googlesyndication.com/safeframe/1-0-16/html/ Frame (2D2 0
0 6ms
6ms Other
text/html 172.217.23.161
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-16/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_183.js

Protocol

SPDY

Server

172.217.23.161 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f1.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Purpose: prefetch
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Thu, 22 Feb 2018 22:36:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 941292
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 1453
x-xss-protection: 1; mode=block
last-modified: Wed, 21 Feb 2018 21:58:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/html
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Feb 2019 22:36:21 GMT

GET
S 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/ Frame (1D4 178 KB
0 52ms
51ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

0517c66a6ea7f6838297f943858762cc1e6aee028daca5f09ab3a51ba874ed7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Mon, 05 Mar 2018 20:04:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
etag: 12438865884920658202
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: private, max-age=1209600
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 67842
x-xss-protection: 1; mode=block
expires: Mon, 05 Mar 2018 20:04:32 GMT

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/ Frame (1D4 73 KB
0 6ms
6ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/osd.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20180228/r20170110/show_ads_impl.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

c875abb472a9f41c06aaa1dec92ff397185f65b49a2ece9259263d64b4f77f3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Wed, 28 Feb 2018 15:21:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 448994
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 27467
x-xss-protection: 1; mode=block
server: cafe
etag: 11784303078778526260
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Mar 2018 15:21:18 GMT

GET
S 200 m_window_focus_non_hydra.js Show response
tpc.googlesyndication.com/pagead/js/r20180228/r20110914/client/ext/ Frame (557 3 KB
1 KB 6ms
6ms Script
text/javascript 172.217.23.161
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180228/r20110914/client/ext/m_window_focus_non_hydra.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_183.js

Protocol

SPDY

Server

172.217.23.161 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f1.1e100.net

Software

cafe /

Resource Hash

f17c52d128492e3041982fb68e8aef913b60dacdffae62cb260af2a67eaec603

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Wed, 28 Feb 2018 14:01:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 453783
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 1203
x-xss-protection: 1; mode=block
server: cafe
etag: 2112876643077467119
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Mar 2018 14:01:30 GMT

GET
S 200 osd_listener.js Show response
tpc.googlesyndication.com/pagead/js/r20180228/r20110914/activeview/ Frame (557 71 KB
0 6ms
6ms Script
text/javascript 172.217.23.161
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20180228/r20110914/activeview/osd_listener.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_183.js

Protocol

SPDY

Server

172.217.23.161 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f1.1e100.net

Software

cafe /

Resource Hash

95a2b3352f45ad7a28052ba8a142b8694e52cef35865312161bcd9cc73bbeccf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Response headers

date: Wed, 28 Feb 2018 14:01:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 453782
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 26517
x-xss-protection: 1; mode=block
server: cafe
etag: 9587303592933190018
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Mar 2018 14:01:30 GMT

GET
S 200 osd.js Show response
pagead2.googlesyndication.com/pagead/ Frame (2D2 73 KB
27 KB 7ms
7ms Script
text/javascript 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_183.js

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

c875abb472a9f41c06aaa1dec92ff397185f65b49a2ece9259263d64b4f77f3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 19:18:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2745
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 27467
x-xss-protection: 1; mode=block
server: cafe
etag: 11784303078778526260
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Mon, 05 Mar 2018 20:18:48 GMT

GET
S 200 view
securepubads.g.doubleclick.net/pcs/ Frame (557 0
47 B 22ms
20ms Image
text/html 172.217.23.162

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv9oc6GQWXyQw-Av_Bv9ywhcPWvX1SiMJqySYumkuhUNL32t531JbmhfN7nPlKXyL01TOSN0mwlVsP9IpZVEjqarsiJD0LSbSapAAB2e64eCJM1aeClP7aigSPcF3iD3y5pKEhrZOtef-BzpoZM1xjQiXUFLEcQKRPvcsVTOi-abQskABFW66U9KNzxSTjMZgEbLoCj0rsODL1KoKPfo4epvfnYE86QZ9d8X1l-2xz3V06mKHMY8qLi1rS7m3rs7gzmyT-baQ&sig=Cg0ArKJSzEg5u_uEYdWFEAE&adurl=

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.162 Mountain View, United States, ASN (),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 05 Mar 2018 20:04:33 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: private
content-type: text/html; charset=UTF-8
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 0
x-xss-protection: 1; mode=block

GET
S 200 17183934108870360521
tpc.googlesyndication.com/simgad/ Frame (557 18 KB
18 KB 21ms
20ms Image
image/jpeg 172.217.23.161
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17183934108870360521

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.161 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f1.1e100.net

Software

sffe /

Resource Hash

9564266456b02754747f006be329e9ace42197e094f887bcb2f9211ac411b586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Thu, 15 Feb 2018 17:15:23 GMT
x-content-type-options: nosniff
age: 1565350
x-dns-prefetch-control: off
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 18499
x-xss-protection: 1; mode=block
last-modified: Tue, 02 Jan 2018 13:18:54 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Feb 2019 17:15:23 GMT

GET
S 204 l
www.google.com/ads/measurement/ Frame (557 0
71 B 14ms
14ms Image
text/html 172.217.22.4
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/measurement/l?ebcid=ALh7CaTbYtKCxTLGlxeaVmtiGzpj0cBgU5vcGF4xIXTDDaELsaxlzGz8KIR2iBlVgQdTbcrEPbLTbrY9mX3EIpWU6fc-d9_KbQ

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.22.4 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s14-in-f4.1e100.net

Software

jumble_frontend_server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:33 GMT
x-content-type-options: nosniff
server: jumble_frontend_server
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
status: 204
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 0
x-xss-protection: 1; mode=block

GET
S 200 connatix.renderer.infeed.min.js Show response
cdn.connatix.com/min/ 2 KB
1 KB 806ms
17ms Script
application/x-javascript 94.31.29.250
netDNA

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js?_=1520280272936
Requested by: Host: s.ntv.io
URL: https://s.ntv.io/serve/load.js
Protocol: SPDY
Server: 94.31.29.250 , United Kingdom, ASN54104 (AS-STACKPATH - netDNA, US),
Reverse DNS: 94.31.29.250.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: a83fa7f104f5d300666fa6a3dc0934f009347baa77b9c0caaf7b34bb58f66954

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:34 GMT
content-encoding: gzip
last-modified: Mon, 05 Mar 2018 17:26:10 GMT
server: NetDNA-cache/2.2
x-amz-request-id: D38F64087D5A867F
etag: W/"bf3516d77f8664f0483ebf922291ae5d"
x-cache: HIT
content-type: application/x-javascript
status: 200
access-control-allow-origin: *
x-amz-id-2: oVSKE3xxp9kaYh9207l3aSF63Wk55VDbPHnOQMGQd2wVUt9ZtKd+rT7t/xXrF9mHB8byNBu12jE=

GET
S 200 trk.gif
jadserve.postrelease.com/ 43 B
339 B 155ms
153ms Image
image/gif 52.7.208.137

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/trk.gif?ntv_ui=d85fd559-34a8-43ff-a26e-e77c2ccffa5d&ntv_fl=1lUNxEyU26ZpCg2fWsVg8A==&ntv_ht=0aKdWgA&ntv_at=303,302&ntv_a=AAAAAAAAAAp7IPA&ord=1520280273485&ntv_dpl=1008,1009,1011,1014,1016,1001,1003,1021,1006,1007
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 52.7.208.137 Ashburn, United States, ASN (),
Reverse DNS: ec2-52-7-208-137.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Mar 2018 20:04:33 GMT
server: nginx/1.12.1
status: 200
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: image/gif
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
S 200 trk.gif
jadserve.postrelease.com/ 43 B
339 B 109ms
107ms Image
image/gif 52.7.208.137

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/trk.gif?ntv_ui=d85fd559-34a8-43ff-a26e-e77c2ccffa5d&ntv_fl=1lUNxEyU26ZpCg2fWsVg8A==&ntv_ht=0aKdWgA&ntv_at=806&ntv_a=AAAAAAAAAAp7IPA&ntv_sat=15&ord=1520280273490
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 52.7.208.137 Ashburn, United States, ASN (),
Reverse DNS: ec2-52-7-208-137.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Mar 2018 20:04:33 GMT
server: nginx/1.12.1
status: 200
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: image/gif
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H/1.1 200
OK ad Show response
a.teads.tv/page/50428/ 98 B
474 B 31ms
31ms XHR
application/json 54.77.82.250

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/page/50428/ad?windowWidth=1600&windowHeight=1200&windowDepth=1&windowReferrerUrl=&page=%7B%22id%22%3A50428%2C%22placements%22%3A%5B%7B%22id%22%3A55543%2C%22validity%22%3A%7B%22status%22%3Atrue%2C%22reasons%22%3A%5B%5D%7D%2C%22player%22%3A%7B%22width%22%3A614%2C%22height%22%3A345%7D%2C%22slotType%22%3A%22native%22%7D%5D%7D&userId=038540c5-f6a3-4467-adb2-d0d11778aa81&auctid=c920d0dd-f34c-4081-b364-2161f7c402c0&formatVersion=2.18.1&env=js-web
Requested by: Host: cdn.teads.tv
URL: https://cdn.teads.tv/media/format/v3/teads-format.min.js
Protocol: HTTP/1.1
Server: 54.77.82.250 Dublin, Ireland, ASN (),
Reverse DNS: ec2-54-77-82-250.eu-west-1.compute.amazonaws.com
Software: teads-ssp /
Resource Hash: 2465f67342841d5db9f96c3ec1d4428c00e6d62c10424d6f9262403d599e9e92

Request headers

Accept: application/json; charset=UTF-8
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Origin: https://www.denverpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:33 GMT
Content-Encoding: gzip
Server: teads-ssp
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://www.denverpost.com
Cache-Control: no-cache, must-revalidate, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 104
Expires: 0

GET
H/1.1 200
OK ad Show response
a.teads.tv/page/50428/ 98 B
474 B 51ms
40ms XHR
application/json 54.77.82.250

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/page/50428/ad?windowWidth=1600&windowHeight=1200&windowDepth=1&windowReferrerUrl=&page=%7B%22id%22%3A50428%2C%22placements%22%3A%5B%7B%22id%22%3A87639%2C%22validity%22%3A%7B%22status%22%3Atrue%2C%22reasons%22%3A%5B%5D%7D%2C%22player%22%3A%7B%22width%22%3A640%2C%22height%22%3A360%7D%2C%22slotType%22%3A%22corner%22%7D%5D%7D&userId=038540c5-f6a3-4467-adb2-d0d11778aa81&auctid=72825fba-6698-414f-aff2-e161f7c402e1&formatVersion=2.18.1&env=js-web
Requested by: Host: cdn.teads.tv
URL: https://cdn.teads.tv/media/format/v3/teads-format.min.js
Protocol: HTTP/1.1
Server: 54.77.82.250 Dublin, Ireland, ASN (),
Reverse DNS: ec2-54-77-82-250.eu-west-1.compute.amazonaws.com
Software: teads-ssp /
Resource Hash: 2465f67342841d5db9f96c3ec1d4428c00e6d62c10424d6f9262403d599e9e92

Request headers

Accept: application/json; charset=UTF-8
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Origin: https://www.denverpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:33 GMT
Content-Encoding: gzip
Server: teads-ssp
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://www.denverpost.com
Cache-Control: no-cache, must-revalidate, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 104
Expires: 0

GET
H/1.1 200
OK p
sb.scorecardresearch.com/ 43 B
309 B 6ms
6ms Image
image/gif 2.19.43.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=17198971&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1520280273602&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va00&ns_st_cl=0&ns_st_pt=0&c3=*null&c4=*null&c6=*null&ns_ts=24602614
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.19.43.224 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:33 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK track
t.teads.tv/ 23 B
193 B 116ms
27ms Image
image/gif 52.48.203.249

