urlscan.io logo urlscan.io
SecurityTrails logo

www.varonis.com Open in urlscan Pro
45.60.154.169  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://t.varonis.com/t/11475/c/06fc3d75-4466-4db5-a5f2-d9fc4db02fa2/NB2HI4DTHIXS653XO4XHMYLSN5XGS4ZOMNXW2L3CNRXWOL3EM...
Effective URL: https://www.varonis.com/blog/darkside-ransomware/
Submission: On September 22 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 29 IPs in 4 countries across 25 domains to perform 89 HTTP transactions. The main IP is 45.60.154.169, located in United States and belongs to INCAPSULA, US. The main domain is www.varonis.com.
TLS certificate: Issued by GlobalSign Atlas R3 DV TLS CA 2020 on July 28th 2021. Valid for: 6 months.
This is the only time www.varonis.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 3.209.22.10 14618 (AMAZON-AES)
1 1 100.25.67.184 14618 (AMAZON-AES)
7 45.60.154.169 19551 (INCAPSULA)
1 104.16.19.94 13335 (CLOUDFLAR...)
34 35.239.147.27 15169 (GOOGLE)
7 92.122.244.59 20940 (AKAMAI-ASN1)
1 104.111.215.74 16625 (AKAMAI-AS)
4 152.195.15.58 15133 (EDGECAST)
1 13.224.193.108 16509 (AMAZON-02)
2 157.240.236.1 32934 (FACEBOOK)
2 216.58.212.168 15169 (GOOGLE)
1 142.250.186.142 15169 (GOOGLE)
2 104.17.211.204 13335 (CLOUDFLAR...)
1 23.41.169.41 16625 (AKAMAI-AS)
1 23.111.9.64 33438 (HIGHWINDS2)
1 104.18.21.191 13335 (CLOUDFLAR...)
1 104.17.236.204 13335 (CLOUDFLAR...)
1 104.17.68.176 13335 (CLOUDFLAR...)
2 3.219.76.19 14618 (AMAZON-AES)
3 142.250.185.142 15169 (GOOGLE)
1 142.250.186.34 15169 (GOOGLE)
5 216.58.212.132 15169 (GOOGLE)
2 104.19.155.83 13335 (CLOUDFLAR...)
1 13.225.78.2 16509 (AMAZON-02)
2 2 52.16.214.249 16509 (AMAZON-02)
1 2 13.225.78.109 16509 (AMAZON-02)
1 35.244.174.68 15169 (GOOGLE)
1 104.19.154.83 13335 (CLOUDFLAR...)
2 157.240.236.35 32934 (FACEBOOK)
1 142.250.186.162 15169 (GOOGLE)
1 74.125.206.154 15169 (GOOGLE)
1 2 108.174.11.37 14413 (LINKEDIN)
1 1 13.107.42.14 8068 (MICROSOFT...)
89 29
1    3.209.22.10 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-209-22-10.compute-1.amazonaws.com
t.varonis.com
1    100.25.67.184 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-100-25-67-184.compute-1.amazonaws.com
app.salesloft.com
7    45.60.154.169 (United States)

ASN19551 (INCAPSULA, US)
www.varonis.com
consent.varonis.com
1    104.16.19.94 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
34    35.239.147.27 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: 27.147.239.35.bc.googleusercontent.com
blogvaronis2.wpengine.com
7    92.122.244.59 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a92-122-244-59.deploy.static.akamaitechnologies.com
use.typekit.net
1    104.111.215.74 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-74.deploy.static.akamaitechnologies.com
p.typekit.net
4    152.195.15.58 (United States)

ASN15133 (EDGECAST, US)
cdn.bizible.com
cdn.bizibly.com
1    13.224.193.108 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-108.fra2.r.cloudfront.net
tag.demandbase.com
2    157.240.236.1 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-02-frx5.fbcdn.net
connect.facebook.net
2    216.58.212.168 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra24s01-in-f8.1e100.net
www.googletagmanager.com
1    142.250.186.142 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f14.1e100.net
cse.google.com
2    104.17.211.204 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hs-scripts.com
js-na1.hs-scripts.com
1    23.41.169.41 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-41-169-41.deploy.static.akamaitechnologies.com
snap.licdn.com
1    23.111.9.64 (United States)

ASN33438 (HIGHWINDS2, US)
scout-cdn.salesloft.com
1    104.18.21.191 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hs-banner.com
1    104.17.236.204 (None, )

ASN13335 (CLOUDFLARENET, US)
js.usemessages.com
1    104.17.68.176 (None, )

ASN13335 (CLOUDFLARENET, US)
js.hs-analytics.net
2    3.219.76.19 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-219-76-19.compute-1.amazonaws.com
scout.salesloft.com
3    142.250.185.142 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f14.1e100.net
www.google-analytics.com
1    142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net
www.googleadservices.com
5    216.58.212.132 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f4.1e100.net
www.google.com
2    104.19.155.83 (None, )

ASN13335 (CLOUDFLARENET, US)
api.hubspot.com
1    13.225.78.2 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-2.fra2.r.cloudfront.net
api.company-target.com
2    52.16.214.249 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-214-249.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
2    13.225.78.109 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-109.fra2.r.cloudfront.net
segments.company-target.com
1    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
id.rlcdn.com
1    104.19.154.83 (None, )

ASN13335 (CLOUDFLARENET, US)
track.hubspot.com
2    157.240.236.35 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-02-frx5.facebook.com
www.facebook.com
1    142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net
googleads.g.doubleclick.net
1    74.125.206.154 (United States)

ASN15169 (GOOGLE, US)
PTR: wk-in-f154.1e100.net
stats.g.doubleclick.net
2    108.174.11.37 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-11-37.fwd.linkedin.com
px.ads.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.linkedin.com
Domain Requested by
34 blogvaronis2.wpengine.com www.varonis.com
blogvaronis2.wpengine.com
7 use.typekit.net www.varonis.com
5 www.google.com cse.google.com
4 www.varonis.com www.varonis.com
3 www.google-analytics.com www.googletagmanager.com
cdn.bizible.com
3 consent.varonis.com www.varonis.com
blogvaronis2.wpengine.com
cdn.bizible.com
3 cdn.bizible.com www.varonis.com
cdn.bizible.com
2 px.ads.linkedin.com 1 redirects
2 www.facebook.com
2 segments.company-target.com 1 redirects
2 match.prod.bidr.io 2 redirects
2 api.hubspot.com cdn.bizible.com
2 scout.salesloft.com scout-cdn.salesloft.com
cdn.bizible.com
2 www.googletagmanager.com www.varonis.com
2 connect.facebook.net www.varonis.com
connect.facebook.net
1 www.linkedin.com 1 redirects
1 stats.g.doubleclick.net cdn.bizible.com
1 googleads.g.doubleclick.net www.googleadservices.com
1 track.hubspot.com
1 js-na1.hs-scripts.com js.hs-analytics.net
1 id.rlcdn.com
1 api.company-target.com cdn.bizible.com
1 cdn.bizibly.com
1 www.googleadservices.com www.googletagmanager.com
1 js.hs-analytics.net js.hs-scripts.com
1 js.usemessages.com js.hs-scripts.com
1 js.hs-banner.com js.hs-scripts.com
1 scout-cdn.salesloft.com www.varonis.com
1 snap.licdn.com www.varonis.com
1 js.hs-scripts.com www.varonis.com
1 cse.google.com www.varonis.com
1 tag.demandbase.com www.varonis.com
1 p.typekit.net www.varonis.com
1 cdnjs.cloudflare.com www.varonis.com
1 app.salesloft.com 1 redirects
1 t.varonis.com 1 redirects
89 36
Subject Issuer Validity Valid
imperva.com
GlobalSign Atlas R3 DV TLS CA 2020		 2021-07-28 -
2022-01-27		 6 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-09-21 -
2022-09-20		 a year crt.sh
*.wpengine.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2021-08-03 -
2022-09-03		 a year crt.sh
use.typekit.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-08-16 -
2022-08-16		 a year crt.sh
*.typekit.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-16 -
2022-07-21		 a year crt.sh
io.bizible.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-06-30 -
2022-07-05		 a year crt.sh
tag.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2020-10-14 -
2021-11-15		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-07-03 -
2021-10-01		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
*.google.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA		 2021-04-30 -
2022-05-11		 a year crt.sh
salesloft.com
Sectigo RSA Domain Validation Secure Server CA		 2021-03-10 -
2022-04-09		 a year crt.sh
www.googleadservices.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
www.google.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
hubspot.com
Cloudflare Inc ECC CA-3		 2021-06-26 -
2022-06-25		 a year crt.sh
api.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2020-10-09 -
2021-10-28		 a year crt.sh
*.company-target.com
Amazon		 2021-08-31 -
2022-09-29		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2021-02-25 -
2022-03-28		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA		 2021-09-16 -
2022-03-16		 6 months crt.sh

This page contains 2 frames:

Primary Page: https://www.varonis.com/blog/darkside-ransomware/
Frame ID: 69D07D7700259EBD6822842445567B00
Requests: 87 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 137FC091526F66BAD577F65BAB62B1F8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Return of the Darkside: Analysis of a Large-Scale Data Theft Campaign

Page URL History Show full URLs

  1. https://t.varonis.com/t/11475/c/06fc3d75-4466-4db5-a5f2-d9fc4db02fa2/NB2HI4DTHIXS653XO4XHMYLSN5XGS... HTTP 302
    https://app.salesloft.com/t/11475/c/06fc3d75-4466-4db5-a5f2-d9fc4db02fa2/NB2HI4DTHIXS653XO4XHMYLSN5XGS... HTTP 302
    https://www.varonis.com/blog/darkside-ransomware/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
  • wp-embed\.min\.js\?ver=([\d.]+)
Overall confidence: 100%
Detected patterns
  • mootools.*\.js
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • js\.hs-analytics\.net/analytics
Overall confidence: 100%
Detected patterns
  • /_Incapsula_Resource
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

89
Requests

100 %
HTTPS

0 %
IPv6

25
Domains

36
Subdomains

29
IPs

4
Countries

2243 kB
Transfer

3720 kB
Size

37
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.varonis.com/t/11475/c/06fc3d75-4466-4db5-a5f2-d9fc4db02fa2/NB2HI4DTHIXS653XO4XHMYLSN5XGS4ZOMNXW2L3CNRXWOL3EMFZGW43JMRSS24TBNZZW63LXMFZGKLY=/www-varonis-com-blog-darkside-ransomware HTTP 302
    https://app.salesloft.com/t/11475/c/06fc3d75-4466-4db5-a5f2-d9fc4db02fa2/NB2HI4DTHIXS653XO4XHMYLSN5XGS4ZOMNXW2L3CNRXWOL3EMFZGW43JMRSS24TBNZZW63LXMFZGKLY=/www-varonis-com-blog-darkside-ransomware HTTP 302
    https://www.varonis.com/blog/darkside-ransomware/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 72
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
  • https://segments.company-target.com/log?vendor=choca&user_id=AADqh07ClvwAACE7FbeOjQ HTTP 303
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AADqh07ClvwAACE7FbeOjQ&verifyHash=8147e17386052684b483d2c224f383189c3f829d
Request Chain 83
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=23300&time=1632337458307&url=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D23300%26time%3D1632337458307%26url%3Dhttps%253A%252F%252Fwww.varonis.com%252Fblog%252Fdarkside-ransomware%252F%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=23300&time=1632337458307&url=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F&liSync=true

