darktrace.com Open in urlscan Pro
54.194.170.100 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Effective URL:
https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Submission: On September 29 via api (September 29th 2022, 5:22:46 pm UTC) from US — Scanned from DE

Summary HTTP 52 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 22 IPs in 4 countries across 19 domains to perform 52 HTTP transactions. The main IP is 54.194.170.100, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is darktrace.com. The Cisco Umbrella rank of the primary domain is 105742.
TLS certificate: Issued by R3 on July 16th 2022. Valid for: 3 months.

This is the only time darktrace.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 4	172.67.0.161 172.67.0.161	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	54.194.170.100 54.194.170.100	16509 (AMAZON-02) (AMAZON-02)
6	2600:9000:249... 2600:9000:2490:6200:12:9e5f:cac0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:806::2004	15169 (GOOGLE) (GOOGLE)
11	2606:4700:440... 2606:4700:4400::6812:2962	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:827::2008	15169 (GOOGLE) (GOOGLE)
3	2600:9000:225... 2600:9000:225e:7c00:1:28b3:b280:93a1	16509 (AMAZON-02) (AMAZON-02)
1	52.222.232.99 52.222.232.99	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
1	108.138.17.46 108.138.17.46	16509 (AMAZON-02) (AMAZON-02)
3	2600:9000:211... 2600:9000:211a:5800:11:3b84:d200:93a1	16509 (AMAZON-02) (AMAZON-02)
1	108.138.1.193 108.138.1.193	16509 (AMAZON-02) (AMAZON-02)
7	52.84.174.99 52.84.174.99	16509 (AMAZON-02) (AMAZON-02)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	18.66.97.57 18.66.97.57	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:11a... 2a02:26f0:11a::6867:4868	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400d:80a::2003	15169 (GOOGLE) (GOOGLE)
52	22

4 172.67.0.161 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

www.darktrace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ir.darktrace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
careers.darktrace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.194.170.100 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-194-170-100.eu-west-1.compute.amazonaws.com

darktrace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:2490:6200:12:9e5f:cac0:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets-global.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700:4400::6812:2962 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn-ukwest.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:225e:7c00:1:28b3:b280:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.weglot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.232.99 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-232-99.fra56.r.cloudfront.net

d3e54v103j8qbb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.17.46 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-17-46.fra56.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:211a:5800:11:3b84:d200:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.1.193 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-1-193.fra56.r.cloudfront.net

www.datadoghq-browser-agent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 52.84.174.99 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-174-99.cdg50.r.cloudfront.net

cdn-api.weglot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.57 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-57.fra56.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:11a::6867:4868 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:80a::2003 (Ireland)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	onetrust.com cdn-ukwest.onetrust.com — Cisco Umbrella Rank: 6306 geolocation.onetrust.com — Cisco Umbrella Rank: 681	149 KB
10	weglot.com cdn.weglot.com — Cisco Umbrella Rank: 13831 cdn-api.weglot.com — Cisco Umbrella Rank: 47721	42 KB
9	website-files.com assets-global.website-files.com — Cisco Umbrella Rank: 11517 assets.website-files.com — Cisco Umbrella Rank: 11421	417 KB
6	darktrace.com 3 redirects www.darktrace.com — Cisco Umbrella Rank: 756960 darktrace.com — Cisco Umbrella Rank: 105742 ir.darktrace.com careers.darktrace.com	14 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 365 www.linkedin.com — Cisco Umbrella Rank: 625 px4.ads.linkedin.com — Cisco Umbrella Rank: 6161	3 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 64	225 KB
2	google.com www.google.com — Cisco Umbrella Rank: 2	1 KB
1	google.de www.google.de — Cisco Umbrella Rank: 6301	548 B
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2852	345 B
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 129	16 KB
1	doubleclick.net 9120626.fls.doubleclick.net Failed googleads.g.doubleclick.net — Cisco Umbrella Rank: 42	2 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 758	3 KB
1	company-target.com api.company-target.com — Cisco Umbrella Rank: 3368	1 KB
1	rlcdn.com id.rlcdn.com — Cisco Umbrella Rank: 555	98 B
1	datadoghq-browser-agent.com www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 2348	14 KB
1	demandbase.com tag.demandbase.com — Cisco Umbrella Rank: 4650	19 KB
1	gstatic.com www.gstatic.com	157 KB
1	cloudfront.net d3e54v103j8qbb.cloudfront.net	30 KB
0	bidr.io Failed match.prod.bidr.io Failed
52	19

	Domain	Requested by
10	cdn-ukwest.onetrust.com	darktrace.com cdn-ukwest.onetrust.com
7	cdn-api.weglot.com	cdn.weglot.com
6	assets-global.website-files.com	darktrace.com
3	assets.website-files.com	assets-global.website-files.com
3	cdn.weglot.com	darktrace.com cdn.weglot.com
3	www.googletagmanager.com	darktrace.com www.googletagmanager.com
2	px.ads.linkedin.com	2 redirects
2	www.google.com	darktrace.com
2	darktrace.com	1 redirects
2	www.darktrace.com	2 redirects
1	www.google.de	darktrace.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	px4.ads.linkedin.com	darktrace.com
1	www.linkedin.com	1 redirects
1	region1.google-analytics.com	www.googletagmanager.com
1	geolocation.onetrust.com	cdn-ukwest.onetrust.com
1	www.googleadservices.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	api.company-target.com	tag.demandbase.com
1	id.rlcdn.com	darktrace.com
1	www.datadoghq-browser-agent.com	cdn.weglot.com
1	careers.darktrace.com	darktrace.com
1	ir.darktrace.com	darktrace.com
1	tag.demandbase.com	darktrace.com
1	www.gstatic.com	www.google.com
1	d3e54v103j8qbb.cloudfront.net	darktrace.com
0	9120626.fls.doubleclick.net Failed	www.googletagmanager.com
0	match.prod.bidr.io Failed	darktrace.com
52	28

This site contains links to these domains. Also see Links.

Domain
customerportal.darktrace.com
partners.darktrace.com
careers.darktrace.com
ir.darktrace.com
fr.darktrace.com
it.darktrace.com
ko.darktrace.com
ja.darktrace.com
es.darktrace.com
de.darktrace.com
pt-br.darktrace.com
rikoostenbroek.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
darktrace.com R3	`2022-07-16` - `2022-10-14`	3 months	crt.sh
*.website-files.com Amazon	`2021-11-12` - `2022-12-10`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-07-18` - `2023-07-18`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.weglot.com Amazon	`2022-03-09` - `2023-04-07`	a year	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2022-08-17` - `2023-09-18`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-04` - `2023-06-03`	a year	crt.sh
*.datadoghq-browser-agent.com DigiCert TLS RSA SHA256 2020 CA1	`2022-02-17` - `2023-02-18`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2022-09-16` - `2023-10-18`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-09-05` - `2022-11-28`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Frame ID: E7C9B8199CC381ECF24CA6B2424275AC
Requests: 52 HTTP requests in this frame

Frame: https://9120626.fls.doubleclick.net/activityi;src=9120626;type=unive0;cat=darkt00;ord=1293298074684;gtm=2wg9s0;auiddc=1937597845.1664472161;~oref=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522
Frame ID: E364BF431C56A837233387A582BB8C82
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Page Not Found | DarktraceBack ButtonSearch IconFilter Icon

Page URL History Show full URLs

http://www.darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 HTTP 301
https://www.darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 HTTP 302
https://darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 HTTP 301
https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 Page URL