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.teads.tv/track?action=placementCall&pageId=50428&pid=55543&gid=&slot=native&env=js-web&ts=1520280273601&auctid=c920d0dd-f34c-4081-b364-2161f7c402c0
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.48.203.249 Dublin, Ireland, ASN (),
Reverse DNS: ec2-52-48-203-249.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 23
content-type: image/gif

GET
H/1.1 200
OK track
t.teads.tv/ 23 B
193 B 105ms
26ms Image
image/gif 54.154.35.241
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.teads.tv/track?action=slotAvailable&pageId=50428&pid=55543&gid=&slot=native&env=js-web&ts=1520280273601&auctid=c920d0dd-f34c-4081-b364-2161f7c402c0
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 54.154.35.241 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-154-35-241.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 23
content-type: image/gif

GET
H/1.1 200
OK p
sb.scorecardresearch.com/ 43 B
309 B 14ms
14ms Image
image/gif 2.19.43.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=17198971&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1520280273633&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va00&ns_st_cl=0&ns_st_pt=0&c3=*null&c4=*null&c6=*null&ns_ts=23702645
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.19.43.224 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:33 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK track
t.teads.tv/ 23 B
193 B 26ms
26ms Image
image/gif 54.154.35.241
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.teads.tv/track?action=placementCall&pageId=50428&pid=87639&gid=&slot=native&env=js-web&ts=1520280273633&auctid=72825fba-6698-414f-aff2-e161f7c402e1
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 54.154.35.241 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-154-35-241.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 23
content-type: image/gif

GET
H/1.1 200
OK track
t.teads.tv/ 23 B
193 B 27ms
27ms Image
image/gif 52.48.203.249

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.teads.tv/track?action=noSlot-minimum&pageId=50428&pid=87639&gid=&slot=native&env=js-web&ts=1520280273633&auctid=72825fba-6698-414f-aff2-e161f7c402e1
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.48.203.249 Dublin, Ireland, ASN (),
Reverse DNS: ec2-52-48-203-249.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 23
content-type: image/gif

GET
H/1.1 200
OK p
sb.scorecardresearch.com/ 43 B
309 B 6ms
6ms Image
image/gif 2.19.43.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?C1=1&C2=17198971&C5=01
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.19.43.224 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:34 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK track
t.teads.tv/ 23 B
193 B 27ms
27ms Image
image/gif 52.48.203.249

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.teads.tv/track?action=adCall&pageId=50428&pid=87639&gid=&slot=corner&env=js-web&ts=1520280273633&auctid=72825fba-6698-414f-aff2-e161f7c402e1
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.48.203.249 Dublin, Ireland, ASN (),
Reverse DNS: ec2-52-48-203-249.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 23
content-type: image/gif

GET
H/1.1 200
OK pl Show response
c.newsinc.com/ 49 B
326 B 432ms
108ms XHR
application/json 52.70.27.99

General

Check archive.org

Show headers Download Go to

Full URL: https://c.newsinc.com/pl?uut=47101b7c-20b1-11e8-8a19-024c3e8e3b03&insid=47101b90-20b1-11e8-8a19-024c3e8e3b03&atei=0&atets=0&vw=1585&vh=1200&sw=1600&sh=1200&furl=https%253A%252F%252Fwww.denverpost.com%252F2018%252F02%252F26%252Fsamsam-ransomware-virus-cdot%252F&ua=chrome+63&embedCount=0&eo=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&iframe=0&fe=0&fv=0&env=&bn=243&ref=&_=1520280273739
Requested by: Host: launch.newsinc.com
URL: https://launch.newsinc.com/243/js/embed.js?ver=4.9.4
Protocol: HTTP/1.1
Server: 52.70.27.99 Ashburn, United States, ASN (),
Reverse DNS: ec2-52-70-27-99.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 4705ae5a35f26014edd9e68cb469a0e7b48532f065c906609d4c22102371ec20

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Origin: https://www.denverpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:10:41 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: Content-Type
Content-Length: 49

GET
H/1.1 200
OK lks
c.newsinc.com/ 42 B
42 B 108ms
108ms Image
application/json 34.239.50.116

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.newsinc.com/lks?isapi=true&event=lkqd&jsonInput=%7B%22insid%22%3A%2247101b90-20b1-11e8-8a19-024c3e8e3b03%22%2C%22uut%22%3A%2247101b7c-20b1-11e8-8a19-024c3e8e3b03%22%2C%22event_time%22%3A%222018-02-05+20%3A04%3A33%22%2C%22event_type%22%3A%22page_load%22%2C%22bn%22%3A%22243%22%2C%22ua%22%3A%22Mozilla%2F5.0+(Macintosh%3B+Intel+Mac+OS+X+10_12_6)+AppleWebKit%2F537.36+(KHTML%2C+like+Gecko)+Chrome%2F63.0.3239.84+Safari%2F537.36%22%2C%22url%22%3A%22https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F%22%2C%22domain%22%3A%22www.denverpost.com%22%2C%22browser%22%3A%22chrome+63%22%2C%22device%22%3A%22dsktop%22%2C%22os%22%3A%22OS+X%22%2C%22os_ver%22%3A%2210.12.6%22%2C%22atets%22%3A14%7D
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 34.239.50.116 Ashburn, United States, ASN (),
Reverse DNS: ec2-34-239-50-116.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:05:02 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: Content-Type
Content-Length: 42

GET
H/1.1 200
OK track
t.teads.tv/ 23 B
193 B 27ms
27ms Image
image/gif 52.48.203.249

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.teads.tv/track?action=noAd-ivt-doubleVerify&pageId=50428&pid=87639&gid=&slot=corner&env=js-web&ts=1520280273633&auctid=72825fba-6698-414f-aff2-e161f7c402e1
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 52.48.203.249 Dublin, Ireland, ASN (),
Reverse DNS: ec2-52-48-203-249.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

expires: Sat, 26 Jul 1997 05:00:00 GMT
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 23
content-type: image/gif

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ Frame (CD7 42 B
178 B 16ms
16ms Image
image/gif 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss4qsE2swvDpG0sjozxQEwtkvpf-k8GDdH03kc8fXsspJQP6OnIUBuI6nrVUSrZ3QnJkoGJUWHpqjTdWcgP9jXL1yXNIfzcSKs&sig=Cg0ArKJSzDsRSR2yEvh0EAE&id=osdim&ti=1&adk=3825197355&tt=1471&bs=1585,1200&mtos=1252,1252,1252,1252,1252&tos=1252,0,0,0,0&p=207,792,208,793&inapp=0&mcvt=1252&rs=3&ht=0&tfs=218&tls=1470&mc=1&lte=1&bas=0&bac=0&ip=1&bos=1600,1200&ps=1585,4511&ss=1600,1200&pt=-1&deb=1-0-6-5-5--1-38-4&tvt=1302&op=1&avms=geo&r=v&uc=9&tgt=BODY&cl=1&cec=5&clc=0&cac=0&cd=1x0&v=r20180228

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Mar 2018 20:04:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK geo2.js Show response
cdn3.optimizely.com/js/ Frame (3B5 294 B
701 B 31ms
11ms Script
application/javascript 2.18.233.186
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn3.optimizely.com/js/geo2.js?cb=1520280273844
Requested by: Host: d2lv4zbk7v5f93.cloudfront.net
URL: https://d2lv4zbk7v5f93.cloudfront.net/esf.js
Protocol: HTTP/1.1
Server: 2.18.233.186 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 40d3161773774e4310edeeed63150f24fd9a64eaa3882649fc26f4f722b818f0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

x-amz-version-id: Y1BKPK.c9lIaZx2uYj8JMWZye_vJfrh9
Server: AmazonS3
x-amz-request-id: 63C8BAB3DDC4826D
ETag: "adadfc5d7afd13e353d9d52cec1c7827"
Content-Type: application/javascript
Cache-Control: max-age=51981
Date: Mon, 05 Mar 2018 20:04:34 GMT
Connection: keep-alive
Content-Length: 294
x-amz-id-2: u9pW5VejRwxUWHLOquasjcWQqZNlc/P5yh5vPT7RxeUYteyYeYyo6EvdZrRfG1OB2sloAUoacWM=

GET
S 200 ;ord=1520280273846
ad.doubleclick.net/ddm/ad/gn/ 43 B
110 B 15ms
15ms Image
image/gif 172.217.23.166
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/ad/gn/;ord=1520280273846?

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.23.166 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f6.1e100.net

Software

cafe /

Resource Hash

9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Mar 2018 20:04:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK ob_logo_67x12.png
widgets.outbrain.com/images/widgetIcons/ 2 KB
3 KB 6ms
5ms Image
image/png 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widgets.outbrain.com/images/widgetIcons/ob_logo_67x12.png
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: 487aec7746a83542b3573383df65747e31c494d8412103b5675329f3d4befaeb

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Last-Modified: Sun, 18 Feb 2018 11:28:04 GMT
Server: Apache
ETag: "c52b07e749f7a09fa7b97b7e195e06ce:1518953284"
Access-Control-Allow-Methods: GET,POST
Content-Type: image/png
Access-Control-Allow-Origin: *, *
Cache-Control: max-age=604800
Access-Control-Allow-Credentials: false
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2326

GET
S 200 get Show response
odb.outbrain.com/utils/ 28 KB
10 KB 138ms
137ms Script
text/x-json 151.101.114.2
Fastly

General

Check archive.org

Show headers Download Go to

Full URL

https://odb.outbrain.com/utils/get?url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&srcUrl=https%3A%2F%2Fwww.denverpost.com%2Ffeed%2F&settings=true&recs=true&widgetJSId=AR_2&key=NANOWDGT01&idx=1&version=01002300&ref=&apv=true&sig=9ST5ofwd&format=html&rand=95637&lsd=3f43353d-d0a4-40a1-8694-00a27baa1b8e&t=MV8yOTYwZDdiYmU1M2M0MjdmOTI4OTgwNGMyYWYyNDE5N18w&winW=1600&winH=1200&adblck=false&secured=true

Requested by

Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js

Protocol

SPDY

Server

151.101.114.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),

Reverse DNS

Software

Resource Hash

e6afea598f1cab44154130591cfc7e0ce00a3fc1a0b044fafba26aa14bd13a65

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains;

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:34 GMT
content-encoding: gzip
traffic-path: NYDC1, JFK, HHN, Europe1
x-cache: MISS, MISS
p3p: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
status: 200
x-cache-hits: 0, 0
strict-transport-security: max-age=0; includeSubDomains;
x-served-by: cache-jfk8132-JFK, cache-hhn1546-HHN
pragma: no-cache
x-timer: S1520280274.897919,VS0,VE131
vary: Accept-Encoding, User-Agent
content-type: text/x-json; charset=UTF-8
via: 1.1 varnish, 1.1 varnish
cache-control: no-cache
backend-ip: 104.156.90.32
accept-ranges: bytes, bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK eyJpdSI6IjNmNjU2OGViMmU1NDk1MjkwZTE3NzRkMzc3ZmJkNWEzZDI2YTYwOTQzZWEyOTk0YWNkOWRlYjJmNDI5NWEyM2QiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 16 KB
16 KB 25ms
6ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6IjNmNjU2OGViMmU1NDk1MjkwZTE3NzRkMzc3ZmJkNWEzZDI2YTYwOTQzZWEyOTk0YWNkOWRlYjJmNDI5NWEyM2QiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: 7fdd6797e615c3d6afc366b036e144c16c0f7d59fe30b8a236f2d58b74c2fc16