89 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.varonis.com/blog/darkside-ransomware/
Redirect Chain
  • https://t.varonis.com/t/11475/c/06fc3d75-4466-4db5-a5f2-d9fc4db02fa2/NB2HI4DTHIXS653XO4XHMYLSN5XGS4ZOMNXW2L3CNRXWOL3EMFZGW43JMRSS24TBNZZW63LXMFZGKLY=/www-varonis-com-blog-darkside-ransomware
  • https://app.salesloft.com/t/11475/c/06fc3d75-4466-4db5-a5f2-d9fc4db02fa2/NB2HI4DTHIXS653XO4XHMYLSN5XGS4ZOMNXW2L3CNRXWOL3EMFZGW43JMRSS24TBNZZW63LXMFZGKLY=/www-varonis-com-blog-darkside-ransomware
  • https://www.varonis.com/blog/darkside-ransomware/
77 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.154.169 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
nginx / WP Engine
Resource Hash
20b827ee733970c15c0f1e933be3a7a14a7b02b81f005ad320b2a9578b04eacb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.varonis.com
:scheme
https
:path
/blog/darkside-ransomware/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

server
nginx
date
Wed, 22 Sep 2021 19:04:16 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
link
<https://www.varonis.com/blog/wp-json/>; rel="https://api.w.org/" <https://www.varonis.com/blog/wp-json/wp/v2/posts/15259>; rel="alternate"; type="application/json" <https://www.varonis.com/blog/?p=15259>; rel=shortlink
x-powered-by
WP Engine
x-cacheable
SHORT
cache-control
max-age=600, must-revalidate
x-cache
HIT: 1
x-cache-group
normal
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-encoding
gzip
set-cookie
visid_incap_2074238=PHPZFnyLTE2NpH+eyjeotC9+S2EAAAAAQUIPAAAAAAASak6biLJaRv+LDng1n5+f; expires=Thu, 22 Sep 2022 14:04:00 GMT; HttpOnly; path=/; Domain=.varonis.com; Secure; SameSite=None incap_ses_474_2074238=BV/LMslp8jd7v4007/yTBi9+S2EAAAAAFIwxK4wPDlwgW/VvkWwX+A==; path=/; Domain=.varonis.com; Secure; SameSite=None
strict-transport-security
max-age=31536000; includeSubDomains
x-cdn
Imperva
x-iinfo
8-76977208-76977209 NNNN CT(121 287 0) RT(1632337455225 0) q(0 0 4 0) r(5 5) U12

Redirect headers

Cache-Control
no-cache
Content-Type
text/html; charset=utf-8
Date
Wed, 22 Sep 2021 19:04:15 GMT
Location
https://www.varonis.com/blog/darkside-ransomware/
Strict-Transport-Security
max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
Vary
Origin
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-Request-Id
9349811ad570d2de30167f3b53fe03ed
X-Runtime
0.045362
X-XSS-Protection
1; mode=block
Content-Length
115
Connection
keep-alive
modernizr.min.js
cdnjs.cloudflare.com/ajax/libs/modernizr/2.8.3/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/modernizr/2.8.3/modernizr.min.js
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.19.94 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2b82e612d2a812e8be2a57300dab8923c4f2edbe7a799e7da70791b595646fe
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:16 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
4550
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
3980
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:13:26 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03f26-2b4c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xnivX9dfs79EfoZoqhq%2Fk4f0CGkdAF7AsHrfjKUl%2FMrqGmMVQpJ1QJ9KEp%2FCWTLk6CFTaQibTJ9ucGGejl3zgO7V1gxVPQY%2FmncrcrvQ3E1aSNgDivZsnlVGppKZV6QyR7tNodgY"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
692dcc4f491b5c02-FRA
expires
Mon, 12 Sep 2022 19:04:16 GMT
styles.css
blogvaronis2.wpengine.com/wp-content/plugins/better-click-to-tweet/assets/css/ 		2 KB
786 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/plugins/better-click-to-tweet/assets/css/styles.css?ver=3.0
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ac588a22069fd96f7979ef0eb66728f0c45d9594c49bea515afe79d229591cdd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:16 GMT
content-encoding
br
last-modified
Wed, 24 Jul 2019 19:48:32 GMT
server
nginx
etag
W/"5d38b610-809"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
youtube-shortcode.css
blogvaronis2.wpengine.com/wp-content/plugins/youtube-shortcode/ 		1 KB
676 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/plugins/youtube-shortcode/youtube-shortcode.css?ver=5.8
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
5d6078edf0103c72f5583f76ae5b32637240e648a2a38a093bd16423c658ba28

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:16 GMT
content-encoding
br
last-modified
Wed, 10 Apr 2019 17:02:17 GMT
server
nginx
etag
W/"5cae2199-50b"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
genericons.css
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/genericons/ 		28 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/genericons/genericons.css?ver=3.4.1
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:16 GMT
content-encoding
br
last-modified
Wed, 10 Apr 2019 17:02:17 GMT
server
nginx
etag
W/"5cae2199-6e6a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
font-awesome.css
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/css/ 		37 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/css/font-awesome.css?ver=4.7.0
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
2a6e2fd26469cea471cc4bf0df35a98e15ea1f03a516045612c78b6f008b3241

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:16 GMT
content-encoding
br
last-modified
Wed, 10 Apr 2019 17:02:16 GMT
server
nginx
etag
W/"5cae2198-9227"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
style.css
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/ 		185 KB
38 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/style.css?ver=4.7.0
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
970ff94ed9b8c359b6bd170753208276095788da18c7a205fc6c1d1989e04c10

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:16 GMT
content-encoding
br
last-modified
Fri, 21 Aug 2020 15:58:59 GMT
server
nginx
etag
W/"5f3fef43-2e295"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
EnlighterJS.min.css
blogvaronis2.wpengine.com/wp-content/plugins/enlighter/resources/ 		36 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/plugins/enlighter/resources/EnlighterJS.min.css?ver=3.10.0
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
f4e8c8dbefc2cd77738662930dff811a9608ddae5a042a29737bc6f1921c9b82

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:16 GMT
content-encoding
br
last-modified
Wed, 24 Jul 2019 19:48:40 GMT
server
nginx
etag
W/"5d38b618-8f0d"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
jquery.min.js
blogvaronis2.wpengine.com/wp-includes/js/jquery/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
br
last-modified
Wed, 10 Mar 2021 15:07:24 GMT
server
nginx
etag
W/"6048e0ac-15db1"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
jquery-migrate.min.js
blogvaronis2.wpengine.com/wp-includes/js/jquery/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:16 GMT
content-encoding
br
last-modified
Wed, 18 Nov 2020 09:06:06 GMT
server
nginx
etag
W/"5fb4e3fe-2bd8"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
varonis.min.js
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/assets/js/ 		1 KB
824 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/assets/js/varonis.min.js?ver=5.8
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
4107e7ffd0644249a155ecfd6ac589440784f0c84a93ee612b088bec177a647f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
br
last-modified
Wed, 10 Apr 2019 15:52:38 GMT
server
nginx
etag
W/"5cae1146-4ad"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
varonis_scripts.js
blogvaronis2.wpengine.com/wp-content/plugins/varonis_customcode/js/ 		190 B
354 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/plugins/varonis_customcode/js/varonis_scripts.js?ver=1.0
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
6dae08808413fb52897d5dfde2ee46682f45c46886702c83a107725d9b79f3d5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
br
last-modified
Wed, 08 May 2019 15:28:28 GMT
server
nginx
etag
W/"5cd2f59c-be"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
jquery.rwdImageMaps.min.js
blogvaronis2.wpengine.com/wp-content/plugins/vr_rwdimagemaps/js/ 		1 KB
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/plugins/vr_rwdimagemaps/js/jquery.rwdImageMaps.min.js?ver=5.8
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ed839d9fae4a8e722e9c408c2716a6f1eb789b99ef16722cd39ff4965749d8fb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
br
last-modified
Wed, 10 Apr 2019 17:02:19 GMT
server
nginx
etag
W/"5cae219b-45a"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
rwdimagemaps.js
blogvaronis2.wpengine.com/wp-content/plugins/vr_rwdimagemaps/js/ 		78 B
282 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/plugins/vr_rwdimagemaps/js/rwdimagemaps.js?ver=5.8
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
764ca7fe7918b60249c36e2bc0d391b76d5c0a6caa03543a466f7bd7361ac422

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:16 GMT
content-encoding
br
last-modified
Wed, 10 Apr 2019 17:02:19 GMT
server
nginx
etag
W/"5cae219b-4e"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
varonis_Logo.svg
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/varonis_Logo.svg
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
f6e380d277704c9f2e82b8a271fa21d2589a35d8b3c398c2a0f660073a1bd29e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
br
last-modified
Thu, 23 Jan 2020 18:31:15 GMT
server
nginx
etag
W/"5e29e673-13eb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
Headshot_SnirBenShimol-150x150.jpg
blogvaronis2.wpengine.com/wp-content/uploads/2020/12/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/uploads/2020/12/Headshot_SnirBenShimol-150x150.jpg
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
d16813b84a1d4acfc8d5f64cc2513a993a6ccbb3c4e380849b68946ecde2b755

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
last-modified
Fri, 18 Dec 2020 18:57:46 GMT
server
nginx
etag
"5fdcfbaa-1f00"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
7936
ssg8zig.js
use.typekit.net/ 		18 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/ssg8zig.js
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.122.244.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a92-122-244-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
510f80deee6c59f4978fdc2a9939e473e2d34e761495fc8b63d2937f90363eca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
server
nginx
date
Wed, 22 Sep 2021 19:04:17 GMT
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
6919
skip-link-focus-fix.js
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/js/ 		1 KB
779 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/js/skip-link-focus-fix.js?ver=20160412
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
6d4083520c18bfdcdffb319248525ebf8f1a547326e10c02e6a0ed0b1722ae9a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
br
last-modified
Wed, 10 Apr 2019 17:02:16 GMT
server
nginx
etag
W/"5cae2198-423"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
functions3.js
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/js/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/js/functions3.js?ver=20160412
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
a3302cc2db3e453e0ed6cec90688d9ee263fa7849ffb35ca852854f11d90939b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
br
last-modified
Wed, 10 Apr 2019 17:02:16 GMT
server
nginx
etag
W/"5cae2198-2af1"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
mootools-core-yc.js
blogvaronis2.wpengine.com/wp-content/plugins/enlighter/resources/ 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/plugins/enlighter/resources/mootools-core-yc.js?ver=3.10.0
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
bcada3fb8ba74f6737ee9e798c50512e274a4227ef0a165b84d6ef3f2f0f5c1f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
br
last-modified
Wed, 24 Jul 2019 19:48:40 GMT
server
nginx
etag
W/"5d38b618-15e0e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
EnlighterJS.min.js
blogvaronis2.wpengine.com/wp-content/plugins/enlighter/resources/ 		49 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/plugins/enlighter/resources/EnlighterJS.min.js?ver=3.10.0
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ba248c9f36442fceef93b25bc4577993797ab7255b16ec87be25d8cec31d559d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
br
last-modified
Wed, 24 Jul 2019 19:48:40 GMT
server
nginx
etag
W/"5d38b618-c395"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
wp-embed.min.js
blogvaronis2.wpengine.com/wp-includes/js/ 		1 KB
947 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-includes/js/wp-embed.min.js?ver=5.8
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
br
last-modified
Wed, 06 Jan 2021 15:29:24 GMT
server
nginx
etag
W/"5ff5d754-592"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
_Incapsula_Resource
www.varonis.com/ 		141 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.varonis.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1307075987
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.154.169 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
bf9cb2d18e0a7c1296d7a96d21a5263d86ea41f3352b4fcf90d913c7234fec8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:path
/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1307075987
pragma
no-cache
cookie
visid_incap_2074238=PHPZFnyLTE2NpH+eyjeotC9+S2EAAAAAQUIPAAAAAAASak6biLJaRv+LDng1n5+f; incap_ses_474_2074238=BV/LMslp8jd7v4007/yTBi9+S2EAAAAAFIwxK4wPDlwgW/VvkWwX+A==
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.varonis.com
referer
https://www.varonis.com/blog/darkside-ransomware/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/blog/darkside-ransomware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
cache-control
no-cache, no-store
x-robots-tag
noindex
content-length
20486
content-type
application/javascript
bg-topad.svg
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/bg-topad.svg
Requested by
Host: blogvaronis2.wpengine.com
URL: https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/style.css?ver=4.7.0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
92165e3f1c1397b39fb790aee4994f2d0928e307d3934d586f0e822255b1b1ae