Detected technologies

AdonisJS (Web frameworks) Expand

Overall confidence: 100%
Detected patterns

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

otSDKStub\.js

Weglot (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

cdn\.weglot\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

52
Requests

94 %
HTTPS

55 %
IPv6

19
Domains

28
Subdomains

22
IPs

4
Countries

1089 kB
Transfer

3622 kB
Size

19
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://customerportal.darktrace.com/
Title: Customer Portal

Search URL Search Domain Scan URL

URL: https://partners.darktrace.com/
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://partners.darktrace.com/apply
Title: Become a partner

Search URL Search Domain Scan URL

URL: https://careers.darktrace.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://ir.darktrace.com/
Title: Investors

Search URL Search Domain Scan URL

URL: https://fr.darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Title: Français

Search URL Search Domain Scan URL

URL: https://it.darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Title: Italiano

Search URL Search Domain Scan URL

URL: https://ko.darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Title: 한국어

Search URL Search Domain Scan URL

URL: https://ja.darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Title: 日本語

Search URL Search Domain Scan URL

URL: https://es.darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Title: Español

Search URL Search Domain Scan URL

URL: https://de.darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://pt-br.darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Title: Português Brasileiro

Search URL Search Domain Scan URL

URL: https://rikoostenbroek.com/
Title: Rik Oostenbroek

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 HTTP 301
https://www.darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 HTTP 302
https://darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 HTTP 301
https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 41

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1664472161857&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm=gtmv2 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D67174%26time%3D1664472161857%26url%3Dhttps%253A%252F%252Fdarktrace.com%252Fblog%252Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%252F%252F%252F%252F%252522%26tm%3Dgtmv2%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1664472161857&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm=gtmv2&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1664472161857&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm=gtmv2&liSync=true&e_ipv6=AQIGB-1U3hYHvQAAAYOKRaEvNTZcq5i5iY91VZCgwU9xFYMXkMLB5y4LyFiMHX-Vung5R9Ao_VTDYhK-ezbKYWEaX9FkQg

52 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

404

Primary Request %22 Show response
darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////
Redirect Chain

http://www.darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
https://www.darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
https://darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

55 KB
13 KB

1959ms
1958ms

Document
text/html

54.194.170.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.194.170.100 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-194-170-100.eu-west-1.compute.amazonaws.com

Software

openresty /

Resource Hash

1ac14370a15095bf8ab55d13146970017c326c130e8d6e2b1b75b77eb256c495

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: private, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: frame-ancestors 'self'
content-type: text/html
date: Thu, 29 Sep 2022 17:22:41 GMT
etag: W/"5b146aa5856a14bec0d82c22f2968ef6"
last-modified: Thu, 29 Sep 2022 10:58:37 GMT
server: openresty
strict-transport-security: max-age=31536000; includeSubDomains
vary: x-wf-forwarded-proto, Accept-Encoding
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-cluster-name: eu-west-1-prod-edge-blue
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-served-by: cache-iad-kjyo7100054-IAD, cache-dub4337-DUB
x-timer: S1664472159.110510,VS0,VE1914

Redirect headers

accept-ranges: bytes
cache-control: private
content-length: 166
content-security-policy: frame-ancestors 'self'
content-type: text/html
date: Thu, 29 Sep 2022 17:22:39 GMT
location: /blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
server: openresty
strict-transport-security: max-age=31536000; includeSubDomains
vary: x-wf-forwarded-proto
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-cluster-name: eu-west-1-prod-edge-blue
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-served-by: cache-iad-kjyo7100037-IAD, cache-dub4324-DUB
x-timer: S1664472159.926642,VS0,VE136

GET
H2 200 web-phoenix.f73cd6de7.min.css
assets-global.website-files.com/626ff19cdd07d1258d49238d/css/ 267 KB
42 KB 108ms
28ms Stylesheet
text/css 2600:9000:2490:6200:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/css/web-phoenix.f73cd6de7.min.css
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:6200:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1ce112404e88b01a6301e730a31e9df68dfd512ebd22e648d3f49025e5bf55ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: jHeSFffwc6vHHnU4xKZelcm1StEC9_Iy
content-encoding: gzip
via: 1.1 f61953901038b0c4b4c82c311140f1b8.cloudfront.net (CloudFront)
date: Thu, 29 Sep 2022 08:20:39 GMT
age: 32523
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 42783
last-modified: Mon, 26 Sep 2022 09:50:09 GMT
server: AmazonS3
etag: "e2f6c30ed2ebe1bf54c6d86f85183e8f"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: mJOwXDuoPV3XHjn3apCctp1nTp1kkTvajJ2Vywh5mV2lyM0Wo-n_dg==

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
966 B 84ms
40ms Script
text/javascript 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7d67f38229c8dac8429af4c162d42073e4abd4337a86ec54a18d3ad7e010b2a8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 17:22:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 553
x-xss-protection: 1; mode=block
expires: Thu, 29 Sep 2022 17:22:41 GMT

GET
H2 200 OtAutoBlock.js Show response
cdn-ukwest.onetrust.com/consent/2f0e2e84-c239-468b-b9dc-95c94890809c/ 6 KB
2 KB 147ms
93ms Script
application/x-javascript 2606:4700:4400::6812:2962
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/consent/2f0e2e84-c239-468b-b9dc-95c94890809c/OtAutoBlock.js

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71e525f4a8cfaa33a6b13bf5ba608ca1c0c8e38b7616b031a18c33460ba690f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 29 Sep 2022 17:22:41 GMT
content-encoding: gzip
cf-cache-status: HIT
content-md5: fuiobenC4rhpGzZ+ojecDg==
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 2037
x-ms-lease-status: unlocked
last-modified: Thu, 25 Aug 2022 13:43:49 GMT
server: cloudflare
etag: 0x8DA869FD7619B28
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: ad538e91-901e-000a-2d82-d33d12000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 752666ff0d4b5c8c-FRA

GET
H2 200 otSDKStub.js Show response
cdn-ukwest.onetrust.com/scripttemplates/ 21 KB
8 KB 135ms
81ms Script
application/javascript 2606:4700:4400::6812:2962
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 29 Sep 2022 17:22:41 GMT
content-encoding: gzip
cf-cache-status: HIT
content-md5: 7BKk7WQU1Z9EDMZmf1T6Vg==
age: 13514
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 7151
x-ms-lease-status: unlocked
last-modified: Tue, 13 Sep 2022 20:31:51 GMT
server: cloudflare
etag: 0x8DA95C6FD5D06A0
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 63962eac-801e-0015-6c82-d3e602000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 752666ff0d4e5c8c-FRA
expires: Thu, 29 Sep 2022 21:22:41 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
76 KB 124ms
52ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N8JM61T88C

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

63997947a96223955cf4d7d0497089d77905bed5a70b406f5dc7e957bad4f7ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 17:22:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 77869
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 29 Sep 2022 17:22:41 GMT

GET
H2 200 weglot.min.js Show response
cdn.weglot.com/ 77 KB
27 KB 85ms
33ms Script
application/javascript 2600:9000:225e:7c00:1:28b3:b280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.weglot.com/weglot.min.js
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:7c00:1:28b3:b280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8610afc6cdee1077fbaa76778cc7aa717047a83990d8ee8f92422324aa0043b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
via: 1.1 8b360b28aeb67c1982fcc466a05eef02.cloudfront.net (CloudFront)
date: Thu, 29 Sep 2022 17:02:31 GMT
last-modified: Thu, 29 Sep 2022 10:30:17 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 1210
etag: W/"67a52d1bcddc2f9d4fc1a5276f60deef"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: max-age=1800
x-amz-cf-id: _gDEpxMIrh8qAeYNP2tQ5jrpUSXp9eBc1qflQHWJAm4q0ISacCZWhQ==