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Thu, 01 Mar 2018 19:01:16 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=2439498
Connection: keep-alive
Content-Length: 16270

GET
H/1.1 200
OK eyJpdSI6ImRmNjFmNDMwZDQ3OTdlNWQ1N2VhZWNlZTk5NDA3MThhY2Q0ZDY4MGI0YjBmOWVkNTFjNGVhMjljNWFmNWJkNzciLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 13 KB
13 KB 26ms
9ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6ImRmNjFmNDMwZDQ3OTdlNWQ1N2VhZWNlZTk5NDA3MThhY2Q0ZDY4MGI0YjBmOWVkNTFjNGVhMjljNWFmNWJkNzciLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: 7f85b617b0bd55f3774a3d9e8a671ccbca7f1ba73813a7d32b73ef98421e4601

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Thu, 15 Feb 2018 09:40:43 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=1344601
Connection: keep-alive
Content-Length: 12996

GET
H/1.1 200
OK eyJpdSI6IjhjOTk3YWVlNDQ4NjMyNmM3ZmMyMGY5MGMyMDI5NzI3ZmIzMGFiY2ZjYjgwYjNiNzQ4NDJlYTVjMmU2MTU5NTIiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 6 KB
6 KB 8ms
8ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6IjhjOTk3YWVlNDQ4NjMyNmM3ZmMyMGY5MGMyMDI5NzI3ZmIzMGFiY2ZjYjgwYjNiNzQ4NDJlYTVjMmU2MTU5NTIiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: 485833c5264caac8f7c0a69f37f92c70b1371588293969928275d31e1bac85aa

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Wed, 31 Jan 2018 14:08:40 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=1231325
Connection: keep-alive
Content-Length: 6014

GET
H/1.1 200
OK eyJpdSI6Ijg2MjZiZDczNmUxNTBkNTc3OGRmZTAyYTQwM2VlY2Y2ZWY1ZTQ4ODQ1OTg2ZDBlYTI0MjE1ZTgzOGMyZGQ5ZWYiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 17 KB
17 KB 8ms
7ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6Ijg2MjZiZDczNmUxNTBkNTc3OGRmZTAyYTQwM2VlY2Y2ZWY1ZTQ4ODQ1OTg2ZDBlYTI0MjE1ZTgzOGMyZGQ5ZWYiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: 7f3f1a2ea3869b97e7474310f746d6aa23e2e6ee9487ac1cd8e8ceed7b55f640

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Sun, 18 Feb 2018 01:41:13 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=2457180
Connection: keep-alive
Content-Length: 16931

GET
H/1.1 200
OK eyJpdSI6IjAyY2ZkZDM5MWIwYzMxZTMyNTcxNGViNDA0OTY4NzRkMjdmMDhhNTY1ZGZhOGM2NWEzYjgzNjlkYjAwYTZjMzkiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 15 KB
15 KB 12ms
11ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6IjAyY2ZkZDM5MWIwYzMxZTMyNTcxNGViNDA0OTY4NzRkMjdmMDhhNTY1ZGZhOGM2NWEzYjgzNjlkYjAwYTZjMzkiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: bd9c106f65aa25948ddc3c22100f0d8fc948e6ed0cadce73398446cf5827ff46

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Wed, 31 Jan 2018 13:16:19 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=1293417
Connection: keep-alive
Content-Length: 15280

GET
H/1.1 200
OK eyJpdSI6ImQ0NzM1Y2M2ZDJjNTU0ZjcxNjdmZjE4NzBiM2ZlZjBjMTc5YTZjMzhjNDIzYzMzYjRmY2VmMmJlMjY5MmM1NjMiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 16 KB
17 KB 10ms
7ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6ImQ0NzM1Y2M2ZDJjNTU0ZjcxNjdmZjE4NzBiM2ZlZjBjMTc5YTZjMzhjNDIzYzMzYjRmY2VmMmJlMjY5MmM1NjMiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: cb2acf2bc5707f8d22c6e9700eb66a7e83d9815ceeddd6f64165445f7a497b53

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Wed, 31 Jan 2018 02:51:07 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=886269
Connection: keep-alive
Content-Length: 16881

GET
H/1.1 200
OK eyJpdSI6ImY4NjA0NjliZjA2YzhhZjA3MmUzNmY2OWQ3OWJhMjUwNjdjZmIyOWU5MGViMzJmMjJlNzhiZWIyNDQwNGMyZTIiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 17 KB
17 KB 14ms
6ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6ImY4NjA0NjliZjA2YzhhZjA3MmUzNmY2OWQ3OWJhMjUwNjdjZmIyOWU5MGViMzJmMjJlNzhiZWIyNDQwNGMyZTIiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: f7768deb40345f0798acf1dd6c0baa61a8559ae598a4102df35f678243fd8d15

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 06 Feb 2018 10:27:02 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=905825
Connection: keep-alive
Content-Length: 17321

GET
H/1.1 200
OK eyJpdSI6IjE2Yjc5NzU5YzgwZDk2NzE2YzlhMDIwNGZiOGViYzkzM2Y1NDNlZWUxY2I3NDIyOGMxZTBkNGFjN2QwNDg3MzMiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 9 KB
9 KB 7ms
6ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6IjE2Yjc5NzU5YzgwZDk2NzE2YzlhMDIwNGZiOGViYzkzM2Y1NDNlZWUxY2I3NDIyOGMxZTBkNGFjN2QwNDg3MzMiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: f0a053755f5f593524486a03b129fcfaab015a49829c1e4e63a7698eb5a2dc7d

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 06 Feb 2018 06:37:48 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=909556
Connection: keep-alive
Content-Length: 9122

GET
H/1.1 200
OK tUxHTINGb1zW Show response
at1.listrakbi.com/activity/ 111 B
487 B 106ms
105ms Script
text/javascript 52.6.36.75
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://at1.listrakbi.com/activity/tUxHTINGb1zW?vuid=96f3e73c-3cc6-45bb-8dd1-a80ab8c9b220&uid=4DCD3F30-FAA3-494B-8A5A-4C956A8FCE0A&gsid=fd26bb7a-fafa-4544-98a7-347a9b0d9b0d&_t_0=at&t_0=PageBrowse&k_0=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F
Requested by: Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=tUxHTINGb1zW&v=1
Protocol: HTTP/1.1
Server: 52.6.36.75 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-6-36-75.compute-1.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: bc9ff628bc157259ffe80521c6748edbb30b7fc2abaa40d6c8f3c7983f6d03e1

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: text/javascript; charset=utf-8
Cache-Control: private
Connection: keep-alive
Content-Length: 111

GET
H/1.1 200
OK tUxHTINGb1zW Show response
at1.listrakbi.com/activity/ 111 B
487 B 206ms
106ms Script
text/javascript 52.6.36.75
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://at1.listrakbi.com/activity/tUxHTINGb1zW?vuid=96f3e73c-3cc6-45bb-8dd1-a80ab8c9b220&uid=BCF85D87-30A4-4445-B167-BB3977346A43&gsid=fd26bb7a-fafa-4544-98a7-347a9b0d9b0d&_t_0=at&t_0=Identification&k_0=3&_t_1=at&t_1=Identification&k_1=4&_t_2=at&t_2=Identification&k_2=5
Requested by: Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=tUxHTINGb1zW&v=1
Protocol: HTTP/1.1
Server: 52.6.36.75 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-6-36-75.compute-1.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: bc9ff628bc157259ffe80521c6748edbb30b7fc2abaa40d6c8f3c7983f6d03e1

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: text/javascript; charset=utf-8
Cache-Control: private
Connection: keep-alive
Content-Length: 111

GET
H/1.1 200
OK tUxHTINGb1zW Show response
at1.listrakbi.com/activity/ 111 B
487 B 311ms
105ms Script
text/javascript 52.6.36.75
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://at1.listrakbi.com/activity/tUxHTINGb1zW?vuid=96f3e73c-3cc6-45bb-8dd1-a80ab8c9b220&uid=EC455C5E-361A-42EB-B95C-BC22A33D7D48&gsid=fd26bb7a-fafa-4544-98a7-347a9b0d9b0d&_t_0=at&t_0=ContentBrowse&k_0=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F
Requested by: Host: cdn.listrakbi.com
URL: https://cdn.listrakbi.com/scripts/script.js?m=tUxHTINGb1zW&v=1
Protocol: HTTP/1.1
Server: 52.6.36.75 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-6-36-75.compute-1.amazonaws.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: bc9ff628bc157259ffe80521c6748edbb30b7fc2abaa40d6c8f3c7983f6d03e1

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: text/javascript; charset=utf-8
Cache-Control: private
Connection: keep-alive
Content-Length: 111

GET
H/1.1 200
OK eyJpdSI6IjQ2Nzk5YzYxYTM2ZjM4OTc4MzFjNzEzYzMzN2IxZTZjOWRhMTQ2MmVlNWJjODIwNzg1NzA1MTk4Y2IwZjc0YjYiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 19 KB
19 KB 22ms
22ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6IjQ2Nzk5YzYxYTM2ZjM4OTc4MzFjNzEzYzMzN2IxZTZjOWRhMTQ2MmVlNWJjODIwNzg1NzA1MTk4Y2IwZjc0YjYiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: 751c41eb180020782ad563c6ab215129708dcb9a5dde34b0df55c18dec12c90b

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Sun, 25 Feb 2018 22:14:53 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=1782314
Connection: keep-alive
Content-Length: 19157

GET
H/1.1 200
OK eyJpdSI6IjlmMTZlYmZiNzdhNDVlODA1YjcxMjY5OWI4ZGJiMGJmNGViYThjZjQxYzY3MzQyZjRkM2E2OGI2YTljMWNmYTUiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 11 KB
12 KB 8ms
8ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6IjlmMTZlYmZiNzdhNDVlODA1YjcxMjY5OWI4ZGJiMGJmNGViYThjZjQxYzY3MzQyZjRkM2E2OGI2YTljMWNmYTUiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: 8e05e08f4ae9dfa47d3c90cd92afbf05c43bed13dfcedff400f75c5173d7cf16

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Mon, 26 Feb 2018 21:03:51 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=1867212
Connection: keep-alive
Content-Length: 11670

GET
H/1.1 200
OK eyJpdSI6IjVjMzNmZGUzYWM3YTNkODhkYTQ4MjJjMTFkY2NlM2JkNWI0NTFiOTQ5OTI5Y2IzZjNjY2U1MmNjYzkzMzdmOGIiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 20 KB
20 KB 11ms
11ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6IjVjMzNmZGUzYWM3YTNkODhkYTQ4MjJjMTFkY2NlM2JkNWI0NTFiOTQ5OTI5Y2IzZjNjY2U1MmNjYzkzMzdmOGIiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: 1577be668ac0c5ee9609039b1c15cd4c3ccd494fedf8e793563594b003660a64

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Wed, 21 Feb 2018 01:13:08 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=1371520
Connection: keep-alive
Content-Length: 20067

GET
H/1.1 200
OK eyJpdSI6ImEzZmZmZjI4Y2EyZjk2YjNkMzM2Y2I2ZmU4ZmIyYzkwMDY3Zjg3NWM3MjhkZDhjNzY5NWY5ZjQ5NWQyNGExZWMiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 6 KB
6 KB 17ms
17ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6ImEzZmZmZjI4Y2EyZjk2YjNkMzM2Y2I2ZmU4ZmIyYzkwMDY3Zjg3NWM3MjhkZDhjNzY5NWY5ZjQ5NWQyNGExZWMiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: 125530e064888934c27b070a751bb201ff46bb2c19236ec0bb5904af19323e97