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/style.css?ver=4.7.0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
br
last-modified
Wed, 10 Apr 2019 17:02:16 GMT
server
nginx
etag
W/"5cae2198-ac2"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
dash.svg
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/ 		688 B
642 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/dash.svg
Requested by
Host: blogvaronis2.wpengine.com
URL: https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/style.css?ver=4.7.0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
749b7eca519fbf896bffd8d40653163b05ff23babc9da40697836ff3b519fdea

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/style.css?ver=4.7.0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
br
last-modified
Wed, 10 Apr 2019 17:02:16 GMT
server
nginx
etag
W/"5cae2198-2b0"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
icon-x.svg
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/ 		901 B
714 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/icon-x.svg
Requested by
Host: blogvaronis2.wpengine.com
URL: https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/style.css?ver=4.7.0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
b67e2d756ec28f9e26b8a7bfd3569f10bf400bfe41a06941072beae36be58fa4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/style.css?ver=4.7.0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
br
last-modified
Wed, 10 Apr 2019 17:02:17 GMT
server
nginx
etag
W/"5cae2199-385"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
icon-search.svg
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/ 		1 KB
823 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/icon-search.svg
Requested by
Host: blogvaronis2.wpengine.com
URL: https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/style.css?ver=4.7.0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
11c13361754d814930d22d9b712f37c3b501b50c9d9d356b2c7b239ac5d09472

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/style.css?ver=4.7.0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
br
last-modified
Wed, 10 Apr 2019 17:02:17 GMT
server
nginx
etag
W/"5cae2199-5ae"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
blog-hero-bg.png
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/bg/ 		215 KB
215 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/bg/blog-hero-bg.png
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
fa9d68ba73efe79a96af58eec1576eee543c1119d0af8db251fbaca8fa1c1c66

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
last-modified
Sat, 29 Feb 2020 01:19:02 GMT
server
nginx
etag
"5e59bc06-35a4a"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
219722
Blog_NetwalkerRansomwareGuide_202011_FNL-1200x400.png
blogvaronis2.wpengine.com/wp-content/uploads/2021/03/ 		53 KB
54 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/uploads/2021/03/Blog_NetwalkerRansomwareGuide_202011_FNL-1200x400.png
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
8df33f5a2b28fbfb1f0a207b154d5ad7fc25554cc1aee89395240b5227d99d19

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
last-modified
Thu, 18 Mar 2021 14:16:13 GMT
server
nginx
etag
"605360ad-d570"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
54640
Blog_ThreatUpdateDigitalTemplate_202002_FNL-9.png
blogvaronis2.wpengine.com/wp-content/uploads/2021/07/ 		65 KB
65 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/uploads/2021/07/Blog_ThreatUpdateDigitalTemplate_202002_FNL-9.png
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
d4afb6d225bf5353945879dd3231503be4ed70bdbf8699590d92f57f85f1ff21

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
last-modified
Wed, 07 Jul 2021 18:14:50 GMT
server
nginx
etag
"60e5ef1a-1034d"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
66381
Blog_ThreatUpdateDigitalTemplate_202002_FNL-8.png
blogvaronis2.wpengine.com/wp-content/uploads/2021/07/ 		64 KB
65 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/uploads/2021/07/Blog_ThreatUpdateDigitalTemplate_202002_FNL-8.png
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
a4e939656f7960d4bceefffb2d6321f194fa2cf2199b741720a6d4be6037ed9a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
last-modified
Wed, 07 Jul 2021 18:12:08 GMT
server
nginx
etag
"60e5ee78-101b7"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
65975
Blog_ThreatUpdateDigitalTemplate_202002_FNL-7.png
blogvaronis2.wpengine.com/wp-content/uploads/2021/07/ 		65 KB
65 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/uploads/2021/07/Blog_ThreatUpdateDigitalTemplate_202002_FNL-7.png
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
32ff3f30afd81df27058a10dc10423dacdac2ade84c9ae0219645de204b2fa18

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
last-modified
Wed, 07 Jul 2021 18:12:09 GMT
server
nginx
etag
"60e5ee79-10249"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
66121
Blog_ThreatUpdateDigitalTemplate_202002_FNL-6.png
blogvaronis2.wpengine.com/wp-content/uploads/2021/07/ 		65 KB
65 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/uploads/2021/07/Blog_ThreatUpdateDigitalTemplate_202002_FNL-6.png
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
ecf7a598ea9d606fd207d8ea33bcb78c3b7fa646ae13fcdc87601b11abb5fd1a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
last-modified
Wed, 07 Jul 2021 18:12:11 GMT
server
nginx
etag
"60e5ee7b-10323"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
66339
fontawesome-webfont.woff2
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: blogvaronis2.wpengine.com
URL: https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/css/font-awesome.css?ver=4.7.0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/css/font-awesome.css?ver=4.7.0
Origin
https://www.varonis.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
last-modified
Wed, 10 Apr 2019 17:02:18 GMT
server
nginx
etag
"5cae219a-12d68"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
77160
Blog_NetwalkerRansomwareGuide_202011_FNL-1024x342.png
blogvaronis2.wpengine.com/wp-content/uploads/2021/03/ 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/uploads/2021/03/Blog_NetwalkerRansomwareGuide_202011_FNL-1024x342.png
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
0130ac55fdd6f3467455879286ca7936cc38991c42e21c533014758001f7c6b5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
last-modified
Thu, 18 Mar 2021 14:16:12 GMT
server
nginx
etag
"605360ac-ae7f"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
44671
rdp-over-tor-1024x577.png
blogvaronis2.wpengine.com/wp-content/uploads/2021/03/ 		417 KB
417 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/uploads/2021/03/rdp-over-tor-1024x577.png
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
6c8e52ec47acf191a6284f374f24b0053d0c1a3ed2a09d3460e390ad52d519cd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
last-modified
Thu, 18 Mar 2021 15:25:36 GMT
server
nginx
etag
"605370f0-68226"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
426534
bg-rainbow.jpg
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/ 		164 KB
164 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/bg-rainbow.jpg
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
1807314e3ad37de67f251000fc9fdc8fad8024a4803706b05fc38eebd42ed71f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
last-modified
Wed, 10 Apr 2019 17:02:16 GMT
server
nginx
etag
"5cae2198-28e07"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
167431
bg-footer.jpg
blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/ 		107 KB
108 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/images/bg-footer.jpg
Requested by
Host: blogvaronis2.wpengine.com
URL: https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/style.css?ver=4.7.0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.239.147.27 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
27.147.239.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
b3477dede55e6ca5237371ec235d4ebc3bea3361df5f8cf8155533e5d185579b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://blogvaronis2.wpengine.com/wp-content/themes/varonis-2019/style.css?ver=4.7.0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
last-modified
Wed, 10 Apr 2019 17:02:16 GMT
server
nginx
etag
"5cae2198-1ad0c"
vary
Accept-Encoding
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
109836
l
use.typekit.net/af/55bd39/00000000000000003b9b093f/27/ 		32 KB
33 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/55bd39/00000000000000003b9b093f/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n9&v=3
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.122.244.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a92-122-244-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
bf7a0b99faebf6d4add94e396e7feab2a95805c3e535a16e09f8752353870958

Request headers

Referer
https://www.varonis.com/
Origin
https://www.varonis.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
server
nginx
etag
"e37ccd92cd587b2884c51bb3b59abba2db840b5a"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
33264
l
use.typekit.net/af/71f83c/00000000000000003b9b093b/27/ 		33 KB
33 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/71f83c/00000000000000003b9b093b/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.122.244.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a92-122-244-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
259ca84f380e0a4a327867ce595dbb02ea8f3fe8ae0e96f902e0051fc44c194c

Request headers

Referer
https://www.varonis.com/
Origin
https://www.varonis.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
server
nginx
etag
"a0f35f91fdc2ca0a90c8288c08c20681c1aecfcf"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
33656
l
use.typekit.net/af/27776b/00000000000000003b9b0939/27/ 		32 KB
33 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/27776b/00000000000000003b9b0939/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.122.244.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a92-122-244-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ae55c313220f063fdb3dc157a89a22e6a20a400cdd5b639a5aabfa4ae91e476a

Request headers

Referer
https://www.varonis.com/
Origin
https://www.varonis.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
server
nginx
etag
"7f43a43bb76581ed1a2cdc24f0d9704bfa1a6732"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
33124
l
use.typekit.net/af/4838bd/00000000000000003b9b0934/27/ 		32 KB
32 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/4838bd/00000000000000003b9b0934/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.122.244.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a92-122-244-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
ceb4ce0bba67a12e21af094eb24293d7ea8bffaffc237a1cd90394c7588eaec9

Request headers

Referer
https://www.varonis.com/
Origin
https://www.varonis.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
server
nginx
etag
"852dacc5cd2685c187708b882b28635465e17bd0"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
32688
l
use.typekit.net/af/437c3d/00000000000000003b9b0932/27/ 		32 KB
32 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/437c3d/00000000000000003b9b0932/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.122.244.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a92-122-244-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b87ef2efd898acfddc8308449b24a558eca1e77f8e66802f03fab8c5d063d92a

Request headers

Referer
https://www.varonis.com/
Origin
https://www.varonis.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
server
nginx
etag
"474f8294a654ddd4e855cc66b1bb647cd40bfa9b"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
32380
l
use.typekit.net/af/3331e6/00000000000000003b9b0936/27/ 		32 KB
33 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/af/3331e6/00000000000000003b9b0936/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n5&v=3
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.122.244.59 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a92-122-244-59.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
7e01c1f46d29e8a778c9b2ae372f63fe76a2dc5c3629c441dcf52ea7b51190c0