GET
H2 200 page-not-found.211a85e40c.svg
assets-global.website-files.com/static/ 754 B
1 KB 61ms
60ms Image
image/svg+xml 2600:9000:2490:6200:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/static/page-not-found.211a85e40c.svg
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:6200:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 58afd37317e5adb23a1e2b5006169e2350cdbc8948ee7998250fce897f3fb699

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: 0gxtxNJ0N3yfqHO_jy8.CvIJW1g5Fi8V
date: Thu, 29 Sep 2022 06:17:32 GMT
via: 1.1 f61953901038b0c4b4c82c311140f1b8.cloudfront.net (CloudFront)
age: 39910
x-amz-cf-pop: FRA56-P6
x-cache: Hit from cloudfront
content-length: 754
last-modified: Mon, 19 Dec 2016 20:52:42 GMT
server: AmazonS3
etag: "211a85e40c7aeb39347a880746cd17c3"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: z6sis0RyM9VkLbw36SesYoPFtaqSqZcj17eNotWX80sAUv-gUBqgPA==

GET
H2 200 jquery-3.5.1.min.dc5e7f18c8.js Show response
d3e54v103j8qbb.cloudfront.net/js/ 87 KB
30 KB 67ms
19ms Script
application/javascript 52.222.232.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=626ff19cdd07d1258d49238d
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.232.99 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-232-99.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://darktrace.com/
Origin: https://darktrace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 07:33:32 GMT
content-encoding: br
via: 1.1 a89f27dcb39a061266ddc18ab5416cba.cloudfront.net (CloudFront)
last-modified: Mon, 20 Jul 2020 17:53:02 GMT
server: AmazonS3
age: 35349
x-amz-cf-pop: FRA56-P4
etag: W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
x-amz-cf-id: aSpA4tR-VUL_IOAyOti_Ln1TfoZbhLIhsgBoEeO0igLwmxfluGmC3A==

GET
H2 200 web-phoenix.10d291b65.js Show response
assets-global.website-files.com/626ff19cdd07d1258d49238d/js/ 899 KB
164 KB 21ms
20ms Script
text/javascript 2600:9000:2490:6200:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/js/web-phoenix.10d291b65.js
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:6200:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1a7f603a9dd1e0a381c028839fdc00b6c6bfa4869b4a8ba22ecda60037ebcaac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: b3QBRifuAUbmIfEXoQg7fnI8XQGmguYp
content-encoding: gzip
via: 1.1 f61953901038b0c4b4c82c311140f1b8.cloudfront.net (CloudFront)
date: Thu, 29 Sep 2022 02:41:55 GMT
age: 52847
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 166956
last-modified: Mon, 26 Sep 2022 09:50:09 GMT
server: AmazonS3
etag: "e316235c2d8f3ca53c09689c42fc2a1a"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
accept-ranges: bytes
x-amz-cf-id: 01OyMzdjxy3eL-wEutW598Qe2T5X52qjvg9bT1W6JBLGkr8CcExY9g==

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/ovmhLiigaw4D9ujHYlHcKKhP/ 391 KB
157 KB 88ms
17ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/ovmhLiigaw4D9ujHYlHcKKhP/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8ad74b30972057e9efc8dd2c5d013ed97938050ceab38f1209780d584bcd6fb3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://darktrace.com/
Origin: https://darktrace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 16:48:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2060
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 159555
x-xss-protection: 0
last-modified: Mon, 19 Sep 2022 04:01:43 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 29 Sep 2023 16:48:21 GMT

GET
H2 200 2f0e2e84-c239-468b-b9dc-95c94890809c.json Show response
cdn-ukwest.onetrust.com/consent/2f0e2e84-c239-468b-b9dc-95c94890809c/ 3 KB
2 KB 245ms
124ms XHR
application/x-javascript 2606:4700:4400::6812:2962
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/consent/2f0e2e84-c239-468b-b9dc-95c94890809c/2f0e2e84-c239-468b-b9dc-95c94890809c.json

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b59b82343b78feaa04fa094535c326c677790b720a2265af536515cd394aa783

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 29 Sep 2022 17:22:41 GMT
content-encoding: gzip
cf-cache-status: HIT
content-md5: Fx5Ovc4SHCpDGzlD8Kz5ZA==
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 1386
x-ms-lease-status: unlocked
last-modified: Thu, 25 Aug 2022 13:43:43 GMT
server: cloudflare
etag: 0x8DA869FD3850293
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 45d5a468-b01e-0070-2382-d3575f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 75266700ab74bb4d-FRA

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 204 KB
73 KB 104ms
33ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PW765SZ

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fb7f87a6ab9c9ad7846ad408ff3b49a5b534ffe8fd356fe2d2ac5abe915c2f3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 17:22:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 73956
x-xss-protection: 0
last-modified: Thu, 29 Sep 2022 16:08:40 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 29 Sep 2022 17:22:41 GMT

GET
H2 200 234baeaaccaa2f09e0dc6c004f571bbd6.json Show response
cdn.weglot.com/projects-settings/ 3 KB
1 KB 55ms
23ms Fetch
application/json 2600:9000:225e:7c00:1:28b3:b280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.weglot.com/projects-settings/234baeaaccaa2f09e0dc6c004f571bbd6.json
Requested by: Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:7c00:1:28b3:b280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9e99633019ba6c0b831c31db1434d00425281752f6a166672df04bc31d8a6c06

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 14:04:07 GMT
x-amz-version-id: null
content-encoding: gzip
last-modified: Thu, 29 Sep 2022 14:02:42 GMT
server: AmazonS3
via: 1.1 32db37931b5639dc27ebaba3ad4f3d2c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P4
etag: W/"b28c22ec5722f788c24fff6e9eb42c3c"
age: 11915
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-cf-id: v0ByRinVLexWLgu6Ql1zdyJNuZrz7hU05xsNty8yAwNy5HiPz2ZLgg==

GET
H2 200 20cb0107a53f0895.min.js Show response
tag.demandbase.com/ 67 KB
19 KB 93ms
20ms Script
application/javascript 108.138.17.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/20cb0107a53f0895.min.js

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.17.46 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-17-46.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

3f623ccadc235f1eefffd70383b9acca84b973e118c4aba4414dd53e260b8a4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: luxB1klmgR_mmJbI.dzpxY08W_x1L5zM
content-encoding: gzip
via: 1.1 d34cf2ddbdf9774517330fee6a26e4b2.cloudfront.net (CloudFront)
date: Thu, 29 Sep 2022 16:34:34 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-amz-cf-pop: FRA56-P7
age: 2888
x-cache: Hit from cloudfront
last-modified: Fri, 23 Sep 2022 17:24:28 GMT
server: AmazonS3
etag: W/"96d30157c6c461e7ba4d452260e013ad"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-id: 6xhlnh5nqv8junuFx1KL70AVjTjHiix3SIWj3uw17-4YgWriTEvLzw==