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 23 Jan 2018 02:25:33 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=888267
Connection: keep-alive
Content-Length: 5772

GET
H/1.1 200
OK eyJpdSI6Ijk1NDc3ZDVmMDhiM2FkOWYyNGUyZmMwNWY1NWVkZWNhMWFjYjE3OThlNDRjOTcxYTkzOTRkODI5YzI5M2M2MmYiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 16 KB
16 KB 11ms
10ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6Ijk1NDc3ZDVmMDhiM2FkOWYyNGUyZmMwNWY1NWVkZWNhMWFjYjE3OThlNDRjOTcxYTkzOTRkODI5YzI5M2M2MmYiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: e98bf0cf17e55c8aa922f559a2ebff8ad12c31894fd14ba5c738b9c003965b9f

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Mar 2018 12:25:50 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=2351980
Connection: keep-alive
Content-Length: 16016

GET
H/1.1 200
OK eyJpdSI6ImE0MTBjMDRlNGNlM2NjODY4ZWYxMmEzZDdhYTk0YTk2MDlmZjExYzQzMjE2M2E5ZmI0MTQ0Y2M0MDY2ZDQ3Y2QiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 37 KB
38 KB 11ms
10ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6ImE0MTBjMDRlNGNlM2NjODY4ZWYxMmEzZDdhYTk0YTk2MDlmZjExYzQzMjE2M2E5ZmI0MTQ0Y2M0MDY2ZDQ3Y2QiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: 04bdc32a9dfdf8c4ae18d1490887ecc9a96fa169e37cc6829e0d730eff68aa17

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Fri, 02 Mar 2018 18:19:44 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=2200092
Connection: keep-alive
Content-Length: 38416

GET
H/1.1 200
OK eyJpdSI6IjdjOGJkYjI1OTZiZGQ2ODIxZmVhNGFmYmE2MjBhZjNmOTI5ZjU2ZDM0ZTI5NzY0YWUwNTgxMjNhZWEyZGRhOTEiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 14 KB
15 KB 9ms
8ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6IjdjOGJkYjI1OTZiZGQ2ODIxZmVhNGFmYmE2MjBhZjNmOTI5ZjU2ZDM0ZTI5NzY0YWUwNTgxMjNhZWEyZGRhOTEiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: 5fc2eeb9c92c8c5a1512c1be6768578e948f31c20b19e6409eaceb3b72112ab4

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Feb 2018 15:18:17 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=1236917
Connection: keep-alive
Content-Length: 14850

GET
H/1.1 200
OK eyJpdSI6IjZlMDllMGFkMTE0OTg5NzVjZWM5YjVmNGJkYjE1MWIzNmE0YTlmMDkyNDdjNWQ2ODUxMjBiOWZjYjBiZmZhMDEiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
images.outbrain.com/transform/v3/ 15 KB
16 KB 16ms
16ms Image
image/webp 2.18.234.190
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrain.com/transform/v3/eyJpdSI6IjZlMDllMGFkMTE0OTg5NzVjZWM5YjVmNGJkYjE1MWIzNmE0YTlmMDkyNDdjNWQ2ODUxMjBiOWZjYjBiZmZhMDEiLCJ3IjoyNDAsImgiOjE3MCwiZCI6MS41LCJjcyI6MCwiZiI6MH0.webp
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 2.18.234.190 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
Software: /
Resource Hash: 4fc9aac150f1d74588d78689bc1edd7132d7fb7c490ebb2ae6ad4065a0048cd1

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Feb 2018 03:30:09 GMT
Vary: Accept-Encoding
Content-Type: image/webp
Cache-Control: max-age=1467581
Connection: keep-alive
Content-Length: 15742

GET
H/1.1 200
OK ptrack-v1.0.1-engagedtime-slots.js Show response
d1z2jf7jlzjs58.cloudfront.net/code/ 34 KB
14 KB 11ms
11ms Script
application/x-javascript 216.137.61.227
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/code/ptrack-v1.0.1-engagedtime-slots.js
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/p.js
Protocol: HTTP/1.1
Server: 216.137.61.227 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-216-137-61-227.fra2.r.cloudfront.net
Software: nginx /
Resource Hash: f5044bb9a4c901d608d6c4f3fc8602b9d95ff62977664876dc3d5088e671adfa

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: public
Date: Fri, 08 Sep 2017 18:17:54 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 Sep 2017 17:36:37 GMT
Server: nginx
Age: 15385600
ETag: W/"59b2d525-86eb"
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 9f37c8b999ae2d6018396fda48773445.cloudfront.net (CloudFront)
Cache-Control: max-age=315360000, public
Connection: keep-alive
X-Amz-Cf-Id: UTU_An5WPO1ZJshLYSL_e5RZ5iyXp7vMGhzbxdW14oxxVsDSDxDT8Q==
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
S 200 rules-p-573scDfDoUH6o.js Show response
rules.quantcount.com/ 3 B
340 B 7ms
7ms Script
application/x-javascript 52.85.184.73
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-573scDfDoUH6o.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: SPDY
Server: 52.85.184.73 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-52-85-184-73.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Fri, 22 Sep 2017 00:53:09 GMT
via: 1.1 d41256fff4c52560b6f36cf42caee95d.cloudfront.net (CloudFront)
last-modified: Sat, 04 Mar 2017 19:59:38 GMT
server: AmazonS3
age: 50183
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=86400
accept-ranges: bytes
content-length: 3
x-amz-cf-id: PxPfsOkwP7Mk4DDT5nvsiuuIHSLg_2hC_BNvTWOFWkqamSeBV5UeTA==

GET
H/1.1 200
OK pixel;r=902533139;labels=Page%20Load.DPID.denverpost-com%2CPage%20Load.Site%20Category.3b.DPID.denverpost-com%2CPage%20Load.Site%20Category.0.DPID.denverpost-com;event=refresh;rf=3;a=p-573scDfDoUH6...
pixel.quantserve.com/ 35 B
287 B 52ms
12ms Image
image/gif 95.172.94.13
Quantcast Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.quantserve.com/pixel;r=902533139;labels=Page%20Load.DPID.denverpost-com%2CPage%20Load.Site%20Category.3b.DPID.denverpost-com%2CPage%20Load.Site%20Category.0.DPID.denverpost-com;event=refresh;rf=3;a=p-573scDfDoUH6o;url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F;fpan=0;fpa=P0-575419576-1520280271784;ns=0;ce=1;cm=;ref=;je=0;sr=1600x1200x24;enc=n;dst=0;et=1520280274183;tzo=0;ogl=type.article%2Ctitle.SamSam%20ransomware%20virus%20keeps%20CDOT%20employees%20offline%20for%20fourth%20day%2Curl.https%3A%2F%2Fwww%252Edenverpost%252Ecom%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F%2Cdescription.Nasty%20ransomware%20took%20its%20toll%20on%20Colorado%20Department%20of%20Transportation%20workers%20%2Csite_name.The%20Denver%20Post%2Cimage.https%3A%2F%2Fwww%252Edenverpost%252Ecom%2Fwp-content%2Fuploads%2F2016%2F10%2Fcover%252Ejpg%3Fw%3D1024%26h%3D576%2Cimage%3Awidth.1024%2Cimage%3Aheight.576%2Clocale.en_US
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 95.172.94.13 , United Kingdom, ASN27281 (QUANTCAST - Quantcast Corporation, US),
Reverse DNS: pixel.quantserve.com
Software: QS /
Resource Hash: a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 05 Mar 2018 20:04:34 GMT
Server: QS
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, proxy-revalidate
Connection: close
Content-Length: 35
Expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1 200
OK widgetGlobalEvent Show response
log.outbrain.com/loggerServices/ 4 B
262 B 386ms
95ms Script
application/json 74.201.198.92
Internap Network ...

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrain.com/loggerServices/widgetGlobalEvent?eT=0&tm=1592&pid=116&sid=16288&wId=251&wRV=01002300&rId=2960d7bbe53c427f9289804c2af24197&idx=0&pvId=2960d7bbe53c427f9289804c2af24197&org=0&pad=8&pVis=1&eIdx=&ab=0&wl=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: HTTP/1.1
Server: 74.201.198.92 , United States, ASN13789 (INTERNAP-BLK3 - Internap Network Services Corporation, US),
Reverse DNS
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 4
Expires: 0

GET
H/1.1 200
OK widgetGlobalEvent Show response
log.outbrain.com/loggerServices/ 4 B
262 B 387ms
102ms Script
application/json 74.201.198.92
Internap Network ...

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrain.com/loggerServices/widgetGlobalEvent?eT=0&tm=1593&pid=116&sid=16288&wId=252&wRV=01002300&rId=2260f227fc13fe6aa46bd941f18cf2f8&idx=1&pvId=2960d7bbe53c427f9289804c2af24197&org=8&pad=0&pVis=0&eIdx=&ab=0&wl=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js
Protocol: HTTP/1.1
Server: 74.201.198.92 , United States, ASN13789 (INTERNAP-BLK3 - Internap Network Services Corporation, US),
Reverse DNS
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 4
Expires: 0

GET
H/1.1 200
OK /
srv-2018-03-05-20.pixel.parsely.com/plogger/ 43 B
229 B 417ms
103ms Image
image/gif 34.194.12.155

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srv-2018-03-05-20.pixel.parsely.com/plogger/?rand=1520280274491&idsite=denverpost.com&url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22parsely_uuid%22%3A%220b623924-7cb7-41b8-82d5-1d6a8ec7e539%22%2C%22parsely_site_uuid%22%3A%22e8ddd4c0-7c00-4f75-907f-40592e26228a%22%7D&sid=1&surl=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&sref=&sts=1520280274489&slts=0&title=CDOT+employees+still+offline+after+SamSam+ransomware+virus+attack&date=Mon+Mar+05+2018+20%3A04%3A34+GMT%2B0000+(UTC)&action=pageview&u=e8ddd4c0-7c00-4f75-907f-40592e26228a
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 34.194.12.155 Ashburn, United States, ASN (),
Reverse DNS: ec2-34-194-12-155.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:34 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
S 200 connatix.renderer.infeed.min.js Show response
cdns.connatix.com/p/429/min/ 503 KB
134 KB 1126ms
1103ms Script
application/x-javascript 151.101.114.107

General

Check archive.org

Show headers Download Go to

Full URL: https://cdns.connatix.com/p/429/min/connatix.renderer.infeed.min.js?_=1520280272936
Requested by: Host: cdn.connatix.com
URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js?_=1520280272936
Protocol: SPDY
Server: 151.101.114.107 San Francisco, United States, ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 92435a4a10e3d120575b993d5db983a320c2af0c847cad3d271587d7f1cf4149

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:35 GMT
content-encoding: gzip
age: 1
x-cache: MISS
status: 200
content-length: 136827
x-served-by: cache-hhn1546-HHN
access-control-allow-origin: *
last-modified: Mon, 05 Mar 2018 17:26:04 GMT
server: AmazonS3
x-timer: S1520280275.621582,VS0,VE1097
etag: "c68d4d7c2d56643125c0ffeda53703f8"
vary: Accept-Encoding
content-type: application/x-javascript
via: 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 0

GET
S 200 connatix.renderer.infeed.min.js Show response
cdns.connatix.com/p/429/min/ 503 KB
134 KB 8ms
7ms Script
application/x-javascript 151.101.114.107

General

Check archive.org

Show headers Download Go to

Full URL: https://cdns.connatix.com/p/429/min/connatix.renderer.infeed.min.js
Requested by: Host: cdn.connatix.com
URL: https://cdn.connatix.com/min/connatix.renderer.infeed.min.js?_=1520280272936
Protocol: SPDY
Server: 151.101.114.107 San Francisco, United States, ASN (),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 92435a4a10e3d120575b993d5db983a320c2af0c847cad3d271587d7f1cf4149