Request headers

Referer
https://www.varonis.com/
Origin
https://www.varonis.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
server
nginx
etag
"b7f32cce44884c0c7d09c7eaf8ec10d20386685b"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
33180
p.gif
p.typekit.net/ 		35 B
214 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.typekit.net/p.gif?s=1&k=ssg8zig&ht=tk&h=www.varonis.com&f=137.139.173.175.5474.25136&a=84227738&js=1.20.0&app=typekit&e=js&_=1632337457420
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.111.215.74 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-74.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
last-modified
Wed, 02 Sep 2020 03:58:21 GMT
server
nginx
etag
"5f4f185d-23"
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
35
_Incapsula_Resource
www.varonis.com/ 		1 B
36 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.varonis.com/_Incapsula_Resource?SWKMTFSR=1&e=0.4589586103874854
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.154.169 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:path
/_Incapsula_Resource?SWKMTFSR=1&e=0.4589586103874854
pragma
no-cache
cookie
visid_incap_2074238=PHPZFnyLTE2NpH+eyjeotC9+S2EAAAAAQUIPAAAAAAASak6biLJaRv+LDng1n5+f; incap_ses_474_2074238=BV/LMslp8jd7v4007/yTBi9+S2EAAAAAFIwxK4wPDlwgW/VvkWwX+A==; ___utmvc=TyVbNmYnuf5NhdkeDdoH4mCfjDnqvLQKzeBNfxCyJUhUaSwV+z0Hwl7IqdNXkollsSoYhxFPMPuDa45Pplryr82kMsT40AgNlScr5X7XiubH/ajAEVRFh5PRbUsvNkRhA+JCB5r8upeo3e0ItIIpuMfJ8uIEw/vvWdtD8Cer/VLuyCpZ6AP0jc9P4I89XBIJ8HzMTX3wch948LGZeRYIjoJNM5Ilpawokp8AbwlEMN8MR0u+85GELNuKrVlGYDkoXbVvq0OX6hsBqCpCyYDeRJIl6fBBih6YGBH5roWHiBjR6KMzvOs5VQYDRRUSsjX6SJlu8WNPuKkAzQkCioH+7JzIODSU3A3sY6UHxeWrXdveKhzG8oFT6O76TRPLDZ4mBk0LxBsNg8qh0j5GZCTxN0ONEXzujH8YJLgGIbbxezmz8cCSZ0eDWxxeV1pZD1+orjAx8VjtWCuRJi2odzZ1RCOkG1sBaOyJNNNjDhMP86r6/NJfvrbgbxK0TmN+Y4LnLPlSGYspA+LymKGNPIXRkfmtXSb0beCj7IUenrI3ODpCWP1NOATLsdx+CizH6YMAQvwBBzSwo9n2f7TdnkaNNFDaji/9vqGcS8CrMJsXil35GgvT3CDrq3Ms3si3oG5/BPhMkVdW6sPUnofnsjmzyz+4mcUuyaEQYPVoukweWWlx3p4WQOJ+rTHquUHAH8UMUhQgRiSgo7lQNsGObbWpdpWi13pFVPmC/AJgS6eMWJgRPzIauQ2sOaT11uDjqkl16YeecPaVtU9zsaZqxeep6xwXTamCYyMECifq5QQk4Wye3gBjG88gf0/AiUQCFKN6377yBk8eAicddiiHI5MTvzkJ/zKm1CYvCybnYX1U2A5EyQHoXUXeWFJ8fMPFDJmx4yg2nKZyfwjaPqqQSsp0EbZ2ilk92t0DTWgFwcbEg9EGET8E0tyArJyJ5W6HLT5KKyEjHw/REOpVkOT5TiDFYkhOJ2/X4Gh9F4IeO39alh1KQBT0s098uXnJipiAhGEYRfCj8jLQFXo+1Upp31BM1UACpwN9WY98BPwPSgDkQ/ag95wAi1KyGp3yEo4BXlDbN+jJT1jqEhoU6yEdx5MAoMZ026Pjw4GvJLmh1KstI5iqqIEPSN5L1hBLHPmKYhjJBTtRVRxHU5V2YYARSf5pH6IjrdLQz+3X/MrYCyN0aoQ+XmszG0df11PRD6ChfFVUhpb+lZVHfq3cHAK8j5ix1cynL7tFbOdxRrswDHnzDKcUsw30Vsd95QRVnpdVT9KJxQWwGEYq5Hbbo6EJPmqbNqU9tWSu8fxtdi1Q8QIabvKZ/uy/1B8s3wc9SBl7v0xO/ac6SKapjy5weaQ2+LY4MGBLuoRedU5jfgaj9wSVoyAqSsWPa5FG7nu93cpmgcS1rHKoHE4D2i6498+WL32mJ1sE26/ICNFkrKHu0vFhCdJDzQZW57iS2JDghbLZxuLUi2wlHOdr+WZUvtuuPgsA+vN1O61wBjeWcInGkjLjMXoTtqouB8xM6U+DwK85i6QHwisobDtzF73sGkhEP7IMC3vPKw3IhdgcUbAkNnqOTP7I0T/4amdN4ytWRNUynfq5Feu8oCUx5uuuOPjtzalqEULN6Cl4AB3hJMljU2QN44m+/qezGvXIwW4VRo7oRzbxx6i+YUgBOHENdZBNm72I42qRppK0AdlI4IcCbPYXh6t0LuWlseiHcw8ybpZiTGBQv3w2rbIH6fUYWKe3/zIdLMz8l/x/M2XkMRVRBYei85iYFcVcFvW1jJAVTneEMbOQK89vbOHHTIDzrAHNkpl4IkzeBaPxGH3IyjVjvET+GDxI6qAueB6aoAhThmBiwMQ3b815AEG6fqyIEBNY2Xdmq+SAm5Wu3b1EGT7xl8I2kqn7hq3sSj/osNOL0ul6+2t43v1AFBgVfRzbNldCsG6ENdQitGjFqfMxU7uzoSBEWrZav26phjKRDeHyECYURRQURvWtby7ubLX5xHON3JBx3k85XqUmxtvDS2Atn0jq8KyxUNDH2Ro0VSkrSIXZL0xW2RWMQcm3G9PAEYOPpwVE76Sb307AWvh3dB5IWPGijq6azWet9K+OlhEokpg2156Tkvnm54G3og8ED/cGZxcDT5c5lPHFV8yoXLbdlE73EaxUE8yuo6mp3U+GWjjnu0QABy+G/io2oJUzUsV7h8tQpxw2d96vK5ettzs7Th8FpYCZsechofUVTBEfVfa3YVvHY/KORZh18HoYJRjMUUDh1hR7J2cKe9kp/ZsZcdeGNwUfqgKZQlHqD43IAlmwjmM6EFgQdbxktHv13r1TKTuqpafKiAgVgJVxnfgYw43Po5Q0PCCNMaajqTKHWApJqQzrZOGcodCvVJjp1p5sRloUKAuGQwHXMDe21qoPEn7EYCAs3MXFiRlZAevIEOlQhT9xvOO8g1blIN+/P2KIKqyAqBWtoLryEcHkPzPScJ2DNdA9GXNV5X/EGyqqbDJG+jTBMBUoru5ERdPjFHbWrPW/68nk6+C8c2lqxd7lZTmoXLVPg1Sd8tS4n9ykmgGKag/7X/FjwZLG5ZKrjotLcnSGMPmXk4ZnkFlLF39eb3Ysmj9JggGefPqJ9npg386YKGIrZUMMLF8OZXLQjzAZ3omYf5etkMZEjJXBnfVSTjoC5OO8Vip5sLwtLoMQia4BLGRpZ2VzdD0xODQwNDEscz02MDljYTA4Mjg5ODU3NDY4YTc3Mzg5ODc2NzZkYTQ3M2EwOTc3YjYzYThhMTc4ODFhNjdiN2E3MTgwOThhOGE5OGM1ZmFjOWU3YTg5NzE2ZA==
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
www.varonis.com
referer
https://www.varonis.com/blog/darkside-ransomware/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/blog/darkside-ransomware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache, no-store
x-robots-tag
noindex
content-length
1
content-type
text/plain
vanalytics.js
www.varonis.com/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.varonis.com/vanalytics.js
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/blog/darkside-ransomware/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.154.169 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
1eaa1020765fe443319fc3b05d23fc90a21764df47893d9bb159c72d131932d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:path
/vanalytics.js
pragma
no-cache
cookie
visid_incap_2074238=PHPZFnyLTE2NpH+eyjeotC9+S2EAAAAAQUIPAAAAAAASak6biLJaRv+LDng1n5+f; incap_ses_474_2074238=BV/LMslp8jd7v4007/yTBi9+S2EAAAAAFIwxK4wPDlwgW/VvkWwX+A==; ___utmvc=TyVbNmYnuf5NhdkeDdoH4mCfjDnqvLQKzeBNfxCyJUhUaSwV+z0Hwl7IqdNXkollsSoYhxFPMPuDa45Pplryr82kMsT40AgNlScr5X7XiubH/ajAEVRFh5PRbUsvNkRhA+JCB5r8upeo3e0ItIIpuMfJ8uIEw/vvWdtD8Cer/VLuyCpZ6AP0jc9P4I89XBIJ8HzMTX3wch948LGZeRYIjoJNM5Ilpawokp8AbwlEMN8MR0u+85GELNuKrVlGYDkoXbVvq0OX6hsBqCpCyYDeRJIl6fBBih6YGBH5roWHiBjR6KMzvOs5VQYDRRUSsjX6SJlu8WNPuKkAzQkCioH+7JzIODSU3A3sY6UHxeWrXdveKhzG8oFT6O76TRPLDZ4mBk0LxBsNg8qh0j5GZCTxN0ONEXzujH8YJLgGIbbxezmz8cCSZ0eDWxxeV1pZD1+orjAx8VjtWCuRJi2odzZ1RCOkG1sBaOyJNNNjDhMP86r6/NJfvrbgbxK0TmN+Y4LnLPlSGYspA+LymKGNPIXRkfmtXSb0beCj7IUenrI3ODpCWP1NOATLsdx+CizH6YMAQvwBBzSwo9n2f7TdnkaNNFDaji/9vqGcS8CrMJsXil35GgvT3CDrq3Ms3si3oG5/BPhMkVdW6sPUnofnsjmzyz+4mcUuyaEQYPVoukweWWlx3p4WQOJ+rTHquUHAH8UMUhQgRiSgo7lQNsGObbWpdpWi13pFVPmC/AJgS6eMWJgRPzIauQ2sOaT11uDjqkl16YeecPaVtU9zsaZqxeep6xwXTamCYyMECifq5QQk4Wye3gBjG88gf0/AiUQCFKN6377yBk8eAicddiiHI5MTvzkJ/zKm1CYvCybnYX1U2A5EyQHoXUXeWFJ8fMPFDJmx4yg2nKZyfwjaPqqQSsp0EbZ2ilk92t0DTWgFwcbEg9EGET8E0tyArJyJ5W6HLT5KKyEjHw/REOpVkOT5TiDFYkhOJ2/X4Gh9F4IeO39alh1KQBT0s098uXnJipiAhGEYRfCj8jLQFXo+1Upp31BM1UACpwN9WY98BPwPSgDkQ/ag95wAi1KyGp3yEo4BXlDbN+jJT1jqEhoU6yEdx5MAoMZ026Pjw4GvJLmh1KstI5iqqIEPSN5L1hBLHPmKYhjJBTtRVRxHU5V2YYARSf5pH6IjrdLQz+3X/MrYCyN0aoQ+XmszG0df11PRD6ChfFVUhpb+lZVHfq3cHAK8j5ix1cynL7tFbOdxRrswDHnzDKcUsw30Vsd95QRVnpdVT9KJxQWwGEYq5Hbbo6EJPmqbNqU9tWSu8fxtdi1Q8QIabvKZ/uy/1B8s3wc9SBl7v0xO/ac6SKapjy5weaQ2+LY4MGBLuoRedU5jfgaj9wSVoyAqSsWPa5FG7nu93cpmgcS1rHKoHE4D2i6498+WL32mJ1sE26/ICNFkrKHu0vFhCdJDzQZW57iS2JDghbLZxuLUi2wlHOdr+WZUvtuuPgsA+vN1O61wBjeWcInGkjLjMXoTtqouB8xM6U+DwK85i6QHwisobDtzF73sGkhEP7IMC3vPKw3IhdgcUbAkNnqOTP7I0T/4amdN4ytWRNUynfq5Feu8oCUx5uuuOPjtzalqEULN6Cl4AB3hJMljU2QN44m+/qezGvXIwW4VRo7oRzbxx6i+YUgBOHENdZBNm72I42qRppK0AdlI4IcCbPYXh6t0LuWlseiHcw8ybpZiTGBQv3w2rbIH6fUYWKe3/zIdLMz8l/x/M2XkMRVRBYei85iYFcVcFvW1jJAVTneEMbOQK89vbOHHTIDzrAHNkpl4IkzeBaPxGH3IyjVjvET+GDxI6qAueB6aoAhThmBiwMQ3b815AEG6fqyIEBNY2Xdmq+SAm5Wu3b1EGT7xl8I2kqn7hq3sSj/osNOL0ul6+2t43v1AFBgVfRzbNldCsG6ENdQitGjFqfMxU7uzoSBEWrZav26phjKRDeHyECYURRQURvWtby7ubLX5xHON3JBx3k85XqUmxtvDS2Atn0jq8KyxUNDH2Ro0VSkrSIXZL0xW2RWMQcm3G9PAEYOPpwVE76Sb307AWvh3dB5IWPGijq6azWet9K+OlhEokpg2156Tkvnm54G3og8ED/cGZxcDT5c5lPHFV8yoXLbdlE73EaxUE8yuo6mp3U+GWjjnu0QABy+G/io2oJUzUsV7h8tQpxw2d96vK5ettzs7Th8FpYCZsechofUVTBEfVfa3YVvHY/KORZh18HoYJRjMUUDh1hR7J2cKe9kp/ZsZcdeGNwUfqgKZQlHqD43IAlmwjmM6EFgQdbxktHv13r1TKTuqpafKiAgVgJVxnfgYw43Po5Q0PCCNMaajqTKHWApJqQzrZOGcodCvVJjp1p5sRloUKAuGQwHXMDe21qoPEn7EYCAs3MXFiRlZAevIEOlQhT9xvOO8g1blIN+/P2KIKqyAqBWtoLryEcHkPzPScJ2DNdA9GXNV5X/EGyqqbDJG+jTBMBUoru5ERdPjFHbWrPW/68nk6+C8c2lqxd7lZTmoXLVPg1Sd8tS4n9ykmgGKag/7X/FjwZLG5ZKrjotLcnSGMPmXk4ZnkFlLF39eb3Ysmj9JggGefPqJ9npg386YKGIrZUMMLF8OZXLQjzAZ3omYf5etkMZEjJXBnfVSTjoC5OO8Vip5sLwtLoMQia4BLGRpZ2VzdD0xODQwNDEscz02MDljYTA4Mjg5ODU3NDY4YTc3Mzg5ODc2NzZkYTQ3M2EwOTc3YjYzYThhMTc4ODFhNjdiN2E3MTgwOThhOGE5OGM1ZmFjOWU3YTg5NzE2ZA==
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.varonis.com
referer
https://www.varonis.com/blog/darkside-ransomware/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/blog/darkside-ransomware/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
content-encoding
gzip
last-modified
Thu, 27 May 2021 01:20:23 GMT
x-cdn
Imperva
etag
W/"60aef3d7-19bc"
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript
x-iinfo
8-76977531-0 0CNN RT(1632337457313 0) q(0 -1 -1 -1) r(0 -1)
cache-control
max-age=21808160, public
set-cookie
___utmvc=a; Max-Age=0; path=/; expires=Sat, 11 Sep 2021 13:59:25 GMT
content-length
1871
expires
Thu, 02 Jun 2022 04:53:37 GMT
bizible.js
cdn.bizible.com/scripts/ 		83 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.bizible.com/scripts/bizible.js
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/vanalytics.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67F3) /
Resource Hash
de22a1f465480545ea9595d61c16ad21ad40e6b2509cca0e76d2601980e52988