GET
H2 200 62aa2f88b8c0342cb0b7fbef_TypeType%20-%20TT%20Interphases%20Pro%20Regular.ttf
assets.website-files.com/626ff19cdd07d1258d49238d/ 136 KB
63 KB 136ms
39ms Font
application/x-font-ttf 2600:9000:211a:5800:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/626ff19cdd07d1258d49238d/62aa2f88b8c0342cb0b7fbef_TypeType%20-%20TT%20Interphases%20Pro%20Regular.ttf
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/css/web-phoenix.f73cd6de7.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211a:5800:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a6fd219289d32bb4cdc8e8831a6f56c5cc0e4246f324bb598277e0c9036753d4

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://darktrace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 09 Sep 2022 02:11:58 GMT
x-amz-version-id: pdAuGtTsh6vh4TYRUxRutxs_j7OuOOpJ
content-encoding: br
via: 1.1 881b12332738e10f6e80298fbdcd7e8e.cloudfront.net (CloudFront)
age: 1782644
x-amz-cf-pop: VIE50-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Wed, 15 Jun 2022 19:35:09 GMT
server: AmazonS3
etag: W/"c1b8cbcc934aea3e53c8fc4904d8060d"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: 8RtEPEfyQXctXQ3iLx_vs-TPfcKXFS-WLts6gcMTlctQHTVBxDHbjg==

GET
H2 200 62c4e22e866dec1fe2712cb3_Darktrace%20Logo%20B%3AO%20-%20Vector.svg
assets-global.website-files.com/626ff19cdd07d1258d49238d/ 8 KB
3 KB 54ms
54ms Image
image/svg+xml 2600:9000:2490:6200:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/62c4e22e866dec1fe2712cb3_Darktrace%20Logo%20B%3AO%20-%20Vector.svg
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:6200:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ef6b6ed623b9789747d2e491b3ad692793d461be2f27bdf0c531b2d953fa670d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Tue, 02 Aug 2022 16:03:41 GMT
x-amz-version-id: U3NyuUAtCMgfEVbn9mSuYAOoErDsuB9M
content-encoding: br
via: 1.1 f61953901038b0c4b4c82c311140f1b8.cloudfront.net (CloudFront)
age: 5015941
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Wed, 06 Jul 2022 01:15:27 GMT
server: AmazonS3
etag: W/"c34059ce90d8a25cb81c8342bac3caad"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-id: AxVaaUcVzXRH3eNtCVDunM_m5gVEayWT8BltKEhu8peMCFUOHNlMaA==

GET
H2 200 /
ir.darktrace.com/ 0
0 149ms
130ms Other
text/html 172.67.0.161
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ir.darktrace.com/
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.0.161 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

GET
H2 200 /
careers.darktrace.com/ 0
0 180ms
163ms Other
text/html 172.67.0.161
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://careers.darktrace.com/
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.0.161 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

GET
H2 200 62aa2f9a73505602c43cdef2_TypeType%20-%20TT%20Interphases%20Pro%20Bold.ttf
assets.website-files.com/626ff19cdd07d1258d49238d/ 135 KB
63 KB 124ms
39ms Font
application/x-font-ttf 2600:9000:211a:5800:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/626ff19cdd07d1258d49238d/62aa2f9a73505602c43cdef2_TypeType%20-%20TT%20Interphases%20Pro%20Bold.ttf
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/css/web-phoenix.f73cd6de7.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211a:5800:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: adecd63acc4782d7f6bea59bda9e02bfcc6f90ed14ace7f83e06c6c814b58e2a

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://darktrace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 04:15:28 GMT
x-amz-version-id: w8aES_2JIQeWMFtSaIseSTPNz4Sh5jKS
content-encoding: br
via: 1.1 881b12332738e10f6e80298fbdcd7e8e.cloudfront.net (CloudFront)
age: 2207232
x-amz-cf-pop: VIE50-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Wed, 15 Jun 2022 19:33:53 GMT
server: AmazonS3
etag: W/"a2975bcd95ef12e21b2c7596dfb5828d"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: LWXUp2fjoG8VSUPiyx4wiOqQ2iuFkyUgJxy4L-NSIl-7m4prb7EeuQ==

GET
H2 200 62aa1da43aa2d3525162b7ca_Cyber%20Essentials.png
assets-global.website-files.com/626ff19cdd07d1258d49238d/ 4 KB
5 KB 43ms
42ms Image
image/png 2600:9000:2490:6200:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/62aa1da43aa2d3525162b7ca_Cyber%20Essentials.png
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:6200:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 21dea0cdc956cea9bb658cc7338d5a7526ba4bee4a4e2c15b2d067b57734b3ab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Wed, 03 Aug 2022 09:09:29 GMT
x-amz-version-id: 6XwZh1Fiwma3h9iKHNFiypOx.wr2_RKl
via: 1.1 f61953901038b0c4b4c82c311140f1b8.cloudfront.net (CloudFront)
age: 4954393
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 4571
last-modified: Wed, 15 Jun 2022 17:57:57 GMT
server: AmazonS3
etag: "0ae37aa84e0802a9679e796afacf31be"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: E8_L15rhSua_Bh3_q8ThWoJQH7m-06mqGhNa9ereqzbtMYkCtI_XoA==

GET
H2 200 62bb366a0ea7e3dcd974222f_iso-27001.png
assets-global.website-files.com/626ff19cdd07d1258d49238d/ 10 KB
10 KB 44ms
44ms Image
image/png 2600:9000:2490:6200:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/62bb366a0ea7e3dcd974222f_iso-27001.png
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:6200:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9215591d842950b73dfde60917a48e309c617d3787046db80940902e4f8368ee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 16 Jul 2022 20:38:45 GMT
x-amz-version-id: eipit0vlrYAgfAGDx6gL12dFYiEq9lWS
via: 1.1 f61953901038b0c4b4c82c311140f1b8.cloudfront.net (CloudFront)
age: 6468237
x-amz-cf-pop: FRA56-P6
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 10209
last-modified: Tue, 28 Jun 2022 17:12:11 GMT
server: AmazonS3
etag: "24292c18d8e2d6d7ba991aa05cec32e7"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
accept-ranges: bytes
x-amz-cf-id: zHTrSO-TG38cH-dgQ0v33U5gnSyfbp5gAUenV7OPn6ployqq8JF2sA==

GET
H2 200 weglot.min.css
cdn.weglot.com/ 28 KB
5 KB 24ms
19ms Stylesheet
text/css 2600:9000:225e:7c00:1:28b3:b280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.weglot.com/weglot.min.css?v=4
Requested by: Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:7c00:1:28b3:b280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8eb91a0802b9e79aef3e47554a25b80de2f8ef73d3053b28c81820734179f4e9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 10:32:32 GMT
content-encoding: gzip
via: 1.1 8b360b28aeb67c1982fcc466a05eef02.cloudfront.net (CloudFront)
x-amz-version-id: null
last-modified: Thu, 29 Sep 2022 10:32:28 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P4
age: 24610
etag: W/"b72cdd8118949f04803d561712cf0c5e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css; charset=utf-8
cache-control: max-age=2592000
x-amz-cf-id: P4r62PFfn3hBygX15MZBvocPEAtdcp7s2FOgpR67UNybhvhxMkujGQ==