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:34 GMT
content-encoding: gzip
age: 9491
x-cache: HIT
status: 200
content-length: 136827
x-served-by: cache-hhn1546-HHN
access-control-allow-origin: *
last-modified: Mon, 05 Mar 2018 17:26:04 GMT
server: AmazonS3
x-timer: S1520280275.777370,VS0,VE0
etag: "c68d4d7c2d56643125c0ffeda53703f8"
vary: Accept-Encoding
content-type: application/x-javascript
via: 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1816

GET
H/1.1

200

partner
sync.search.spotxchange.com/
Redirect Chain

https://sync.search.spotxchange.com/partner?source=pub_136839
https://sync.search.spotxchange.com/partner?source=pub_136839&__user_check__=1&sync_id=6cff8e54-20b0-11e8-be65-1873cb630006
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_sc
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEPynktSjoTWTnBv19iWbKdg&google_cver=1
https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=Wp2i0QAAAHV6Mja8&img=1
https://match.adsrvr.org/track/cmf/generic?ttd_pid=spotx&ttd_puid=6cff8eb1-20b0-11e8-be65-1873cb630006
https://sync.search.spotxchange.com/partner?adv_id=7028&uid=196068f6-7675-4a2d-b6fe-d7797827bcd2&img=1
https://sync.tidaltv.com/Spotx.ashx
https://sync.tidaltv.com/genericusersync.ashx?dpid=6512&s=1
https://sync.search.spotxchange.com/partner?adv_id=6512&uid=bd016b4f-e910-41fe-a52b-85c65fe50013&img=1
https://sync.mathtag.com/sync/img?mt_exid=30&redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6653%26uid%3D%5BMM_UUID%5D
https://sync.search.spotxchange.com/partner?adv_id=6653&uid=ded75a97-0b22-4a00-84db-4f5c11da17f0
https://log.adap.tv/spotx_sync
https://sync.adaptv.advertising.com/spotx_sync?
https://sync.search.spotxchange.com/partner?adv_id=6920&uid=3437108335093224225-VB6b8be90a-20b0-11e8-9d8b-0acf033c15dc
https://dsp.adfarm1.adition.com/cookie/?ssp=14
https://sync.search.spotxchange.com/partner?adv_id=7577&uid=6529554070504077336

43 B
690 B

12ms
11ms

Image
image/gif

185.94.180.125

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7577&uid=6529554070504077336
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: HTTP/1.1
Server: 185.94.180.125 , Netherlands, ASN (),
Reverse DNS
Software: nginx/1.12.0 /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:37 GMT
Server: nginx/1.12.0
Access-Control-Allow-Methods: GET, POST, OPTIONS
P3P: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43

Redirect headers

Location: https://sync.search.spotxchange.com/partner?adv_id=7577&uid=6529554070504077336
Date: Mon, 05 Mar 2018 20:04:37 GMT
Server: nginx
Connection: keep-alive
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
Transfer-Encoding: chunked
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK pls Show response
vcore.connatix.com/ 136 B
522 B 428ms
109ms Script
text/javascript 34.197.188.11

General

Check archive.org

Show headers Download Go to

Full URL: https://vcore.connatix.com/pls?callback=jQuery32104989249873115613_1520280274885&token=d1550620-9eb3-4ded-9d10-1efdcf7322e2&p=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&c_v=429_0_0_0_1&_=1520280274886
Requested by: Host: cdns.connatix.com
URL: https://cdns.connatix.com/p/429/min/connatix.renderer.infeed.min.js
Protocol: HTTP/1.1
Server: 34.197.188.11 Ashburn, United States, ASN (),
Reverse DNS: ec2-34-197-188-11.compute-1.amazonaws.com
Software: nginx/1.12.2 / ServiceStack/5.02 NETStandard/.NET
Resource Hash: 34157cae4b5a2a19a7883039e5da0dd39687a0ba23b8fa78ad918fdb93b18658

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:35 GMT
Content-Encoding: gzip
Server: nginx/1.12.2
X-Powered-By: ServiceStack/5.02 NETStandard/.NET
Vary: Accept
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Content-Length: 141

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ Frame (74A 42 B
110 B 16ms
16ms Image
image/gif 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssLlkIzcprHXtohlXO7GuuCLd3eZcOuM6cZ0jhYprWFctCWnQoIoX_peY6KHd54d46nj5uU2C-UThoILHZ1evUsEhAxCkAFRUg&sig=Cg0ArKJSzOJChKa13wBZEAE&id=osdim&ti=1&adk=685209867&tt=3441&bs=1585,1200&mtos=1013,1013,1013,1013,1013&tos=1013,0,0,0,0&p=218,429,308,1157&opac=1&inapp=0&mcvt=1013&rs=3&ht=0&tfs=2427&tls=3440&mc=1&lte=1&bas=0&bac=0&ip=1&bos=1600,1200&ps=1585,5508&ss=1600,1200&pt=-1&deb=1-0-6-11-17--1-245-11&tvt=3272&op=1&avms=geo&r=v&uc=35&tgt=INS&cl=1&cec=7&clc=1&cac=0&cd=728x90&v=r20180228

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Mar 2018 20:04:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
S 200 activeview
pagead2.googlesyndication.com/pcs/ Frame (70B 42 B
110 B 16ms
16ms Image
image/gif 172.217.18.2
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuNMc8KisSi1RgN4ytZXu00m0QChT5Rt-1AqYBBI74aKUSC6XJ5C3tHxHIAMvgJWpEBiG6jrB3a8ShEL9knqqQKqjbaqO0_E7s&sig=Cg0ArKJSzIlCAN_dX7_6EAE&id=osdim&ti=1&adk=779411635&tt=3441&bs=1585,1200&mtos=1056,1056,1056,1056,1056&tos=1056,0,0,0,0&p=541,1120,791,1420&opac=1&inapp=0&mcvt=1056&rs=3&ht=0&tfs=2384&tls=3440&mc=1&lte=1&bas=0&bac=0&ip=1&bos=1600,1200&ps=1585,5508&ss=1600,1200&pt=-1&deb=1-0-6-11-17--1-245-11&tvt=3272&op=1&avms=geo&r=v&uc=39&tgt=INS&cl=1&cec=7&clc=1&cac=0&cd=300x250&v=r20180228

Requested by

Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/

Protocol

SPDY

Server

172.217.18.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 05 Mar 2018 20:04:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: hq="googleads.g.doubleclick.net:443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="41,39,38,37,35",hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 42
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK cs.js Show response
sb.scorecardresearch.com/c2/6035443/ 0
400 B 7ms
6ms Script
application/x-javascript 2.19.43.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/c2/6035443/cs.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Protocol: HTTP/1.1
Server: 2.19.43.224 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:37 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 Apr 2011 23:11:26 GMT
ETag: "d41d8cd98f00b204e9800998ecf8427e:1349196464"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=259200
Connection: keep-alive
Content-Length: 20
Expires: Thu, 08 Mar 2018 20:04:37 GMT

GET
S 200 chartbeat.js Show response
static.chartbeat.com/js/ 33 KB
13 KB 27ms
6ms Script
application/x-javascript 151.101.114.202
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat.js
Requested by: Host: www.denverpost.com
URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Protocol: SPDY
Server: 151.101.114.202 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: 1548df29ed135b0d6b69ce8959cd2d8a975272d552f8da1bdb83c1bb628f2ee2

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 05 Mar 2018 20:04:37 GMT
content-encoding: gzip
last-modified: Fri, 16 Feb 2018 03:46:04 GMT
server: nginx
etag: "5a8653fc-85d0"
x-served-by: cache-hhn1550-HHN
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
status: 200
cache-control: max-age=7200
accept-ranges: bytes
content-length: 13342
via: 1.1 varnish
x-cache-hits: 1002796

GET
H/1.1 200
OK bundle.js Show response
app-cdn.spot.im/modules/newsfeed/3.1.426/ 942 KB
251 KB 37ms
37ms Script
application/javascript 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://app-cdn.spot.im/modules/newsfeed/3.1.426/bundle.js
Requested by: Host: www.spot.im
URL: https://www.spot.im/launcher/bundle.js
Protocol: HTTP/1.1
Server: 209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x03f.map2.ssl.hwcdn.net
Software: /
Resource Hash: f19e1879e142f3e71c4610bd7939580284170bc4392629d4927370ac18b92b4d

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:37 GMT
Content-Encoding: gzip
Last-Modified: Sun, 04 Mar 2018 14:00:12 GMT
ETag: 1520172012
X-HW: 1520280272.dop009.fr8.t,1520280272.cds003.fr8.shn,1520280277.dop009.fr8.t,1520280277.cds002.fr8.c
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=31427773
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 256532

GET
H/1.1 503
Site over allowed capacity. ping
ping.chartbeat.net/ 0
346 B 438ms
107ms Image
text/html 50.17.242.191

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=denverpost.com&p=%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&u=BoEK9-BklpG4BPetEN&d=denverpost.com&g=2671&g0=Business%2CColorado%20News%2CLatest%20News%2CNews%2CTechnology%2CTransportation&g1=Tamara%20Chuang&n=1&f=00001&c=0&x=0&m=0&y=5508&o=1585&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=7259&t=CUocKSBN1JY4syG7_9TcE3CDdFQE&V=100&i=CDOT%20employees%20still%20offline%20after%20SamSam%20ransomware%20virus%20attack&tz=0&sn=1&EE=0&sv=O26Q7CovgM8KKfozCiIQD7D-NkFq&_
Protocol: HTTP/1.1
Server: 50.17.242.191 Ashburn, United States, ASN (),
Reverse DNS: ec2-50-17-242-191.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 150
Content-Type: text/html

GET
H/1.1 200
OK newsfeed-preview Show response
www.spot.im/api/newsfeed-sync/spot/sp_sXPv48AD/ 2 KB
3 KB 405ms
405ms XHR
application/json 209.197.3.63
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.spot.im/api/newsfeed-sync/spot/sp_sXPv48AD/newsfeed-preview

Requested by

Host: app-cdn.spot.im
URL: https://app-cdn.spot.im/modules/newsfeed/3.1.426/bundle.js

Protocol

HTTP/1.1

Server

209.197.3.63 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),

Reverse DNS

vip0x03f.map2.ssl.hwcdn.net

Software

Resource Hash

1cade4a90fc4abcc3e2880a62c06b30e0e1588981c88a1f9186e7307bba45279

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
Origin: https://www.denverpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type: text/plain

Response headers

Date: Mon, 05 Mar 2018 20:04:38 GMT
X-Content-Type-Options: nosniff
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, PATCH, HEAD, OPTIONS
Content-Type: application/json
Access-Control-Allow-Origin: https://www.denverpost.com
Access-Control-Expose-Headers: x-spotim-bid, x-spotim-rid, x-spotim-token, x-spotim-networkid, x-spotim-spotid, x-spotim-vid
Access-Control-Allow-Credentials: true
x-spotim-bid
Connection: Keep-Alive
x-spotim-rid
Access-Control-Allow-Headers: x-spotim-bid, x-spotim-rid, x-spotim-token, x-spotim-networkid, x-spotim-spotid, x-spotim-vid, Content-Type
Content-Length: 2266
X-HW: 1520280271.dop004.fr8.t,1520280271.cds034.fr8.shn,1520280278.dop004.fr8.t,1520280278.cds018.fr8.sc,1520280278.cds018.fr8.p
x-spotim-vid