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
content-encoding
gzip
last-modified
Thu, 16 Sep 2021 23:43:50 GMT
server
ECS (frb/67F3)
age
76488
etag
"68dc22b354abd71:0"
vary
Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
cache-control
max-age=86400
accept-ranges
bytes
content-length
32240
LB4pGhMk.min.js
tag.demandbase.com/ 		58 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tag.demandbase.com/LB4pGhMk.min.js
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/vanalytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.193.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-193-108.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0ccc8a089a5c15b3ddafd513681885bac6d84b828e57b8afe2d3d41514fb5bdb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

x-amz-version-id
3kBmt.zyLlTLBTFSs_kmRxLahS.ustB_
content-encoding
gzip
last-modified
Tue, 08 Dec 2020 23:23:50 GMT
server
AmazonS3
age
1910
etag
W/"025d4a22b315d411557e859e048608e1"
vary
Accept-Encoding
x-edge-origin-shield-skipped
0
content-type
application/javascript; charset=utf-8
via
1.1 3b02f73dccc5077f1ad544a27a475ed6.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
date
Wed, 22 Sep 2021 18:35:15 GMT
x-cache
Hit from cloudfront
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
q1TOpuXVoMyqO4oQ_OmDXU6TtPzcXvvkDU-SbY6AqTBv7oxmdnyuvQ==
fbevents.js
connect.facebook.net/en_US/ 		98 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/vanalytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.240.236.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-02-frx5.fbcdn.net
Software
/
Resource Hash
ab43cf929d649dba8ce38c92dec4849c8049b678fec9942ae08df5ca57757280
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
25969
x-xss-protection
0
pragma
public
x-fb-debug
z/LY/5gOic6/uGAmJCr6LE4snaztrYwujJfneygw1Ko9KDzZAC3XpUXE15X+5T+/bLGlXDBzLf9w5ebYQA4o7g==
x-fb-trip-id
917726464
x-frame-options
DENY
date
Wed, 22 Sep 2021 19:04:18 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		96 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-1015553108
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/vanalytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.168 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
165c8bd3fffa97fa49734f10bffd39aec2c7190a3349acfc1b7e0a9b16447691
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39036
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 18:14:07 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 22 Sep 2021 19:04:18 GMT
js
www.googletagmanager.com/gtag/ 		100 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-2019109-1
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/vanalytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.168 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s01-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
e9b8c13480d06b8971129ff9382b2a33f6aa706ab05c5d8ec239806afe20ebf8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40309
x-xss-protection
0
last-modified
Wed, 22 Sep 2021 18:14:07 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 22 Sep 2021 19:04:18 GMT
cse.js
cse.google.com/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cse.google.com/cse.js?cx=013425730632158569092:arjc2usbxyq
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/vanalytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.142 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s07-in-f14.1e100.net
Software
gws /
Resource Hash
ebd572282cedc6e8893c11479a654cb9dce963c134ae4271d096eecc5115a5ea
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

bfcache-opt-in
unload
date
Wed, 22 Sep 2021 19:04:18 GMT
content-encoding
br
server
gws
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3454
x-xss-protection
0
142972.js
js.hs-scripts.com/ 		1 KB
885 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-scripts.com/142972.js
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/vanalytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.211.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6d954f3e13ca2d77d08aa911d4815601ba8e0b42cf37be844ac59828aceefab7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
4
cf-polished
origSize=1441
x-hubspot-correlation-id
f27bc56a-862c-4f8c-8bb5-c90c6ec6fa27
cf-bgj
minify
server
cloudflare
x-trace
2B12EFA4121491BFAAD32251E0BD53701669943E8B000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3600
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://www.varonis.com
cache-control
public, max-age=60
access-control-allow-credentials
true
cf-ray
692dcc58cd591f3d-FRA
expires
Wed, 22 Sep 2021 19:05:18 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/vanalytics.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.41.169.41 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-41-169-41.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 22 Sep 2021 19:04:18 GMT
Content-Encoding
gzip
Last-Modified
Fri, 13 Aug 2021 21:34:05 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=60935
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2036
sl.js
scout-cdn.salesloft.com/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://scout-cdn.salesloft.com/sl.js
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/vanalytics.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.64 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
a959317813b70f3a91aceafa835bee05b1cf81ca27f7d2b7acbaed4a9c7a8762