GET
H2 200 datadog-logs-v4.js Show response
www.datadoghq-browser-agent.com/ 40 KB
14 KB 93ms
21ms Script
application/javascript 108.138.1.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.datadoghq-browser-agent.com/datadog-logs-v4.js
Requested by: Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.1.193 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-1-193.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a6a6893ad73574488751b1c519b042b268ccbf65d96224c235f936fcb2aa0ab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 17:22:19 GMT
content-encoding: gzip
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
last-modified: Wed, 28 Sep 2022 13:03:39 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 24
etag: W/"b9c5b8c7456a44290e9a7a90a34027cd"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=14400, s-maxage=60
timing-allow-origin: *
x-amz-cf-id: TcjzXEui9mCmRUXczrcs-KWejwxDa-S1UIF_obRSAnCOGLvt1_U7YQ==

GET
H2 200 slugs Show response
cdn-api.weglot.com/translations/ 533 B
2 KB 116ms
31ms Fetch
application/json 52.84.174.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-api.weglot.com/translations/slugs?api_key=wg_234baeaaccaa2f09e0dc6c004f571bbd6&language_to=fr&v=1658845381

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.174.99 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-174-99.cdg50.r.cloudfront.net

Software

nginx /

Resource Hash

9270bbe635cc7cf73fcdaa51e5e9ea0ad367a2ca4eeec9b837c5779ceb45cd40

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-fd52dc7693fb02cb654b6b9c4cbb7458' dashboard.weglot.com .weglot.com .stripe.com .announcekit.app .nolt.io .jsdelivr.net .firstpromoter.com beacon-v2.helpscout.net .google.com .google-analytics.com .googletagmanager.com .googleadservices.com .gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com .snap.licdn.com .redditstatic.com connect.facebook.net .hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 14:23:32 GMT
content-security-policy: script-src 'nonce-fd52dc7693fb02cb654b6b9c4cbb7458' dashboard.weglot.com *.weglot.com *.stripe.com *.announcekit.app *.nolt.io *.jsdelivr.net *.firstpromoter.com beacon-v2.helpscout.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com *.snap.licdn.com *.redditstatic.com connect.facebook.net *.hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
via: 1.1 51076e0d05d56160dd8ee5148f1f74d8.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG50-P1
age: 5626749
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,PUT,PATCH
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-store, private
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
access-control-allow-headers: Content-Type
x-amz-cf-id: WBHIP8ktxI1LPRDfOrGLC94DGztBtaRCqS1GQiFn24X54HbRPdqbBA==
expires: Tue, 26 Jul 2022 14:23:32 GMT

GET
H2 200 slugs Show response
cdn-api.weglot.com/translations/ 2 B
1 KB 113ms
27ms Fetch
application/json 52.84.174.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-api.weglot.com/translations/slugs?api_key=wg_234baeaaccaa2f09e0dc6c004f571bbd6&language_to=it&v=1658845381

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.174.99 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-174-99.cdg50.r.cloudfront.net

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-8bd0be8d00de84d1cffb6d70f40fd066' dashboard.weglot.com .weglot.com .stripe.com .announcekit.app .nolt.io .jsdelivr.net .firstpromoter.com beacon-v2.helpscout.net .google.com .google-analytics.com .googletagmanager.com .googleadservices.com .gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com .snap.licdn.com .redditstatic.com connect.facebook.net .hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 14:23:32 GMT
content-security-policy: script-src 'nonce-8bd0be8d00de84d1cffb6d70f40fd066' dashboard.weglot.com *.weglot.com *.stripe.com *.announcekit.app *.nolt.io *.jsdelivr.net *.firstpromoter.com beacon-v2.helpscout.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com *.snap.licdn.com *.redditstatic.com connect.facebook.net *.hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
via: 1.1 51076e0d05d56160dd8ee5148f1f74d8.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG50-P1
age: 5626749
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,PUT,PATCH
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-store, private
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
access-control-allow-headers: Content-Type
x-amz-cf-id: 3Neg6Oz_hYEtc2LDkLkjFDbjcvY-l9i0XNt78-EpTbQyXfwSMa0dPw==
expires: Tue, 26 Jul 2022 14:23:32 GMT

GET
H2 200 slugs Show response
cdn-api.weglot.com/translations/ 2 B
1 KB 114ms
28ms Fetch
application/json 52.84.174.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-api.weglot.com/translations/slugs?api_key=wg_234baeaaccaa2f09e0dc6c004f571bbd6&language_to=ko&v=1658845381

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.174.99 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-174-99.cdg50.r.cloudfront.net

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-cf9bf898f29d24bc1a8c417a3fc149c8' dashboard.weglot.com .weglot.com .stripe.com .announcekit.app .nolt.io .jsdelivr.net .firstpromoter.com beacon-v2.helpscout.net .google.com .google-analytics.com .googletagmanager.com .googleadservices.com .gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com .snap.licdn.com .redditstatic.com connect.facebook.net .hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 14:23:32 GMT
content-security-policy: script-src 'nonce-cf9bf898f29d24bc1a8c417a3fc149c8' dashboard.weglot.com *.weglot.com *.stripe.com *.announcekit.app *.nolt.io *.jsdelivr.net *.firstpromoter.com beacon-v2.helpscout.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com *.snap.licdn.com *.redditstatic.com connect.facebook.net *.hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
via: 1.1 51076e0d05d56160dd8ee5148f1f74d8.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG50-P1
age: 5626749
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,PUT,PATCH
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-store, private
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
access-control-allow-headers: Content-Type
x-amz-cf-id: YNL43piNtywuQtLH56fPXjpX_5K8BrctsriyE6xKIXHCv7uhDNGJzw==
expires: Tue, 26 Jul 2022 14:23:32 GMT

GET
H2 200 slugs Show response
cdn-api.weglot.com/translations/ 2 B
1 KB 114ms
29ms Fetch
application/json 52.84.174.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-api.weglot.com/translations/slugs?api_key=wg_234baeaaccaa2f09e0dc6c004f571bbd6&language_to=ja&v=1658845381

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.174.99 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-174-99.cdg50.r.cloudfront.net

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-782e5a974ee0bb3d0ba64e22c8eb6426' dashboard.weglot.com .weglot.com .stripe.com .announcekit.app .nolt.io .jsdelivr.net .firstpromoter.com beacon-v2.helpscout.net .google.com .google-analytics.com .googletagmanager.com .googleadservices.com .gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com .snap.licdn.com .redditstatic.com connect.facebook.net .hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 14:23:32 GMT
content-security-policy: script-src 'nonce-782e5a974ee0bb3d0ba64e22c8eb6426' dashboard.weglot.com *.weglot.com *.stripe.com *.announcekit.app *.nolt.io *.jsdelivr.net *.firstpromoter.com beacon-v2.helpscout.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com *.snap.licdn.com *.redditstatic.com connect.facebook.net *.hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
via: 1.1 51076e0d05d56160dd8ee5148f1f74d8.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG50-P1
age: 5626749
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,PUT,PATCH
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-store, private
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
access-control-allow-headers: Content-Type
x-amz-cf-id: fmf7YPaNsnEDwXGl_308ixL2roFgfgb80DRxKKnQqSZSOrxYhuYnhg==
expires: Tue, 26 Jul 2022 14:23:32 GMT

GET
H2 200 slugs Show response
cdn-api.weglot.com/translations/ 2 B
1 KB 116ms
30ms Fetch
application/json 52.84.174.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-api.weglot.com/translations/slugs?api_key=wg_234baeaaccaa2f09e0dc6c004f571bbd6&language_to=es&v=1658845381

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.174.99 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-174-99.cdg50.r.cloudfront.net