GET
H/1.1 200
OK bcn
www.summerhamster.com/ 43 B
252 B 550ms
181ms Image
image/gif 52.38.152.125

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.summerhamster.com/bcn?fe=1520280278246&y=2.0.1003&elg=84659000&flg=UVRFKZYxoSUxmdQ&x=zzz.ghqyhusrvw.frp%2F2018%2F02%2F26%2Fvdpvdp-udqvrpzduh-yluxv-fgrw%2F&vqwo=1&deo=0&g0=vg%3A%3Aer%2Cxd%3A%3Aqexd%3A%3Aqsu%7Cvg%3A%3Ask%3A%3Aqsk%3A%3Aqsu%7Clq%3A%3Adm%2Clqi%2Cqh%2Cvf%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Ffgq3.rswlplchob.frp%2Fmv%2Fjhr2.mv%3Ffe%3D1520280273844%7Cgisl%3A%3Alp%2Clqi%2Cqh%3A%3Aqoe%3A%3Aqsu%3A%3Axuo%3D%2F%2Fdg.grxeohfolfn.qhw%2Fggp%2Fdg%2Fjq%2F%3Brug%3D1520280273846%3F%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.sodlqDg%7Cddg%2Cjdg%3A%3Aho%2Ckl%2Cklg%2Clqi%3A%3Aqhk%3A%3Aqsu%3A%3Avho%3D.des_re_halvw%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Cdg%3A%3Adu%2Cklg%2Cvv%3A%3Aqvvs%3A%3Aqsu%7Csu%3A%3Aid%3A%3Aquiv%3A%3Aqsu&hu=0&g2=0%3A%3A0%3A%3A0%3A%3A0%3A%3A0
Protocol: HTTP/1.1
Server: 52.38.152.125 Boardman, United States, ASN (),
Reverse DNS: ec2-52-38-152-125.us-west-2.compute.amazonaws.com
Software: openresty /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 05 Mar 2018 20:04:38 GMT
Server: openresty
Connection: keep-alive
Content-Length: 43
Access-Control-Allow-Methods: *
Content-Type: image/gif

GET
S 200 mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/ 9 KB
9 KB 6ms
6ms Font
font/woff2 172.217.23.163
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2

Requested by

Host: app-cdn.spot.im
URL: https://app-cdn.spot.im/modules/newsfeed/3.1.426/bundle.js

Protocol

SPDY

Server

172.217.23.163 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s22-in-f163.1e100.net

Software

sffe /

Resource Hash

50dda9aac0fcea362bdda27ae7833240485ad5a20ccc105c1cd13ea26802a8bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans:400,300,600,700,800&subweset=latin,cyrillic-ext,cyrillic,greek-ext,greek,vietnamese,latin-ext
Origin: https://www.denverpost.com

Response headers

date: Thu, 08 Feb 2018 17:56:36 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 21:49:48 GMT
server: sffe
age: 2167682
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303431; quic=51303339; quic=51303338; quic=51303337; quic=51303335,quic=":443"; ma=2592000; v="41,39,38,37,35"
content-length: 8916
x-xss-protection: 1; mode=block
expires: Fri, 08 Feb 2019 17:56:36 GMT

GET
H/1.1 200
OK i
www.i.matheranalytics.com/ 43 B
338 B 109ms
109ms Image
image/gif 52.5.12.45
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.i.matheranalytics.com/i?e=pe&tv=js-2.2.16-c&tna=Mather&aid=v1&p=web&tz=UTC&lang=en-US&cs=UTF-8&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_nolocalstorage=1&tid=2723edd0-497b-4fc7-9e7a-aaa93b74a603&pid=a8687a73-7722-4973-b451-4542168111c3&dtm=1520280281810&qnm=_snaq&vp=1600x1200&ds=1585x5508&vid=1&duid=80b3516d7eba81bd&fp=1684409236&cid=ma23578&mrk=239876503&url=https%3A%2F%2Fwww.denverpost.com%2F2018%2F02%2F26%2Fsamsam-ransomware-virus-cdot%2F&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTUyMDI4MDI3MDY2OSIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiIxNi4xbWIiLCJoZWFwVCI6IjIxLjdtYiIsImZldGNoUyI6IjEiLCJkb21haW5TIjoiMSIsImRvbWFpbkUiOiIxIiwiY29ublMiOiIxIiwiY29ubkUiOiIxNyIsInNzbFMiOiI2IiwicmVxdVMiOiIxNyIsInJlc3BTIjoiMzU0IiwicmVzcEUiOiI0ODIiLCJkb21Mb2FkIjoiMzU2IiwiZG9tSW50ZXIiOiIyMTY0IiwiZG9tTG9hZFMiOiIyMTY0IiwiZG9tTG9hZEUiOiIyMjAwIiwiZG9tQ21wbHQiOiI3MjU5IiwibG9hZFMiOiI3MjU5IiwibG9hZEUiOiI3MjY1In19
Protocol: HTTP/1.1
Server: 52.5.12.45 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-5-12-45.compute-1.amazonaws.com
Software: /
Resource Hash: d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

Referer: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Mon, 05 Mar 2018 20:04:41 GMT
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Content-Length: 43
Content-Type: image/gif

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn.spotim.market
URL: https://cdn.spotim.market/prebid/prebid_loader.min.js?prebid=270443_140

Verdicts & Comments Add Verdict or Comment

308 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

42 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.amazon-adsystem.com/	1970-01-25 11:19:40	Name: ad-privacy Value: 0
.amazon-adsystem.com/	1970-01-18 19:20:24	Name: ad-id Value: A-3szuxoqEPyvcEshngbluY
.outbrain.com/	1970-01-18 14:18:00	Name: recs_cba8b7e7890ff6a1fb657fa95f0e295f Value: 0B1932590557A1922579442A1880289379A1889533496A1324923596A1832935598A460638919A1634770616AC1B1929823368A1930499227A1930502552A1933242052A1934498457A1933499942A1925258700A1927021050ACD1
.outbrain.com/	1970-01-18 14:28:05	Name: _ofcap_DOC1 Value: AG8AZgBjAGEAcAACAAAAAHLcAfoAZAQCQ//CAGQEEe9ggABkBBJhvyAAZAQBiRpqAGQEAYkvaQBkAyHpRgBkBAHx4BEAZAQfgX1iAGQEHkakJgBkBAMUNOsAZARrZjqkAGQEVYxwCwBkBD22oFUAZANwxL8AZAMEMOIAZA==
.outbrain.com/	1970-01-18 23:03:36	Name: _utastes_1 Value: AFUAVABBAFMAVABFAFP/////AQZCAAoBAAAAAAAAP6AACg==
.teads.tv/	1970-01-18 14:19:26	Name: tt_emetriq Value:
.outbrain.com/	1970-01-18 14:28:05	Name: _fcap_CAM4 Value: AHAAZgBjAGEAcAACAAAAADummCQAZAMEn0MAZAMGunsAZAMBOwAAZAJ51QBkAwOmMgBkAzp3WgBkAzz13gBk
.denverpost.com/	1970-01-18 14:18:02	Name: _parsely_session Value: {%22sid%22:1%2C%22surl%22:%22https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/%22%2C%22sref%22:%22%22%2C%22sts%22:1520280274489%2C%22slts%22:0}
.denverpost.com/	1970-01-22 05:58:19	Name: GSIDtUxHTINGb1zW Value: fd26bb7a-fafa-4544-98a7-347a9b0d9b0d
www.denverpost.com/	1970-01-21 03:44:24	Name: ndn_uut Value: 47101b7c-20b1-11e8-8a19-024c3e8e3b03
.teads.tv/	1970-01-18 14:19:26	Name: tt_exelate Value:
www.denverpost.com/	1969-12-31 23:59:59	Name: OX_user_latency Value: 91%2C90%2C88%2C82%2C88
.teads.tv/	1970-01-18 23:02:09	Name: tt_viewer Value: e79d9345-177a-4561-8bda-87fddbea8c27
www.denverpost.com/	1969-12-31 23:59:59	Name: OX_net_latency Value: 57%2C86
.denverpost.com/	1970-01-19 07:49:12	Name: _sp_id.f869 Value: 3cc46bb633deb4bf.1520280272.1.1520280273.1520280272
www.denverpost.com/	1969-12-31 23:59:59	Name: OX_plg Value: pm
.denverpost.com/	1970-01-18 14:18:02	Name: _sp_ses.f869 Value: *
www.denverpost.com/	1969-12-31 23:59:59	Name: OX_BI_TS Value:
.denverpost.com/	1970-01-19 07:49:12	Name: __gads Value: ID=0a31ac0eff60bffb:T=1520280271:S=ALNI_MbmN9tDllpUUAX8yjZ3TJ2Y-yJg8A
www.denverpost.com/	1969-12-31 23:59:59	Name: OX_digitrust_id Value:
.denverpost.com/	1970-01-18 14:18:02	Name: __asc Value: a4a70a4e161f7c3fafbe1f28774
.denverpost.com/	1970-01-18 23:05:02	Name: __auc Value: a4a70a4e161f7c3fafbe1f28774
.denverpost.com/	1970-01-18 14:18:00	Name: _gat_UA-61435456-7 Value: 1
.denverpost.com/	1970-01-19 07:49:12	Name: _parsely_visitor Value: {%22id%22:%22e8ddd4c0-7c00-4f75-907f-40592e26228a%22%2C%22session_count%22:1%2C%22last_session_ts%22:1520280274489}
www.denverpost.com/	1969-12-31 23:59:59	Name: OX_digitrust_id_exp Value:
.doubleclick.net/	1970-01-18 23:39:36	Name: IDE Value: AHWqTUlILa-8dLIBXC6K0Lr-kqp0KzBbj67AJnLdo_M2_Czg6WdO2fEu9o7WbXpp
.denverpost.com/	1970-01-22 05:54:00	Name: optimizelyEndUserId Value: oeu1520280271093r0.9388145189607271
.denverpost.com/	1970-01-18 14:18:00	Name: _dc_gtm_UA-61435456-7 Value: 1
.denverpost.com/	1970-01-18 14:18:00	Name: optimizelyPendingLogEvents Value: %5B%5D
.spot.im/	1970-01-18 14:25:12	Name: spotim-device-v2 Value: d_8IXcuk9zSGPzvoVejKuv
.denverpost.com/	1970-01-19 07:49:12	Name: _ga Value: GA1.2.1585394644.1520280272
.denverpost.com/	1970-01-18 14:19:26	Name: _gid Value: GA1.2.670420000.1520280272
www.denverpost.com/	1969-12-31 23:59:59	Name: OX_BI Value:
.denverpost.com/	1970-01-25 21:36:59	Name: ab.storage.deviceId.8432b72c-1a46-4208-9152-78c3a255ead8 Value: %7B%22g%22%3A%22cb3f1ce2-7211-d6c4-64fc-287d7b1e7f16%22%2C%22c%22%3A1520280271320%2C%22l%22%3A1520280271320%7D
.denverpost.com/	1970-01-22 05:54:00	Name: optimizelyBuckets Value: %7B%7D
.teads.tv/	1970-01-18 14:19:26	Name: tt_bluekai Value:
.denverpost.com/	1970-01-22 05:54:00	Name: optimizelySegments Value: %7B%228268781616%22%3A%22gc%22%2C%228267483531%22%3A%22false%22%2C%228262772133%22%3A%22none%22%2C%228268120246%22%3A%22direct%22%7D
www.denverpost.com/	1970-01-18 14:18:01	Name: OX_sd Value: 1
.denverpost.com/	1970-01-18 23:42:29	Name: __qca Value: P0-575419576-1520280271784
.denverpost.com/	1970-01-25 21:36:59	Name: ab.storage.sessionId.8432b72c-1a46-4208-9152-78c3a255ead8 Value: %7B%22g%22%3A%226bbba8e7-24d9-26b4-5944-fd327674e176%22%2C%22e%22%3A1520282071318%2C%22c%22%3A1520280271319%2C%22l%22%3A1520280271319%7D
.outbrain.com/	1970-01-18 16:27:36	Name: obuid Value: 3f43353d-d0a4-40a1-8694-00a27baa1b8e
www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot	1970-01-18 14:18:03	Name: _vuid Value: 96f3e73c-3cc6-45bb-8dd1-a80ab8c9b220