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
content-encoding
gzip
last-modified
Mon, 27 Apr 2020 18:38:20 GMT
server
NetDNA-cache/2.2
x-amz-request-id
X31NA3FAX8FJFEQM
etag
W/"f39a9ee69f7c11a788f004f2b71ace38"
x-cache
HIT
x-amz-version-id
null
content-type
application/javascript
x-amz-id-2
nvOyDXbMTCdU3Jwr4u9TYMnp8sCxsHLR6vBaSXsdb6F59luBbFnxTAhssFv5K+sKHqVGZi22RGg=
cookie-consent.js
consent.varonis.com/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://consent.varonis.com/js/cookie-consent.js
Requested by
Host: www.varonis.com
URL: https://www.varonis.com/vanalytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.154.169 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
WEBrick/1.3.1 (Ruby/2.3.7/2018-03-28) /
Resource Hash
59858d560467c272b1e6faa2f94dca83f00d14a2d48667540ab3c73c318ce596
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
via
1.1 vegur
last-modified
Wed, 29 Apr 2020 21:22:27 GMT
server
WEBrick/1.3.1 (Ruby/2.3.7/2018-03-28)
vary
Origin
content-type
application/javascript
access-control-allow-origin
*
x-iinfo
8-76977549-76977551 NNYN CT(99 198 0) RT(1632337457373 0) q(0 0 3 0) r(4 4) U2
cache-control
no-cache
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-cdn
Imperva
179650485736885
connect.facebook.net/signals/config/ 		305 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/179650485736885?v=2.9.46&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.240.236.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-02-frx5.fbcdn.net
Software
/
Resource Hash
226b15064fa1b99881c51f34ef2394f67c4b4a1b985e420e7a8980f354ff44fe
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
iTkzdvnc5WlMUvWOsn2m3y2gm+NHGwLwaCdMYgA3bLWhfET8KFLM3aaCE3Zxyrvc0Hk9J2fUKXDkmBH2BexL+w==
x-fb-trip-id
917726464
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Wed, 22 Sep 2021 19:04:18 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
142972.js
js.hs-banner.com/ 		61 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-banner.com/142972.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/142972.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.21.191 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
422b5426f800bf80ba300f90fef3e8a3f140dcbbe6d438afb8c26212c08094cc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
content-encoding
br
cf-cache-status
HIT
age
126
x-amz-server-side-encryption
AES256
content-type
text/javascript; charset=UTF-8
access-control-max-age
604800
x-amz-request-id
F1ZAZ2PP7B20KSH2
x-amz-id-2
FZiFqE608MVumz+1BsJDsUNcmeXHj38Qsa7VpnInHDyJmBWy78hv/vCXz+N0Xc+nBxCnb765cxM=
timing-allow-origin
*
last-modified
Fri, 03 Sep 2021 19:24:19 GMT
server
cloudflare
etag
W/"ce71ee5d55c3ccc6e777733363708a83"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-amz-version-id
d2Oh2OOUGaRTS1Sf9W3vHyyo536yE800
access-control-allow-origin
https://info.varonis.com
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control
max-age=300, public
access-control-allow-credentials
true
cf-ray
692dcc591c202c4e-FRA
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
expires
Wed, 22 Sep 2021 19:07:12 GMT
conversations-embed.js
js.usemessages.com/ 		80 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.usemessages.com/conversations-embed.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/142972.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.236.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
832fcb7a625f828fb8cd99e39ef1b9abe50f1bc164a0aeeeed1ef15fa7505deb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
via
1.1 fb41e17254dfd781519e95cedd257827.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
235
x-amz-server-side-encryption
AES256
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=conversations-embed/static-1.9209/bundles/project.js&cfRay=692dc69c0fc80621-FRA
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
x-amz-replication-status
COMPLETED
content-encoding
br
last-modified
Thu, 16 Sep 2021 05:13:43 UTC
server
cloudflare
etag
W/"cecb2964faa8bf5b647ff0431628c01f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
HAX2I11puR0RrwmgvE3LmLBDwNOOTMQz
cache-control
max-age=600
x-hs-cache-status
HIT
x-amz-cf-pop
IAD89-C3
cf-ray
692dcc590c119730-FRA
x-amz-cf-id
ju7DNAN6UnbwNQLuElyP7A9aKQnRF7VPkUx24NDyCLKipez0OZfG-A==
x-hs-target-asset
conversations-embed/static-1.9209/bundles/project.js
142972.js
js.hs-analytics.net/analytics/1632337200000/ 		62 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.hs-analytics.net/analytics/1632337200000/142972.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/142972.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.68.176 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
10d4196f80a46f2d411ad62881684a77342baa71c461a2a6c6f56efb95ab7f0d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
content-encoding
br
cf-cache-status
HIT
age
126
x-amz-server-side-encryption
AES256
x-amz-request-id
0NGHDXJ33YPPKQQ1
x-amz-id-2
D9rxD/gdwSjyuZPwoctqiyZCKE9KlX6iNR8RddGa2yYDtWgoPbGOtcscA5uOc+fh0vGtuL9KOz0=
last-modified
Fri, 13 Aug 2021 22:16:41 GMT
server
cloudflare
etag
W/"d340ff00336e5945b3a4ac7067635de1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=300, public
access-control-allow-credentials
false
x-amz-version-id
null
cf-ray
692dcc591d986921-FRA
expires
Wed, 22 Sep 2021 19:07:12 GMT
r
scout.salesloft.com/ 		41 B
403 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://scout.salesloft.com/r?tid=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0IjoxMTQ3NX0.iI-HhwOQ2R9nR36t6D2kwo7l09ByrLMU2A7_XHc4Ar0
Requested by
Host: scout-cdn.salesloft.com
URL: https://scout-cdn.salesloft.com/sl.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.219.76.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-76-19.compute-1.amazonaws.com
Software
/
Resource Hash
e05ae076790852a21a47535d8a06e4ebdfc3079536d9c3f9f91d9f5b29303f0e
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
strict-transport-security
max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.varonis.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
content-length
41
x-request-id
d8e38f222ffa9116b4fc0a6063f9429a
analytics.js
www.google-analytics.com/ 		48 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2019109-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.142 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 11 Aug 2021 00:32:57 GMT
server
Golfe2
age
1041
date
Wed, 22 Sep 2021 18:46:57 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19747
expires
Wed, 22 Sep 2021 20:46:57 GMT
conversion_async.js
www.googleadservices.com/pagead/ 		36 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1015553108
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
cafe /
Resource Hash
0899c22c6b5ecb084f0746f194d82a887c52906770ff9b168eabdc775da7c728
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14069
x-xss-protection
0
server
cafe
etag
5051469215060845982
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 22 Sep 2021 19:04:18 GMT
ipv
cdn.bizible.com/m/ 		43 B
305 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=966f4efaf1454925bc93559e38db44fa&_biz_s=443c8d&_biz_l=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F&_biz_t=1632337458103&_biz_i=Return%20of%20the%20Darkside%3A%20Analysis%20of%20a%20Large-Scale%20Data%20Theft%20Campaign&_biz_n=0&rnd=50772&cdn_o=a&_biz_z=1632337458104
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6760) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 22 Sep 2021 19:04:18 GMT
last-modified
Sun, 19 Sep 2021 11:21:51 GMT
server
ECS (frb/6760)
age
286947
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control
no-cache, no-store
accept-ranges
bytes
content-type
Image/GIF
content-length
43
expires
-1
u
cdn.bizibly.com/ 		43 B
203 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.bizibly.com/u?_biz_u=966f4efaf1454925bc93559e38db44fa&_biz_s=443c8d&_biz_l=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F&_biz_t=1632337458107&_biz_i=Return%20of%20the%20Darkside%3A%20Analysis%20of%20a%20Large-Scale%20Data%20Theft%20Campaign&rnd=4943&cdn_o=a&_biz_z=1632337458107
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67C2) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 22 Sep 2021 19:04:18 GMT
last-modified
Thu, 16 Sep 2021 23:57:01 GMT
server
ECS (frb/67C2)
age
500837
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control
no-cache, no-store
accept-ranges
bytes
content-type
Image/GIF
content-length
43
expires
-1
xdc.js
cdn.bizible.com/ 		116 B
442 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.bizible.com/xdc.js?_biz_u=966f4efaf1454925bc93559e38db44fa&_biz_h=-1906410348&cdn_o=a&jsVer=4.21.06.25
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6711) /
Resource Hash
391301ac20bad013ced6c6fd6d300b103fc7870800b413a332cce722cadaf9e7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:17 GMT
cache-control
private, must-revalidate, max-age=21600
server
ECS (frb/6711)
content-type
text/javascript; charset=utf-8
etag
C8127FA7
content-length
116
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cse_element__en.js
www.google.com/cse/static/element/b54a745638da8bbb/ 		280 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/cse/static/element/b54a745638da8bbb/cse_element__en.js?usqp=CAI%3D
Requested by
Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=013425730632158569092:arjc2usbxyq
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f4.1e100.net
Software
sffe /
Resource Hash
94fc1b6f57eaec5b66d02212a4a8c63fb22b3b46c2643d76c1b39edeea337b71
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 17:44:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4766
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
93992
x-xss-protection
0
last-modified
Wed, 30 Jun 2021 17:07:08 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="prose-team"
expires
Thu, 22 Sep 2022 17:44:52 GMT
default+en.css
www.google.com/cse/static/element/b54a745638da8bbb/ 		41 KB
41 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.google.com/cse/static/element/b54a745638da8bbb/default+en.css
Requested by
Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=013425730632158569092:arjc2usbxyq
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f4.1e100.net
Software
sffe /
Resource Hash
4c1355d27b14881a055e00a4a2afa4608b452c9780ac5c61e1b8f9fd55fa3e1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Mon, 20 Sep 2021 16:09:44 GMT
x-content-type-options
nosniff
age
183274
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41474
x-xss-protection
0
last-modified
Wed, 30 Jun 2021 17:07:08 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="prose-team"
expires
Tue, 20 Sep 2022 16:09:44 GMT
default.css
www.google.com/cse/static/style/look/v4/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.google.com/cse/static/style/look/v4/default.css
Requested by
Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=013425730632158569092:arjc2usbxyq
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f4.1e100.net
Software
sffe /
Resource Hash
dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 18:59:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
274
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1345
x-xss-protection
0
last-modified
Wed, 17 Jun 2020 00:00:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type
text/css
cache-control
public, max-age=3000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="prose-team"
expires
Wed, 22 Sep 2021 19:49:44 GMT
public
api.hubspot.com/livechat-public/v1/message/ 		282 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.hubspot.com/livechat-public/v1/message/public?portalId=142972&conversations-embed=static-1.9209&mobile=false&messagesUtk=4f0756c0edd44e5e9111260caf2e2e12&traceId=4f0756c0edd44e5e9111260caf2e2e12
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.155.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
258c11266f97658b953d1096682dc775964b49265f7d1d3f6dd45fdb0dcae36c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Referer
https://www.varonis.com/
Accept-Language
de-DE,de;q=0.9
X-HubSpot-Messages-Uri
https://www.varonis.com/blog/darkside-ransomware/

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
content-encoding
gzip
vary
Accept-Encoding
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
55fe2689-04f9-45d5-b87e-4c98a86d6234
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
224
server
cloudflare
x-trace
2B02FA1B4A632A2392906C41A7FC0E3EBFE647C931000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nTPXOrnSpzT334REnyeewyDVEW6K93DNHXPKz%2B1a1sZcbjf3jtycz6sOcIlawmFKoGJYRlgRkEQCs6WlKbPlEqLyHrFKcyj9EVQvR294trSU2T%2FpWxmIrKE0uKthGYJuTg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.varonis.com
cache-control
no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials
false
cf-ray
692dcc5abd065c62-FRA
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
public
api.hubspot.com/livechat-public/v1/message/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.hubspot.com/livechat-public/v1/message/public?portalId=142972&conversations-embed=static-1.9209&mobile=false&messagesUtk=4f0756c0edd44e5e9111260caf2e2e12&traceId=4f0756c0edd44e5e9111260caf2e2e12
Protocol
H2
Server
104.19.155.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
x-hubspot-messages-uri
Origin
https://www.varonis.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
content-type
text/plain; charset=utf-8
content-length
18
cf-ray
692dcc59bd706931-FRA
access-control-allow-origin
https://www.varonis.com
allow
HEAD,GET,OPTIONS
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
cf-cache-status
DYNAMIC
access-control-allow-credentials
false
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-hubspot-correlation-id
3ec03c41-71a1-46e7-830b-615a178360cc
x-trace
2B1E06ABFA48ADE340E2602DDE40F2E400032AF907000000000000000000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K%2Bm8aKB7CGa6LVGQHZajSs47NgdKuAMuvJ%2FQ8T5TR8lSU0zL2O1zZTBz3XF1qsTKBIevpAkcZDmjORTJtCQQ0S7NFUnLOd0cDDMgDSLIK8IZE7B54skFB7pzbvdJ%2FJ8lIA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
ip.json
api.company-target.com/api/v2/ 		1011 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F&page_title=Return%20of%20the%20Darkside%3A%20Analysis%20of%20a%20Large-Scale%20Data%20Theft%20Campaign&src=tag&key=46ef68e9b9ca462fdf04c8e8a744ff94
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.2 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-2.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
8a700119cb9ef415acdfe7feaf2b63335bc09a99aba07d5bdfafb008b8c2ad5c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
identification-source
CACHE
vary
Accept-Encoding, Origin
x-amz-cf-pop
FRA2-C2
x-cache
Miss from cloudfront
request-id
f80f938d-5044-44f1-8c32-5deb5a6b450b
content-encoding
gzip
pragma
no-cache
access-control-allow-origin
https://www.varonis.com
server
nginx
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 56fad5a50ef67bd961b9722ed0931839.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
z1Elpijw2ZA6Zd_feyUXi5di7rZbj-yQgi4RxPyFmo40V01gYiUxNQ==
expires
Tue, 21 Sep 2021 19:04:18 GMT
validateCookie
segments.company-target.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
  • https://segments.company-target.com/log?vendor=choca&user_id=AADqh07ClvwAACE7FbeOjQ
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AADqh07ClvwAACE7FbeOjQ&verifyHash=8147e17386052684b483d2c224f383189c3f829d
26 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AADqh07ClvwAACE7FbeOjQ&verifyHash=8147e17386052684b483d2c224f383189c3f829d
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.225.78.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-78-109.fra2.r.cloudfront.net
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date
Wed, 22 Sep 2021 19:04:18 GMT
Via
1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA2-C2
Vary
Origin
X-Cache
Miss from cloudfront
Content-Type
image/gif
Transfer-Encoding
chunked
Connection
keep-alive
trace-id
94d06ef8748ea157
X-Amz-Cf-Id
ByeceLLTyy3zFz8eV1_fkvZTrGcbuu0AtPiClIaTH4DXDCuRb6xgbg==