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-2dd656899da62f7cc3ab76b07d3eca63' dashboard.weglot.com .weglot.com .stripe.com .announcekit.app .nolt.io .jsdelivr.net .firstpromoter.com beacon-v2.helpscout.net .google.com .google-analytics.com .googletagmanager.com .googleadservices.com .gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com .snap.licdn.com .redditstatic.com connect.facebook.net .hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 14:23:32 GMT
content-security-policy: script-src 'nonce-2dd656899da62f7cc3ab76b07d3eca63' dashboard.weglot.com *.weglot.com *.stripe.com *.announcekit.app *.nolt.io *.jsdelivr.net *.firstpromoter.com beacon-v2.helpscout.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com *.snap.licdn.com *.redditstatic.com connect.facebook.net *.hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
via: 1.1 51076e0d05d56160dd8ee5148f1f74d8.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG50-P1
age: 5626749
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,PUT,PATCH
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-store, private
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
access-control-allow-headers: Content-Type
x-amz-cf-id: 0slwxihK8ZPLqBSs0y00n8FmOji3fdEG-ZbbcezuVQhRESJ_GHAzOA==
expires: Tue, 26 Jul 2022 14:23:32 GMT

GET
H2 200 slugs Show response
cdn-api.weglot.com/translations/ 2 B
1 KB 115ms
30ms Fetch
application/json 52.84.174.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-api.weglot.com/translations/slugs?api_key=wg_234baeaaccaa2f09e0dc6c004f571bbd6&language_to=de&v=1658845381

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.174.99 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-174-99.cdg50.r.cloudfront.net

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-3f283f1ac3cd4c4004b53c13dba01313' dashboard.weglot.com .weglot.com .stripe.com .announcekit.app .nolt.io .jsdelivr.net .firstpromoter.com beacon-v2.helpscout.net .google.com .google-analytics.com .googletagmanager.com .googleadservices.com .gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com .snap.licdn.com .redditstatic.com connect.facebook.net .hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 14:23:32 GMT
content-security-policy: script-src 'nonce-3f283f1ac3cd4c4004b53c13dba01313' dashboard.weglot.com *.weglot.com *.stripe.com *.announcekit.app *.nolt.io *.jsdelivr.net *.firstpromoter.com beacon-v2.helpscout.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com *.snap.licdn.com *.redditstatic.com connect.facebook.net *.hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
via: 1.1 51076e0d05d56160dd8ee5148f1f74d8.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG50-P1
age: 5626749
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,PUT,PATCH
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-store, private
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
access-control-allow-headers: Content-Type
x-amz-cf-id: 9GqmrJSxtGlx03zGi314KbVvnM0FgIawq59x75jp8ozEnlPIMA09eg==
expires: Tue, 26 Jul 2022 14:23:32 GMT

GET
H2 200 slugs Show response
cdn-api.weglot.com/translations/ 79 B
1 KB 113ms
29ms Fetch
application/json 52.84.174.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-api.weglot.com/translations/slugs?api_key=wg_234baeaaccaa2f09e0dc6c004f571bbd6&language_to=br&v=1658845381

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.84.174.99 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-84-174-99.cdg50.r.cloudfront.net

Software

nginx /

Resource Hash

e52ba320502e2cd491874b86e0e3fbffbd189d8913f5f46c6092056ecfa24104

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-3e37a68a6af83ab6588535f2acd56e4d' dashboard.weglot.com .weglot.com .stripe.com .announcekit.app .nolt.io .jsdelivr.net .firstpromoter.com beacon-v2.helpscout.net .google.com .google-analytics.com .googletagmanager.com .googleadservices.com .gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com .snap.licdn.com .redditstatic.com connect.facebook.net .hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 14:23:32 GMT
content-security-policy: script-src 'nonce-3e37a68a6af83ab6588535f2acd56e4d' dashboard.weglot.com *.weglot.com *.stripe.com *.announcekit.app *.nolt.io *.jsdelivr.net *.firstpromoter.com beacon-v2.helpscout.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com *.snap.licdn.com *.redditstatic.com connect.facebook.net *.hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
via: 1.1 51076e0d05d56160dd8ee5148f1f74d8.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG50-P1
age: 5626749
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
access-control-allow-methods: GET,POST,PUT,PATCH
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=0, must-revalidate, no-store, private
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
access-control-allow-headers: Content-Type
x-amz-cf-id: ARN2jAHbVFdnbkV4M2kTJu1dC9k0ZIt7onC17Vg5N_rzfwCjEQAGLQ==
expires: Tue, 26 Jul 2022 14:23:32 GMT

GET
DATA 200
OK truncated
/ 255 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9948ae846979246ddfe993e604739594ce0e7cdfa77657412b9b0090009dcf23

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET demandbase
match.prod.bidr.io/cookie-sync/ 0
0

GET
H2 451 464526.gif
id.rlcdn.com/ 0
98 B 71ms
25ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 17:22:41 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 ip.json Show response
api.company-target.com/api/v2/ 3 KB
1 KB 436ms
67ms XHR
application/json 18.66.97.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&page_title=Page%20Not%20Found%20%7C%20Darktrace
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/20cb0107a53f0895.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-57.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 0bfc17823fb88c2de136191f024c33fb90ba470d50c347926a54f9049010bc13

Request headers

Referer: https://darktrace.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 29 Sep 2022 17:22:41 GMT
identification-source: CENTRAL
content-encoding: gzip
via: 1.1 22993faf725ff29c940e58cb14ddf668.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
x-cache: Miss from cloudfront
request-id: 06b978f6-7dfd-485a-ad47-e2d4eeb11057
pragma: no-cache
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://darktrace.com
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding, Origin
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: X6ysY8Gth0qhk4lyKGcHSytb1IeP6CpvHxTCl14CKMVysDJNfuKU9w==
expires: Wed, 28 Sep 2022 17:22:41 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 378ms
29ms Script
application/x-javascript 2a02:26f0:11a::6867:4868
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW765SZ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:11a::6867:4868 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 17:22:41 GMT
content-encoding: gzip
last-modified: Fri, 12 Aug 2022 20:23:36 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=50613
accept-ranges: bytes
content-length: 3063

GET activityi;src=9120626;type=unive0;cat=darkt00;ord=1293298074684;gtm=2wg9s0;auiddc=1937597845.1664472161;~oref=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-...
9120626.fls.doubleclick.net/ Frame E364 0
0

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
16 KB 363ms
32ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW765SZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

f42283e0ca17a52688c5250e714ecd1b6a53af8b0f6e54ac64546499b0ec1b19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 17:22:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15699
x-xss-protection: 0
server: cafe
etag: 699633608045481581
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 29 Sep 2022 17:22:41 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 223 KB
76 KB 31ms
31ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N8JM61T88C&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW765SZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

286191ffcafae835f8ef58ac322c157d36a0bd1562f3c322e9c3ef9ac4f6ed12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 17:22:41 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 77839
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 29 Sep 2022 17:22:41 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 182 B
294 B 116ms
103ms XHR
application/json 2606:4700:4400::6812:2962
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://darktrace.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 17:22:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 75266701dde7bb4d-FRA
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/ 375 KB
89 KB 94ms
94ms Script
application/javascript 2606:4700:4400::6812:2962
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/otBannerSdk.js

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0766007565870c9a9ce93e31236bc0119fd01fff87ed569848a2a486e931c0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 29 Sep 2022 17:22:41 GMT
content-encoding: gzip
cf-cache-status: HIT
content-md5: PoUkurh3GT3DbFeu3QcwyA==
age: 13499
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 91152
x-ms-lease-status: unlocked
last-modified: Tue, 23 Aug 2022 20:32:06 GMT
server: cloudflare
etag: 0x8DA85468BC88A3B
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 75475713-901e-0028-1e82-d35324000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 752667037e3e5c8c-FRA
expires: Thu, 29 Sep 2022 21:22:41 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
345 B 316ms
23ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-N8JM61T88C&gtm=2oe9s0&_p=1779642451&cid=1180427271.1664472162&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_z=ccd.v9B&_s=1&sid=1664472161&sct=1&seg=0&dl=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&dt=Page%20Not%20Found%20%7C%20Darktrace&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N8JM61T88C&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Sep 2022 17:22:42 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://darktrace.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1664472161857&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm=...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D67174%26time%3D1664472161857%26url%3Dhttps%253A%252F%252Fdarktrace.com%252Fblog%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1664472161857&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm=...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1664472161857&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm...