13 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	(Line 1) Message: Tamara Chuang
console-api	log	(Line 1) Message: Tamara Chuang
console-api	log	(Line 1) Message: Tamara Chuang
console-api	log	URL: https://www.denverpost.com/_static/??/wp-content/plugins/connext-wp-vip/public/js/Connext.min.js,/wp-content/client-mu-plugins/src/Paywall/static/js/connext-paywall-analytics.min.js?m=1519664843j(Line 1) Message: Connext >>>> DEBUG <<<<< init => Initializing CnnXt...
console-api	log	URL: https://www.denverpost.com/_static/??/wp-content/plugins/connext-wp-vip/public/js/Connext.min.js,/wp-content/client-mu-plugins/src/Paywall/static/js/connext-paywall-analytics.min.js?m=1519664843j(Line 1) Message: Connext >>>> DEBUG <<<<< Core => getZipCode
console-api	log	URL: https://www.denverpost.com/_static/??/wp-content/plugins/connext-wp-vip/public/js/Connext.min.js,/wp-content/client-mu-plugins/src/Paywall/static/js/connext-paywall-analytics.min.js?m=1519664843j(Line 2) Message: CONNEXT VERSION IS 1.10.3
console-api	log	URL: https://www.spot.im/launcher/bundle.js(Line 7) Message: Spot.IM Launcher version 3.1.426 deployed at Sun Mar 04 2018 13:52:48 GMT+0000 (UTC)
console-api	error	URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js(Line 1) Message: Exception in queued GPT command
console-api	error	URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_184.js(Line 1) Message: Exception in queued GPT command
console-api	log	URL: https://www.denverpost.com/2018/02/26/samsam-ransomware-virus-cdot/(Line 2) Message: CMD
console-api	log	URL: https://app-cdn.spot.im/modules/essential/3.1.426/bundle.js(Line 23) Message: Spot.IM Essential Module version 3.1.426 deployed at Sun Mar 04 2018 13:52:59 GMT+0000 (UTC)
console-api	log	URL: https://app-cdn.spot.im/modules/prerender/3.1.426/conversation/host/host-bundle.js(Line 17) Message: Spot.IM Conversation Module version 3.1.426 deployed at Sun Mar 04 2018 13:55:12 GMT+0000 (UTC)
console-api	log	URL: https://app-cdn.spot.im/modules/newsfeed/3.1.426/bundle.js(Line 29) Message: Spot.IM Newsfeed Module version 3.1.426 deployed at Sun Mar 04 2018 13:56:35 GMT+0000 (UTC)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob:; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8276234126.log.optimizely.com
a.teads.tv
aax.amazon-adsystem.com
ad.doubleclick.net
adservice.google.com
adservice.google.de
ajax.googleapis.com
app-cdn.spot.im
assets.digitalfirstmedia.com
at1.listrakbi.com
c.amazon-adsystem.com
c.newsinc.com
cdn.connatix.com
cdn.listrakbi.com
cdn.optimizely.com
cdn.spotim.market
cdn.teads.tv
cdn3.optimizely.com
cdns.connatix.com
certify.alexametrics.com
cm.g.doubleclick.net
connect.facebook.net
d1z2jf7jlzjs58.cloudfront.net
d2lv4zbk7v5f93.cloudfront.net
d31qbv1cthcecs.cloudfront.net
dev.appboy.com
digitalfirst-d.openx.net
dsp.adfarm1.adition.com
extras.denverpost.com
fonts.googleapis.com
fonts.gstatic.com
freegeoip.net
images.outbrain.com
images.spot.im
insight.adsrvr.org
jadserve.postrelease.com
js.appboycdn.com
js.matheranalytics.com
launch.newsinc.com
log.adap.tv
log.outbrain.com
match.adsrvr.org
maxcdn.bootstrapcdn.com
nexus.ensighten.com
odb.outbrain.com
onescript-recscont.listrakbi.com
pagead2.googlesyndication.com
ping.chartbeat.net
pixel.quantserve.com
pixel.wp.com
recirculation.spot.im
rules.quantcount.com
s.ntv.io
s.w.org
s1.listrakbi.com
sb.scorecardresearch.com
secure.quantserve.com
securepubads.g.doubleclick.net
srv-2018-03-05-20.config.parsely.com
srv-2018-03-05-20.pixel.parsely.com
static.chartbeat.com
stats.g.doubleclick.net
stats.wp.com
sync-tm.everesttech.net
sync.adap.tv
sync.adaptv.advertising.com
sync.mathtag.com
sync.search.spotxchange.com
sync.tidaltv.com
t.teads.tv
tpc.googlesyndication.com
track.spots.im
vcore.connatix.com
widgets.outbrain.com
www.denverpost.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.i.matheranalytics.com
www.spot.im
www.summerhamster.com
cdn.spotim.market
104.20.50.244
104.25.149.25
107.178.250.234
151.101.113.130
151.101.113.53
151.101.114.107
151.101.114.2
151.101.114.202
151.101.114.49
172.217.18.2
172.217.22.10
172.217.22.14
172.217.22.2
172.217.22.3
172.217.22.4
172.217.23.161
172.217.23.162
172.217.23.163
172.217.23.166
172.217.23.168
173.241.240.220
185.29.135.181
185.60.216.19
185.60.216.35
185.94.180.125
192.0.66.2
192.0.76.3
192.0.77.48
2.18.233.186
2.18.234.163
2.18.234.190
2.18.234.227
2.18.234.64
2.19.43.224
209.197.3.63
216.137.61.227
216.137.61.62
216.58.214.42
34.194.12.155
34.197.188.11
34.226.60.227
34.231.175.253
34.236.182.108
34.239.50.116
35.157.8.66
50.17.242.191
52.3.86.250
52.38.152.125
52.48.203.249
52.5.12.45
52.5.130.242
52.5.76.191
52.6.36.75
52.7.208.137
52.70.27.99
52.85.184.15
52.85.184.252
52.85.184.73
52.94.218.7
54.154.35.241
54.164.16.198
54.204.38.141
54.230.92.79
54.230.93.112
54.72.119.233
54.72.25.143
54.77.170.180
54.77.82.250
66.102.1.157
74.201.198.92
85.114.159.93
94.31.29.16
94.31.29.250
95.172.94.13
95.172.94.21
95.172.94.35
04bdc32a9dfdf8c4ae18d1490887ecc9a96fa169e37cc6829e0d730eff68aa17
0517c66a6ea7f6838297f943858762cc1e6aee028daca5f09ab3a51ba874ed7d
083d35e9cedf55e27713ed31f05f0a0a3c6e10b57a58863d7db7308983d529d4
08ca8cc0a09b2fc94fc1b7189f7cdc31716ce0d0694e9cfdb63ce941137d65c4
09af2f4683ff34575485ca709d03d5fc5ab6cf330aecb7e0f20bc077fe997af5
0bfe338b42b2f3a8b4eddd75ab503ce19d504dfbb3c89703527658ae264261d5
0ec04bfe055b86ca4c19144f81aebc2aecef5a07ce707faa46af08991ef6809e
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
125530e064888934c27b070a751bb201ff46bb2c19236ec0bb5904af19323e97
1548df29ed135b0d6b69ce8959cd2d8a975272d552f8da1bdb83c1bb628f2ee2
1561317977e581c66b370d63a2b3a33cd4dd012b572867960f06c541ffac9064
1577be668ac0c5ee9609039b1c15cd4c3ccd494fedf8e793563594b003660a64
15bd316b58cb6d60f70ee592ff5e60b43d1375149c69d6946da4d5bd0a677d19
1614f0cef6ccd70588e729d301766ef768f1aeaa1d93c2299f0f7654e5baa6f0
163e7e45661d055db356a58996759599ebbd1618f759d72910758b6c75d81cfa
182abb62bdb40059dbda691bf6631cf6b471499a85971a5fd04832453d7b4141
1bd07598a025bc051a20af4f9ebbbbf7cd6b48f9d4044cc00260289d21f08ecf
1cade4a90fc4abcc3e2880a62c06b30e0e1588981c88a1f9186e7307bba45279
218ed570a598ad8820ebf94fdb0c29243daee25a643490493dc72a0ff54c8051
23a1a8123c5cfb9df1063c6cfbab2b7bb80fe645d6e7158baacbea022a81e2a0
2465f67342841d5db9f96c3ec1d4428c00e6d62c10424d6f9262403d599e9e92
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
2590d66919bcebebcab8820a8e98a672c795c718f39f53d1c62cdd26ced8660b
29001964c73b80381ab43142b3d2371025e8ce2a43b1b8d4630d5db19f3b4ff0
29451fb716c05b025bfb8a468767f7112baad0112dbc512d1610f64dbbad4bc0
29682278a8e5675c8cda93d2bf3debc501059652c3c7479490e33786d5b295bb
2b91cdc25ce3367fcb582096d46f67158300f452b14b5975c02bd071799937d8
2bdc6c730d94a6bc1ea01da4299b3ee21fd8c2fb663e9db57369b78c902c0b7d
2e62791314793c102e9950724a89245d603380c83d42cc2785378e6bc0078672
2ee2237bac85687238733d5bba227eb04b9c34ed4d817c21527cb7012316aa38
30aad5d987fdb5c9a4aa104dd98d6e6a69d4dbe81d26716c98b6c466a2f3caef
323075a1922843a6c7f5371bc7fa55500b77944f1268d83461964e3906942141
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
34157cae4b5a2a19a7883039e5da0dd39687a0ba23b8fa78ad918fdb93b18658
37b9e02b97d23ed896aeca78b49babae4316f72db0b105d91b0e9712a580afcf
3d8e94fed6cc8ea56ee5ec6174efb68cb7197d2e729149cb43e85505bf175779
3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82
40d3161773774e4310edeeed63150f24fd9a64eaa3882649fc26f4f722b818f0
412a16c7fd20f47028cca3bfa3a60008d194b7bdcc44d838b29d56205f8cabc1
4250093df42f46cf162116438da0d35481c9a3c54ec34cbb7ddb3e6b7a1ae20e
43a5480be163a10c4036b989e340a168aaea8a3ad062d95d589ec3e9651d340f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4705ae5a35f26014edd9e68cb469a0e7b48532f065c906609d4c22102371ec20
47550fb9f11c96bd159a2a7247dcb5556ede4e104052dec014f95f61e0696dd9
4837d45d900563b337ae12af4698866274b7ac82098754cebc591be8835d2e6f
485833c5264caac8f7c0a69f37f92c70b1371588293969928275d31e1bac85aa
486e7061a989cf1c6834390c0fdc9a8d181f9179efe68fe8c35c254ff2d49de6
487aec7746a83542b3573383df65747e31c494d8412103b5675329f3d4befaeb