Redirect headers

Date
Wed, 22 Sep 2021 19:04:18 GMT
Via
1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA2-C2
Vary
Origin
X-Cache
Miss from cloudfront
Location
/validateCookie?vendor=choca&user_id=AADqh07ClvwAACE7FbeOjQ&verifyHash=8147e17386052684b483d2c224f383189c3f829d
Connection
keep-alive
trace-id
1e14a7298de28d1b
Content-Length
0
X-Amz-Cf-Id
DIFvJGNU14Q84LJ1RKrvZTwckfjSbudZYuNx7yAiT4jx2jyK1Ofp7Q==
464526.gif
id.rlcdn.com/ 		0
66 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/464526.gif
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
via
1.1 google
alt-svc
clear
content-length
0
142972.js
js-na1.hs-scripts.com/ 		1 KB
648 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js-na1.hs-scripts.com/142972.js
Requested by
Host: js.hs-analytics.net
URL: https://js.hs-analytics.net/analytics/1632337200000/142972.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.211.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
17d2eba457170f9a4e195b1c55ee8e9d25e8d15bbcfa705a3692baa564c8f1bd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
content-encoding
br
cf-cache-status
EXPIRED
server
cloudflare
x-hubspot-correlation-id
b32c9dfc-21c4-4e2f-88a7-3a11d0bd7b48
x-trace
2B780C8B3CDEA8F02270B21E0BC7837D5584A2DDD8000000000000000000
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
access-control-allow-origin
https://www.varonis.com
access-control-max-age
3600
cache-control
public, max-age=30
access-control-allow-credentials
true
cf-ray
692dcc59ceb31f3d-FRA
__ptq.gif
track.hubspot.com/ 		45 B
988 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=3169173831&v=1.1&a=142972&rcu=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F&pu=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F&t=Return+of+the+Darkside%3A+Analysis+of+a+Large-Scale+Data+Theft+Campaign&cts=1632337458177&vi=ab696e4d31d23ded26aea2f69ea43c5b&nc=true&u=162743971.ab696e4d31d23ded26aea2f69ea43c5b.1632337458172.1632337458172.1632337458172.1&b=162743971.1.1632337458172&cc=15
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.154.83 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
vary
Accept-Encoding
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-hubspot-correlation-id
b3dd2d3e-c01a-4019-98c2-ff668f75e2f5
cf-ray
692dcc59bfec6904-FRA
p3p
CP="NOI CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
45
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hPCkoOfNjTfC6j%2FfRTZd2qVIiiIXqDnVw8WZusxkkepzcI4M6ZwBMqdMJNBakm5RhEV1ISTXopxyzvkp5Um0Xv4E8xwmUXzv3AxNdrMkoqjrN7%2FF6GSxc76TLcoO5HDxR8bd"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
no-cache, no-store, no-transform
access-control-allow-credentials
false
x-robots-tag
none
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j93&a=307386733&t=pageview&_s=1&dl=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F&ul=en-us&de=UTF-8&dt=Return%20of%20the%20Darkside%3A%20Analysis%20of%20a%20Large-Scale%20Data%20Theft%20Campaign&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1049148584&gjid=1166653650&cid=1380211509.1632337458&tid=UA-2019109-1&_gid=1991152342.1632337458&_r=1&gtm=2ou9k0&z=799181000
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.142 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.varonis.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 22 Sep 2021 19:04:18 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.varonis.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
313 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=179650485736885&ev=PageView&dl=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F&rl=&if=false&ts=1632337458212&sw=1600&sh=1200&v=2.9.46&r=stable&ec=0&o=30&fbp=fb.1.1632337458210.1855388206&it=1632337458055&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
edge-star-mini-shv-02-frx5.facebook.com
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Wed, 22 Sep 2021 19:04:18 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1015553108/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015553108/?random=1632337458218&cv=9&fst=1632337458218&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9k0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F&tiba=Return%20of%20the%20Darkside%3A%20Analysis%20of%20a%20Large-Scale%20Data%20Theft%20Campaign&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
acfdcdc2e0d047ee844c9f7d2b5617e6cd40686dfd02a9d7fb7381b01bea3789
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 22 Sep 2021 19:04:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1074
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		2 B
411 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-2019109-1&cid=1380211509.1632337458&jid=1049148584&gjid=1166653650&_gid=1991152342.1632337458&_u=YEBAAUAAAAAAAC~&z=649791675
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.125.206.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wk-in-f154.1e100.net
Software
Golfe2 /
Resource Hash
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.varonis.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Wed, 22 Sep 2021 19:04:18 GMT
content-type
text/plain
access-control-allow-origin
https://www.varonis.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j93&a=307386733&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F&ul=en-us&de=UTF-8&dt=Return%20of%20the%20Darkside%3A%20Analysis%20of%20a%20Large-Scale%20Data%20Theft%20Campaign&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aHBAAUABAAAAAC~&jid=&gjid=&cid=1380211509.1632337458&tid=UA-2019109-1&_gid=1991152342.1632337458&gtm=2ou9k0&cd10=10256319&cd14=Netprotect%20AS&cd15=(Non-Company%20Visitor)&cd16=Manufacturing&cd17=SMB&cd18=(Non-AccountWatch%20Visitor)&z=1112452776
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.142 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 22 Sep 2021 15:01:41 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
14557
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-2019109-1&cid=1380211509.1632337458&jid=1049148584&_u=YEBAAUAAAAAAAC~&z=554886276
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 22 Sep 2021 19:04:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/1015553108/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/1015553108/?random=1632337458218&cv=9&fst=1632337200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9k0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F&tiba=Return%20of%20the%20Darkside%3A%20Analysis%20of%20a%20Large-Scale%20Data%20Theft%20Campaign&async=1&fmt=3&is_vtc=1&random=3835100970&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.132 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 22 Sep 2021 19:04:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
px.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=23300&time=1632337458307&url=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D23300%26time%3D1632337458307%26url%3Dhttps%253A%252F%252Fwww.varonis.com%252Fblog...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=23300&time=1632337458307&url=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F&liSync=true
0
81 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=23300&time=1632337458307&url=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F&liSync=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
108.174.11.37 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS
108-174-11-37.fwd.linkedin.com
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:19 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lor1
x-li-proto
http/2
x-li-pop
prod-esv5
content-type
application/javascript
content-length
0
x-li-uuid
UWmVREU6pxbQF5ykwCoAAA==

Redirect headers

strict-transport-security
max-age=31536000
x-content-type-options
nosniff
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-length
0
x-li-uuid
AAXMmi5kp8QCsuWT5HZCtA==
pragma
no-cache
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: ED3B2A1C6EED44B7A2B5B2273EEDCF80 Ref B: PRG01EDGE1119 Ref C: 2021-09-22T19:04:18Z
date
Wed, 22 Sep 2021 19:04:18 GMT
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options
sameorigin
x-li-fabric
prod-lor1
location
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=23300&time=1632337458307&url=https%3A%2F%2Fwww.varonis.com%2Fblog%2Fdarkside-ransomware%2F&liSync=true
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri /security/csp?f=l
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
i
scout.salesloft.com/ 		48 B
511 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://scout.salesloft.com/i
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.219.76.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-219-76-19.compute-1.amazonaws.com
Software
/
Resource Hash
615e121231f1f51e108e62fd46b5d572c910a3f724e6517226022f8a51be8a76
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
strict-transport-security
max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.varonis.com
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
content-length
48
x-request-id
38af7ca94148f1d57700e5c6df8b5419
cookie-notice.css
consent.varonis.com/css/ 		2 KB
710 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://consent.varonis.com/css/cookie-notice.css
Requested by
Host: blogvaronis2.wpengine.com
URL: https://blogvaronis2.wpengine.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.154.169 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
WEBrick/1.3.1 (Ruby/2.3.7/2018-03-28) /
Resource Hash
80b9fb35343b8b2e07a060e7fceabd3cdb2d22f01fd8088bf204b042ba1bd765
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
via
1.1 vegur
last-modified
Wed, 29 Apr 2020 21:22:27 GMT
server
WEBrick/1.3.1 (Ruby/2.3.7/2018-03-28)
vary
Origin
content-type
text/css
access-control-allow-origin
*
x-iinfo
8-76977633-76970640 2NYN RT(1632337457784 0) q(0 0 0 -1) r(4 4) U2
cache-control
no-cache
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-cdn
Imperva
cookie-notice-en.html
consent.varonis.com/ 		382 B
855 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://consent.varonis.com/cookie-notice-en.html
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
45.60.154.169 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
WEBrick/1.3.1 (Ruby/2.3.7/2018-03-28) /
Resource Hash
8bc82555e70a1d2fed21308d9ce0e97919c894e7ea139e452dbf2d0a20f6df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Referer
https://www.varonis.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 22 Sep 2021 19:04:18 GMT
via
1.1 vegur
last-modified
Wed, 29 Apr 2020 21:22:27 GMT
server
WEBrick/1.3.1 (Ruby/2.3.7/2018-03-28)
vary
Origin
content-type
text/html
access-control-allow-origin
*
x-iinfo
4-62734053-62734054 NNYN CT(98 198 0) RT(1632337457800 0) q(0 0 2 0) r(4 4) U12
cache-control
no-cache
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
x-cdn
Imperva
/
www.facebook.com/tr/ Frame 137F 		0
18 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
157.240.236.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
edge-star-mini-shv-02-frx5.facebook.com
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
POST
:authority
www.facebook.com
:scheme
https
:path
/tr/
content-length
6624
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
origin
https://www.varonis.com
content-type
application/x-www-form-urlencoded
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.varonis.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
Origin
https://www.varonis.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.varonis.com/

Response headers

content-type
text/plain
access-control-allow-origin
https://www.varonis.com
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
content-length
0
server
proxygen-bolt
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority
u=3,i
date
Wed, 22 Sep 2021 19:04:18 GMT

Verdicts & Comments Add Verdict or Comment

117 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster object| html5 object| Modernizr function| $ function| jQuery object| Typekit object| screenReaderText object| global function| IFrame function| Elements function| Cookie object| MooTools function| typeOf function| instanceOf function| Type object| Browser function| $constructor function| $family function| Class function| Chain function| Events function| Options object| Slick number| uniqueNumber function| getDocument function| getWindow function| $$ function| addListener function| removeListener function| retrieve function| store function| eliminate function| DOMEvent function| addEvent function| removeEvent function| addEvents function| removeEvents function| fireEvent function| cloneEvents function| getSize function| getScroll function| getScrollSize function| getPosition function| getCoordinates function| getHeight function| getWidth function| getScrollTop function| getScrollLeft function| getScrollHeight function| getScrollWidth function| getTop function| getLeft function| Fx function| EnlighterJS object| wp object| EnlighterJS_Config function| downloadJSAtOnload function| loadError function| affixScriptToHead function| bizibleLoaded function| gAdsLoaded function| gaLoaded function| hubspotLoaded object| vidDefer function| varonisCookieConsentLoaded function| fbq function| _fbq string| _linkedin_partner_id object| _linkedin_data_partner_ids string| SLScoutObject function| slscout object| _hsp object| google_tag_manager object| dataLayer object| google_tag_data string| GoogleAnalyticsObject function| ga object| Bizible object| BizTrackingA object| BizA object| _vis_opt_queue object| LC_API object| __gcse boolean| hubspot_live_messages_running object| HubSpotConversations object| _hsq boolean| _hspb_ran boolean| _hspb_loaded function| __extends object| Demandbase object| __db function| DBSegment object| _paq function| sanitizeKey boolean| _hstc_ran string| __hsUserToken number| expireDateTime object| e boolean| _hstc_loaded object| gaplugins object| gaGlobal object| gaData function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO object| module$exports$cse$search object| module$exports$cse$CustomImageSearch object| module$exports$cse$CustomWebSearch object| google object| module$exports$cse$searchcontrol object| module$exports$cse$customsearchcontrol object| closure_lm_114726 function| lintrk boolean| _already_called_lintrk object| cookieConsent string| html_lang