0
264 B

337ms
193ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1664472161857&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm=gtmv2&liSync=true&e_ipv6=AQIGB-1U3hYHvQAAAYOKRaEvNTZcq5i5iY91VZCgwU9xFYMXkMLB5y4LyFiMHX-Vung5R9Ao_VTDYhK-ezbKYWEaX9FkQg
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 17:22:42 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 372431BE4AB541D1AD63722CCE5D0CDC Ref B: FRAEDGE1314 Ref C: 2022-09-29T17:22:42Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXp1CACoQAM2xudyLndTg==

Redirect headers

date: Thu, 29 Sep 2022 17:22:42 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 055D6D7B99DB43469C138C0C32056BC3 Ref B: FRAEDGE1312 Ref C: 2022-09-29T17:22:42Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1664472161857&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm=gtmv2&liSync=true&e_ipv6=AQIGB-1U3hYHvQAAAYOKRaEvNTZcq5i5iY91VZCgwU9xFYMXkMLB5y4LyFiMHX-Vung5R9Ao_VTDYhK-ezbKYWEaX9FkQg
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXp1B/9adXnjCYxbGzaWw==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/401176436/ 2 KB
2 KB 322ms
34ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/401176436/?random=1664472161859&cv=9&fst=1664472161859&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg9s0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tiba=Page%20Not%20Found%20%7C%20Darktrace&auid=1937597845.1664472161&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

06bf50fcb5c9880e0d70856a566698cc2f9d64570047dfa0ef636ed58519b548

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Sep 2022 17:22:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1068
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 en.json Show response
cdn-ukwest.onetrust.com/consent/2f0e2e84-c239-468b-b9dc-95c94890809c/d5ff8eee-09cb-4368-a822-e6582bcf7ca7/ 53 KB
12 KB 88ms
88ms Fetch
application/x-javascript 2606:4700:4400::6812:2962
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/consent/2f0e2e84-c239-468b-b9dc-95c94890809c/d5ff8eee-09cb-4368-a822-e6582bcf7ca7/en.json

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3ef8145f66e52c663d816432e10af9dd07771e0948c4ab7f0879b138b8aa4c95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 29 Sep 2022 17:22:42 GMT
content-encoding: gzip
cf-cache-status: HIT
content-md5: U2fI4ktBSkUZ+MPrqiTsaQ==
age: 4306
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 12447
x-ms-lease-status: unlocked
last-modified: Thu, 25 Aug 2022 13:43:48 GMT
server: cloudflare
etag: 0x8DA869FD677EB24
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 7512e2c0-401e-0047-2d82-d3fbf0000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 752667047bc3bb4d-FRA

GET
H2 200 otFlat.json Show response
cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/assets/ 13 KB
3 KB 115ms
114ms Fetch
application/json 2606:4700:4400::6812:2962
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/assets/otFlat.json

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 29 Sep 2022 17:22:42 GMT
content-encoding: gzip
cf-cache-status: HIT
content-md5: ivRWEcgBmKISMHohZLmqHg==
age: 4304
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3007
x-ms-lease-status: unlocked
last-modified: Tue, 23 Aug 2022 20:31:53 GMT
server: cloudflare
etag: 0x8DA85468405BB89
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 3739a522-601e-0072-7b82-d355a5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 752667051dacbb4d-FRA
expires: Thu, 29 Sep 2022 21:22:42 GMT

GET
H2 200 otPcCenter.json Show response
cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/assets/v2/ 62 KB
13 KB 102ms
102ms Fetch
application/json 2606:4700:4400::6812:2962
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/assets/v2/otPcCenter.json

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3e634eb4bc8fc909bd1ea389002b9036063e2fe86f1a423fb2eb577baaf7e1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 29 Sep 2022 17:22:42 GMT
content-encoding: gzip
cf-cache-status: HIT
content-md5: 21cHQ6etMkoj8lO7BcUj3Q==
age: 4304
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 13334
x-ms-lease-status: unlocked
last-modified: Tue, 23 Aug 2022 20:31:56 GMT
server: cloudflare
etag: 0x8DA854685C28887
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 55eba731-601e-005b-5b82-d323e7000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 752667051db2bb4d-FRA
expires: Thu, 29 Sep 2022 21:22:42 GMT

GET
H2 200 otCommonStyles.css Show response
cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/assets/ 22 KB
5 KB 303ms
302ms Fetch
text/css 2606:4700:4400::6812:2962
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/assets/otCommonStyles.css

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 29 Sep 2022 17:22:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
content-md5: B55i3ZY9miZIaUrwjufy0w==
age: 4304
x-ms-lease-status: unlocked
last-modified: Tue, 23 Aug 2022 20:32:15 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: aa6aeba8-601e-003d-1982-d391bd000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
cf-ray: 752667051dbdbb4d-FRA
expires: Thu, 29 Sep 2022 21:22:42 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/401176436/ 42 B
64 B 65ms
31ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/401176436/?random=1664472161859&cv=9&fst=1664470800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg9s0&sendb=1&frm=0&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tiba=Page%20Not%20Found%20%7C%20Darktrace&async=1&fmt=3&is_vtc=1&random=813251123&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Sep 2022 17:22:42 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/401176436/ 42 B
548 B 146ms
68ms Image
image/gif 2a00:1450:400d:80a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/401176436/?random=1664472161859&cv=9&fst=1664470800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg9s0&sendb=1&frm=0&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tiba=Page%20Not%20Found%20%7C%20Darktrace&async=1&fmt=3&is_vtc=1&random=813251123&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 29 Sep 2022 17:22:42 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 62aa2f9b38cc775f4bdc1381_TypeType%20-%20TT%20Interphases%20Pro%20DemiBold.ttf
assets.website-files.com/626ff19cdd07d1258d49238d/ 136 KB
65 KB 30ms
29ms Font
application/x-font-ttf 2600:9000:211a:5800:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/626ff19cdd07d1258d49238d/62aa2f9b38cc775f4bdc1381_TypeType%20-%20TT%20Interphases%20Pro%20DemiBold.ttf
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/css/web-phoenix.f73cd6de7.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211a:5800:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 79a7d5deff1189cba78946faa0ed6bd78a1c9292cfad4329b208d0be5a045ff7

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://darktrace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Tue, 02 Aug 2022 16:03:41 GMT
x-amz-version-id: 1q.Kipg6KvQuvMwrlLhzKvk3zJ.eCFMs
content-encoding: br
via: 1.1 881b12332738e10f6e80298fbdcd7e8e.cloudfront.net (CloudFront)
age: 5015941
x-amz-cf-pop: VIE50-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Fri, 01 Jul 2022 16:04:37 GMT
server: AmazonS3
etag: W/"6e56bc5a25ce4549b6a7580fd047582c"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
vary: Accept-Encoding
x-amz-cf-id: MWCrPaI8nc58ICDdhmMugFuPFPJFDgjv8sS4gS3NhrKy_375CO11UQ==