4a58441133d85539974e4b136c25eaa5512ac1b018d4f6d53124a08c6f19b55e
4fc9aac150f1d74588d78689bc1edd7132d7fb7c490ebb2ae6ad4065a0048cd1
50dda9aac0fcea362bdda27ae7833240485ad5a20ccc105c1cd13ea26802a8bd
52067cb8c17e70aa0eb89ee87e2156579df49e376fc2450af85e3964b3c953a2
52f35b7f628b93dd17c3e40714ecd702bcba145ef3f1a4b537c35d81d0c472fa
53fb71cd471c609fb8ac9e06dcf3f337b79d3c3eeb92666b5de1d16c72023b04
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
547ea67155dac1c27efb550426c4848b7364357ed040fd531719c4797e356a1d
562d5cfee4e51ada23bce977138975b55ebc5373e94674ba94610fca655d05f1
57b4db8e04f917ceebdda97a6edcc37ccaa415f5a948cf522d7f58457c1128b3
597a1d464d0f871e6d60e1689b29e0bb8bb6877086c2f45bcd68d516004f4fe9
5b521ba4f973ebc7db53634576a6ba801e41df2c84be5cd9c3ee50e9f2cda286
5b58353c6803afc16620ea7acab92824f084e8a93e2dffb18a53c10dcb89ca30
5c8c495016572ba460b4bf0099398fb114114a1f1ea52585cab4f5259bad751a
5e64ac0eae117c38b3a8efb18ec4655a2226a35ee6db7e207d062c8cd5934b1c
5fc2eeb9c92c8c5a1512c1be6768578e948f31c20b19e6409eaceb3b72112ab4
64c5e627d2faf4c759b23f188c25f2af79ea73e522d8b73b71242131c6d3534a
65a01d4df9fe556adcbdfd0f5feeedcce739854cd808d46767eb02b095bc254b
69db17c06068efb64040c2e98d0b2c5359d294fa37475dcef9e828a6a3f05ac2
6a404f237f78fc8eefdc0e09e61ef8cec67226b3627f3dc338afaf380745b188
6a52dd58d7afae1b6bb657cbe920e39e8bad4b789b9f7a726bb499ffa34c966b
6b0b4a47e143da5c4a268e87b4dd52673f7a9694c7a24aac104b0d74051b3470
6b3efc350a2371caf6924eab9feda1db394ab5111373adb75227426da4e88405
6c1ea45333a28a1704889705502fb72cb581e3f572fe42fc3e54fd8c295918f0
6eeb088fc5152383f9e6204063cd4da6a863a071c6b64ffbf5e979cd7b6bffae
704e5b4e16a03a815bc09d24b6dfc267ba8bdc2ecdbdc57b60bb0b71ff46e077
725913eab3460e2955a8ac4ec176f902c7d8d2db60757248b735cbf8698b0749
730bc7510aefdabb4124b6bb3942ab8e3aba39b30a5f5af425545d8eefbc5e4e
751c41eb180020782ad563c6ab215129708dcb9a5dde34b0df55c18dec12c90b
77d110c320f166ae8e2ab66a60edf193290b9b6bd778ef118ea088b508ff4214
78ea7db0363e798c2a6f5ee4790d673892e43ecbf84e5eab1ab44fdb23a934b1
79a00e3f660aa62e7380afa42b0053b2e4f96e85da42b3079440d4ad844eb5d2
7a0f7fb4389375f867dbe1a0b37c434225fd8902ec49c5de0416727e6ee31d45
7cf9f1b809e02b135c7d88f5aca64d40a4bbea3cc31bf3aa9433cf3f6e03adb9
7e7fa886d5d75c745d95be4fc3c5bfb4c988019b3f643c669734612345e1b8c8
7f3f1a2ea3869b97e7474310f746d6aa23e2e6ee9487ac1cd8e8ceed7b55f640
7f85b617b0bd55f3774a3d9e8a671ccbca7f1ba73813a7d32b73ef98421e4601
7fdd6797e615c3d6afc366b036e144c16c0f7d59fe30b8a236f2d58b74c2fc16
81063cc513fedda9f3ab6efa9de827e22909f2cc59dacb2177348b19603cb381
81751d6c2faecdb9f793f25b2417277a01dcbae6d147622b8b6fcad7a4835af9
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
858c43f311dc3adb895f69ee9e3fbed55e6dc98c83ac0f2af877ad43ce23b017
8594a0441a676da2f70511fa1b19ffcf7643ec6fb3fb2bb37a9528ef64d89ff8
86e27f2a8a6f68f90a2c99a3f046c86cf1dc25adfd9b627b2a9be3ed4737c625
86f892b2ffb50310d8240890df542d93557460b31f24e8d4dd7fe07cd1decec5
8868d2a2f803ea6802d54a11564b5b96c7d8be56117a328c8f605539d6dee167
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8ba355d714c3387de480eaf201e6ea065f1466ce2f963fde40d34b6410087e32
8dad82bedbd4c26f75940481e5d3c8ffd1c086e45dd59b227168e96b51d0e5cc
8e05e08f4ae9dfa47d3c90cd92afbf05c43bed13dfcedff400f75c5173d7cf16
8f5500bab5fdb15e1fa70b4c5e8bae7d20fed96dd8c5ae3615319922406da9b2
8fb45fa7cbce9e96b885cd517f799ab1f68b2e37ca11c5cfcc234849c0d5961a
90971b5abba8fb8482d192a07c1b51397eeacf3351e01bcf58fec3f0b8775cd0
92435a4a10e3d120575b993d5db983a320c2af0c847cad3d271587d7f1cf4149
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
953cb1f9b05c01dd9777e4823dcd66730cac5298f574ad907308791a96255b9c
9564266456b02754747f006be329e9ace42197e094f887bcb2f9211ac411b586
95a2b3352f45ad7a28052ba8a142b8694e52cef35865312161bcd9cc73bbeccf
95b6fcde6bda58219b57d536498f7b72f63da803f130feb7cdb57878cc204600
9646f432a47705aeb0df4e23a0b13a94c205b366ca544dd3f0b7061339881e6f
9c41ba408efaf3a7a36099370bc814e38b0afd42229fa9e0e6040740620c85c0
a0066433a645f196eb0ece299c86dc27a5c74dbe2cae7ae6d9211c1549a92085
a04a6a31c8b13c7820942e036b00df1c4d59ef54f7892f5a0427c80ee78e8729
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0f7ad40a8b8b9df70709defea63709286ca0b6d6c2efe903bcf1aca308fedaf
a103eebda6a5fd876ce289fea770859bddb5f68f8aa5aa10a656a8aaac5a49ac
a83fa7f104f5d300666fa6a3dc0934f009347baa77b9c0caaf7b34bb58f66954
ac4e30b367a727a36c9c5f3f66053539a155ccbb0b935da5cd8fd34019d018e1
aea0c8ddd84132838fcee935f9d827ec5f7ba116e443b25db7a5bcc944cbe914
aeab0cb3b2befe450ee7ac64e48ace5ade48bfb66e5cf227384f490fbe69630c
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
af39052168c97b7c55a3e184a79d70609abd2cf78f7dc808ea3584b1f7bc240a
b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
babf6bf06610b17476f36a9cc4ef902267a10ebba74946bf03f2c36b673b2013
bc9ff628bc157259ffe80521c6748edbb30b7fc2abaa40d6c8f3c7983f6d03e1
bd359961893d4b15ab12208619238cb7049df9932f9c3a64318f3fb1b8211620
bd9c106f65aa25948ddc3c22100f0d8fc948e6ed0cadce73398446cf5827ff46
c158a2bcacfc15d0d404b9597a0d7c97f328c28aa3d4e53c483a4486289ca25a
c3877658122025a9863287cce38aefe65e886847551c5c745c7d225ab3eebc34
c838662f89269e6862c0d4c69e78f9485ab1fe5cd0bf60a5f76d06057afde667
c875abb472a9f41c06aaa1dec92ff397185f65b49a2ece9259263d64b4f77f3c
ca19741acaa61449f33108c4210ac2abf832b5e2daf9e6bc1af928f788ac9044
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cb2acf2bc5707f8d22c6e9700eb66a7e83d9815ceeddd6f64165445f7a497b53
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d133ba6c3606f15996eaecffe9eb3ac1341711db1f4a1851a72b7c619d6b95b9
d45a16ca8762ec5e2a69b5caedbb437b59bf2072814a0ac61103fe7cbcae9054
d4dcf0e52bfc6fe5b8c7e58ebb65e54ae23bc46674943ac4ae48d6b53a032bb4
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc
daeb0d0d8a07b94afc37fbcda2fa218ce20eeec575dfb1b3a8859017a3aeec5e
de6a4a38d6998a17e74b00606a650dc0de1e1a33878bb381badcff1d4b95d67d
e1b8e258788f759b3f38ba4bfee951217e59ac1a532c305ded9fdb7cdf8e918b
e29e9492510632ea5536cc7b835e38ec441095e03f836d82ffd28963a562d3b8
e2b48061f14ab4b9f7cef3f8f4de4da920c65cf1a9b59a7bde6f9c36c7ca0d24
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e5f1b54da88912b1c3881a137cd47c0364ba9d742fe22ab71b0354bb6e625a17
e6afea598f1cab44154130591cfc7e0ce00a3fc1a0b044fafba26aa14bd13a65
e98bf0cf17e55c8aa922f559a2ebff8ad12c31894fd14ba5c738b9c003965b9f
eae1bcf059a36b33197a3211a7c97df71d65ed8c59623447cb80314d128f9991
eb87a730f99fe7cdee95a385a3dc62fbf5d67ff25b5564772ce4052f5c8c138c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0a053755f5f593524486a03b129fcfaab015a49829c1e4e63a7698eb5a2dc7d
f17c52d128492e3041982fb68e8aef913b60dacdffae62cb260af2a67eaec603
f19e1879e142f3e71c4610bd7939580284170bc4392629d4927370ac18b92b4d
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f5044bb9a4c901d608d6c4f3fc8602b9d95ff62977664876dc3d5088e671adfa
f7768deb40345f0798acf1dd6c0baa61a8559ae598a4102df35f678243fd8d15
f8cfbc9e5f7ee24d999fcb6402b0ca7fec7977a0fe629ee2c6d189d57e657edb
f8ef655ef916e39713ede9c6db56d7ca5618bd82cf5ac991dcd013f05e0fdfc7
f989559987f22456d88cea6c4f9cdb00f6921a23de45b217fd98000a51045dbc
fc2fa9c1c783bc0db2e22ac096ea88744498c19a202d7d44eecb78a951f492d3
fcc6715e9b73cb3c1c1b8042fb590efc76697e6187fcada5c5315180252f98d8
fe1fd2390971d20586c515c99cbdf53ed0f3a9e4ddb091222dfafeae3a5eabff
fe32c9921874b35b87acb0a3b558784ca7b9fed91ed34c1d2a68b6566c9d09be
fe4b3126024ae26e4dd61ff70ca74e4f38a4523958eaf987021f7f4ba7ea0f81
ff8789fd23d4f52bad228f345b4340e6d3d7ece437cf5d1e232ba1ea381204ee

www.denverpost.com Open in urlscan Pro 192.0.66.2 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

277 Requests

7 %HTTPS

0 %IPv6

51 Domains

84 Subdomains

68 IPs

6 Countries

3438 kBTransfer

11296 kBSize

42 Cookies

45 Outgoing links

Redirected requests

277 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.denverpost.com Open in urlscan Pro
192.0.66.2 Public Scan

Screenshot
Live screenshot

Full Image

277
Requests

7 %
HTTPS

0 %
IPv6

51
Domains

84
Subdomains

68
IPs

6
Countries

3438 kB
Transfer

11296 kB
Size

42
Cookies

277 HTTP transactions
2 data transactions