37 Cookies

Domain/Path Name / Value
.varonis.com/ Name: visid_incap_2074238
Value: PHPZFnyLTE2NpH+eyjeotC9+S2EAAAAAQUIPAAAAAAASak6biLJaRv+LDng1n5+f
.varonis.com/ Name: incap_ses_474_2074238
Value: BV/LMslp8jd7v4007/yTBi9+S2EAAAAAFIwxK4wPDlwgW/VvkWwX+A==
.varonis.com/ Name: _gcl_au
Value: 1.1.1135454887.1632337458
.varonis.com/ Name: _biz_uid
Value: 966f4efaf1454925bc93559e38db44fa
.varonis.com/ Name: _biz_sid
Value: 443c8d
.varonis.com/ Name: _biz_nA
Value: 1
.bizible.com/ Name: _BUID
Value: 966f4efaf1454925bc93559e38db44fa
.varonis.com/ Name: _biz_pendingA
Value: %5B%5D
.bizibly.com/ Name: _BUID
Value: 17c82296c80a378cc9ffc7f81a409ec7
.varonis.com/ Name: __hstc
Value: 162743971.ab696e4d31d23ded26aea2f69ea43c5b.1632337458172.1632337458172.1632337458172.1
.varonis.com/ Name: hubspotutk
Value: ab696e4d31d23ded26aea2f69ea43c5b
.varonis.com/ Name: __hssrc
Value: 1
.varonis.com/ Name: __hssc
Value: 162743971.1.1632337458172
.varonis.com/ Name: _ga
Value: GA1.2.1380211509.1632337458
.varonis.com/ Name: _gid
Value: GA1.2.1991152342.1632337458
.varonis.com/ Name: _gat_gtag_UA_2019109_1
Value: 1
.varonis.com/ Name: _fbp
Value: fb.1.1632337458210.1855388206
.hubspot.com/ Name: __cf_bm
Value: 76qXkZeuO6SkgOSYltm01UNMkXVhIK9Lka2DGqiwBU0-1632337458-0-AUqnBKfzTFXrU1jOEaiXffKfWm1G5BH5jQBatHXVDRl+Hy7ydzXnTfQZYW3QJ8NSJGgm6BpkNZdIaLw5SY1wtBc=
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.varonis.com/ Name: _biz_flagsA
Value: %7B%22Version%22%3A1%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.bidr.io/ Name: bito
Value: AADqh07ClvwAACE7FbeOjQ
.bidr.io/ Name: bitoIsSecure
Value: ok
www.varonis.com/ Name: slireg
Value: https://scout.us1.salesloft.com
.varonis.com/ Name: visid_incap_2246311
Value: QgO9eklSQ5ua0sl2IW/WlzF+S2EAAAAAQUIPAAAAAACm6wLqkF26DDGs2X31hvxr
.varonis.com/ Name: nlbi_2246311
Value: Ni3VNhVimh5vbvutiwCEuwAAAADDRSI0HYCdu6QCvjQky00b
.varonis.com/ Name: incap_ses_474_2246311
Value: KfJaNS0u0QONwY007/yTBjF+S2EAAAAAyr0nDTpM046XoXCddxKnog==
.company-target.com/ Name: tuuid
Value: 0549e906-63ee-43c1-9ae7-9a8cac106391
.company-target.com/ Name: tuuid_lu
Value: 1632337458
www.varonis.com/ Name: sliguid
Value: 18afcea9-76eb-4293-b1f6-263577e57d58
www.varonis.com/ Name: slirequested
Value: true
.linkedin.com/ Name: UserMatchHistory
Value: AQIzrZ_UaHATwgAAAXwO5PYgQ-lb6jhVYFWYv1hfTdXri2-pdQhnvZ0MaCPpcst0EcB-DC4pxkJxww
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQIAvKBdgtyXgAAAAXwO5PYgzlDo41Q4aGtPUhO8tyXGPuM-NW6Fuq6uCrmQSzmlX3dDasDnX4_sGvyO3ep6oA
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&de44f53f-57da-43c5-84cb-d12bde7365d3"
.linkedin.com/ Name: lidc
Value: "b=OGST02:s=O:r=O:a=O:p=O:g=2486:u=1:x=1:i=1632337458:t=1632423858:v=2:sig=AQE_UNky-97ufVB5sl9EOcxHgzK8DDwt"
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&20210922190418e01f828e-1894-4010-852a-7a4a9655e918AQH8Fe7ESI-cCxctg5TqyFSRvm5Yaoi4"

1 Console Messages

Source Level URL
Text
network error URL: https://id.rlcdn.com/464526.gif
Message:
Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.company-target.com
api.hubspot.com
app.salesloft.com
blogvaronis2.wpengine.com
cdn.bizible.com
cdn.bizibly.com
cdnjs.cloudflare.com
connect.facebook.net
consent.varonis.com
cse.google.com
googleads.g.doubleclick.net
id.rlcdn.com
js-na1.hs-scripts.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.usemessages.com
match.prod.bidr.io
p.typekit.net
px.ads.linkedin.com
scout-cdn.salesloft.com
scout.salesloft.com
segments.company-target.com
snap.licdn.com
stats.g.doubleclick.net
t.varonis.com
tag.demandbase.com
track.hubspot.com
use.typekit.net
www.facebook.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.varonis.com
100.25.67.184
104.111.215.74
104.16.19.94
104.17.211.204
104.17.236.204
104.17.68.176
104.18.21.191
104.19.154.83
104.19.155.83
108.174.11.37
13.107.42.14
13.224.193.108
13.225.78.109
13.225.78.2
142.250.185.142
142.250.186.142
142.250.186.162
142.250.186.34
152.195.15.58
157.240.236.1
157.240.236.35
216.58.212.132
216.58.212.168
23.111.9.64
23.41.169.41
3.209.22.10
3.219.76.19
35.239.147.27
35.244.174.68
45.60.154.169
52.16.214.249
74.125.206.154
92.122.244.59
0130ac55fdd6f3467455879286ca7936cc38991c42e21c533014758001f7c6b5
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0899c22c6b5ecb084f0746f194d82a887c52906770ff9b168eabdc775da7c728
0ccc8a089a5c15b3ddafd513681885bac6d84b828e57b8afe2d3d41514fb5bdb
10d4196f80a46f2d411ad62881684a77342baa71c461a2a6c6f56efb95ab7f0d
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11c13361754d814930d22d9b712f37c3b501b50c9d9d356b2c7b239ac5d09472
165c8bd3fffa97fa49734f10bffd39aec2c7190a3349acfc1b7e0a9b16447691
17d2eba457170f9a4e195b1c55ee8e9d25e8d15bbcfa705a3692baa564c8f1bd
1807314e3ad37de67f251000fc9fdc8fad8024a4803706b05fc38eebd42ed71f
1eaa1020765fe443319fc3b05d23fc90a21764df47893d9bb159c72d131932d4
20b827ee733970c15c0f1e933be3a7a14a7b02b81f005ad320b2a9578b04eacb
226b15064fa1b99881c51f34ef2394f67c4b4a1b985e420e7a8980f354ff44fe
258c11266f97658b953d1096682dc775964b49265f7d1d3f6dd45fdb0dcae36c
259ca84f380e0a4a327867ce595dbb02ea8f3fe8ae0e96f902e0051fc44c194c
2a6e2fd26469cea471cc4bf0df35a98e15ea1f03a516045612c78b6f008b3241
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
32ff3f30afd81df27058a10dc10423dacdac2ade84c9ae0219645de204b2fa18
391301ac20bad013ced6c6fd6d300b103fc7870800b413a332cce722cadaf9e7
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
4107e7ffd0644249a155ecfd6ac589440784f0c84a93ee612b088bec177a647f
422b5426f800bf80ba300f90fef3e8a3f140dcbbe6d438afb8c26212c08094cc
4c1355d27b14881a055e00a4a2afa4608b452c9780ac5c61e1b8f9fd55fa3e1e
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2
510f80deee6c59f4978fdc2a9939e473e2d34e761495fc8b63d2937f90363eca
59858d560467c272b1e6faa2f94dca83f00d14a2d48667540ab3c73c318ce596
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5d6078edf0103c72f5583f76ae5b32637240e648a2a38a093bd16423c658ba28
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
615e121231f1f51e108e62fd46b5d572c910a3f724e6517226022f8a51be8a76
6c8e52ec47acf191a6284f374f24b0053d0c1a3ed2a09d3460e390ad52d519cd
6d4083520c18bfdcdffb319248525ebf8f1a547326e10c02e6a0ed0b1722ae9a
6d954f3e13ca2d77d08aa911d4815601ba8e0b42cf37be844ac59828aceefab7
6dae08808413fb52897d5dfde2ee46682f45c46886702c83a107725d9b79f3d5
749b7eca519fbf896bffd8d40653163b05ff23babc9da40697836ff3b519fdea
764ca7fe7918b60249c36e2bc0d391b76d5c0a6caa03543a466f7bd7361ac422
7e01c1f46d29e8a778c9b2ae372f63fe76a2dc5c3629c441dcf52ea7b51190c0
80b9fb35343b8b2e07a060e7fceabd3cdb2d22f01fd8088bf204b042ba1bd765
832fcb7a625f828fb8cd99e39ef1b9abe50f1bc164a0aeeeed1ef15fa7505deb
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8a700119cb9ef415acdfe7feaf2b63335bc09a99aba07d5bdfafb008b8c2ad5c
8bc82555e70a1d2fed21308d9ce0e97919c894e7ea139e452dbf2d0a20f6df9a
8df33f5a2b28fbfb1f0a207b154d5ad7fc25554cc1aee89395240b5227d99d19
92165e3f1c1397b39fb790aee4994f2d0928e307d3934d586f0e822255b1b1ae
94fc1b6f57eaec5b66d02212a4a8c63fb22b3b46c2643d76c1b39edeea337b71
970ff94ed9b8c359b6bd170753208276095788da18c7a205fc6c1d1989e04c10
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
a3302cc2db3e453e0ed6cec90688d9ee263fa7849ffb35ca852854f11d90939b
a4e939656f7960d4bceefffb2d6321f194fa2cf2199b741720a6d4be6037ed9a
a959317813b70f3a91aceafa835bee05b1cf81ca27f7d2b7acbaed4a9c7a8762
ab43cf929d649dba8ce38c92dec4849c8049b678fec9942ae08df5ca57757280
ac588a22069fd96f7979ef0eb66728f0c45d9594c49bea515afe79d229591cdd
acfdcdc2e0d047ee844c9f7d2b5617e6cd40686dfd02a9d7fb7381b01bea3789
ae55c313220f063fdb3dc157a89a22e6a20a400cdd5b639a5aabfa4ae91e476a
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b3477dede55e6ca5237371ec235d4ebc3bea3361df5f8cf8155533e5d185579b
b67e2d756ec28f9e26b8a7bfd3569f10bf400bfe41a06941072beae36be58fa4
b87ef2efd898acfddc8308449b24a558eca1e77f8e66802f03fab8c5d063d92a
ba248c9f36442fceef93b25bc4577993797ab7255b16ec87be25d8cec31d559d
bcada3fb8ba74f6737ee9e798c50512e274a4227ef0a165b84d6ef3f2f0f5c1f
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bf7a0b99faebf6d4add94e396e7feab2a95805c3e535a16e09f8752353870958
bf9cb2d18e0a7c1296d7a96d21a5263d86ea41f3352b4fcf90d913c7234fec8a
ceb4ce0bba67a12e21af094eb24293d7ea8bffaffc237a1cd90394c7588eaec9
d16813b84a1d4acfc8d5f64cc2513a993a6ccbb3c4e380849b68946ecde2b755
d2b82e612d2a812e8be2a57300dab8923c4f2edbe7a799e7da70791b595646fe
d4afb6d225bf5353945879dd3231503be4ed70bdbf8699590d92f57f85f1ff21
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89
de22a1f465480545ea9595d61c16ad21ad40e6b2509cca0e76d2601980e52988
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e05ae076790852a21a47535d8a06e4ebdfc3079536d9c3f9f91d9f5b29303f0e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9b8c13480d06b8971129ff9382b2a33f6aa706ab05c5d8ec239806afe20ebf8
ebd572282cedc6e8893c11479a654cb9dce963c134ae4271d096eecc5115a5ea
ecf7a598ea9d606fd207d8ea33bcb78c3b7fa646ae13fcdc87601b11abb5fd1a
ed839d9fae4a8e722e9c408c2716a6f1eb789b99ef16722cd39ff4965749d8fb
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f4e8c8dbefc2cd77738662930dff811a9608ddae5a042a29737bc6f1921c9b82
f6e380d277704c9f2e82b8a271fa21d2589a35d8b3c398c2a0f660073a1bd29e
fa9d68ba73efe79a96af58eec1576eee543c1119d0af8db251fbaca8fa1c1c66
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3