GET
H2 200 ot_logo.png
cdn-ukwest.onetrust.com/logos/static/ 13 KB
13 KB 88ms
88ms Image
image/png 2606:4700:4400::6812:2962
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-ukwest.onetrust.com/logos/static/ot_logo.png

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61e7a7943f7444e87b2af6295044b34292a537a23dd3d9436886e3a2ccf620ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 29 Sep 2022 17:22:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: HIT
content-md5: 8WyO+79CLtcTX81zrcTfgg==
age: 13413
content-length: 13077
x-ms-lease-status: unlocked
last-modified: Tue, 13 Sep 2022 20:32:03 GMT
server: cloudflare
etag: 0x8DA95C704EB5D7A
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: e7cb2797-601e-0036-0882-d389c9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 752667070e1f5c8c-FRA
expires: Thu, 29 Sep 2022 21:22:42 GMT

GET
H2 200 poweredBy_ot_logo.svg
cdn-ukwest.onetrust.com/logos/static/ 3 KB
2 KB 83ms
83ms Image
image/svg+xml 2606:4700:4400::6812:2962
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-ukwest.onetrust.com/logos/static/poweredBy_ot_logo.svg

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49b9b4996d1ff0a8e3de643a0c623255bf631f298f2799b949c29de93926ee7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 29 Sep 2022 17:22:42 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
content-md5: LpuayL42jB78xRllx0vkOw==
age: 13507
x-ms-lease-status: unlocked
last-modified: Tue, 13 Sep 2022 20:32:03 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: e7cb255a-601e-0036-6682-d389c9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
cf-ray: 752667070e245c8c-FRA
expires: Thu, 29 Sep 2022 21:22:42 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: match.prod.bidr.io
URL: https://match.prod.bidr.io/cookie-sync/demandbase

Domain: 9120626.fls.doubleclick.net
URL: https://9120626.fls.doubleclick.net/activityi;src=9120626;type=unive0;cat=darkt00;ord=1293298074684;gtm=2wg9s0;auiddc=1937597845.1664472161;~oref=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522?

Verdicts & Comments Add Verdict or Comment

47 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
ir.darktrace.com/	1969-12-31 23:59:59	Name: adonis-session Value: d319e995756e245fe20d73dd0749adaeMBZ0yV8or4TFcqvAfrmjdQXJ75UKsHITZhQRXFc5kE7bgTEAcY02MIdibbQ%2BCUHHwacbKvemCqZPZ3jJKCwM8475on8mkz3%2BPqNUqNQR8axzmBwcRAHw0X4HXB%2FJ2c4T
ir.darktrace.com/	1970-01-20 06:21:19	Name: XSRF-TOKEN Value: 101ff562bb9b78894660ee9f843f2240JzrmTnDZPKXABNl%2BQoeYtjDQo275BPlzNIEdSTUvHCbA7Vv4n1BtyDkU44Sqhj6qhpWFO7DOlqFxUQxafIxGiMTXGiWx1%2FU4XnGTei5mx4x%2F06viP%2BVpdyGwyMRnKHuY
ir.darktrace.com/	1969-12-31 23:59:59	Name: adonis-session-values Value: 170356f6b90400afd4e356a01d3104ce5%2BEkR27bJWjPbqK9vChuMdu8nImxtO548cYR9DuZkqLtKradXX1%2B4tl9PeTfLWVlwyloVLmeB3iDcG2X%2FXhOAfstwgx1TGHjn6mh6KBLW8EuCYzTgRU78CSJGWxikHLuecfcHTNiwQOO4Tpp%2Bp8%2FL9WleEWJqdIuNjAqzBx4J%2FJALQbBjETxsP3ZdaKcsWmKQgY8%2BTWMhoVxLrnKiOgdy9D460SngW6ApHJXGIRtDUOs%2Fg73qL0SlQTNgDPBG1sEfBoc6uPVmFACB7OUlQcwPK0%2Bab%2BB5ZYbt9cjzATbJFbaJLLTTA4l95ECzjfPHWJL
careers.darktrace.com/	1970-01-20 06:21:19	Name: XSRF-TOKEN Value: eyJpdiI6ImtVVXhoTURnZ0kxY0NjN1VYaDNlakE9PSIsInZhbHVlIjoiaUZScGNFYUVwblFrMmNZV2JlVWhBTEFBMzVJbndOT21iTE0yQkY1NnFBclZSNzRiQ0o4Wjhkcm1YWWYzeUkzY0FyeXR4MkIwRko2Y0NmcVRPcWpaSmNKOXJzaTdBVlJYZnFTVFZxRkNMVlVrSXRnYmRNVHBtMEJkUGdxTW00Uk8iLCJtYWMiOiIxMDE5MzNjMTE4ZTIwN2I0NjU4YzI4NGYxMDhkMDQ3MDYwZmVhNzMwMzhiNTM5NzI4OGZjMWRkNjk2Yzc5ZDA2IiwidGFnIjoiIn0%3D
careers.darktrace.com/	1970-01-20 06:21:19	Name: darktrace_careers_session Value: eyJpdiI6IlFIc2prYmdPOU12M0FUYnJuZHhRWEE9PSIsInZhbHVlIjoiaVNRUk5Fa0FZVms1NFNhVzRGMGRhdGw5U3FJYVRXYlBkTjJVQXNpK2tQVmZrbHBEWkdsZTZoN25HY0tiQVI3dkZYSXpxblhLNDlPVGFVa2wreWhpRVlJTkl4d0pnVlI4ekxvc0lDOEZ1aE5SbHFhN3hIdGFyRWYwVzJVQ0IwNDgiLCJtYWMiOiI5ODg5NmE3YmFiZDc5NTY0MDBmYjNhNjdmNmZjZjU5NzYwOGJkYjg2NDY3MzlkNThlYjcyMjM0OWJjY2RmODZlIiwidGFnIjoiIn0%3D
.darktrace.com/	1970-01-20 08:30:48	Name: _gcl_au Value: 1.1.1937597845.1664472161
.darktrace.com/	1970-01-20 15:57:12	Name: _ga Value: GA1.1.1180427271.1664472162
.darktrace.com/	1970-01-20 15:57:12	Name: _ga_N8JM61T88C Value: GS1.1.1664472161.1.1.1664472161.0.0.0
.doubleclick.net/	1970-01-20 06:21:13	Name: test_cookie Value: CheckForPermission
.linkedin.com/	1970-01-20 07:04:24	Name: UserMatchHistory Value: AQIvfnwouZ-wcwAAAYOKRZ9MZMpwrokZaurcMwIyE4RvHFtoZaain65ZPL4TZOMRnXnLq1itAhNKGA
.linkedin.com/	1970-01-20 07:04:24	Name: AnalyticsSyncHistory Value: AQJBLT_8U_NL0QAAAYOKRZ9MxMlTngzNu069ItMiT-5dDdRtPJ_spnkR41ncRBBg8KOErd1BQXxi9HBtnngZ8A
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 15:06:48	Name: bcookie Value: "v=2&ead496a0-c85f-43d3-835d-22ad5c8aeeb1"
.linkedin.com/	1970-01-20 06:22:38	Name: lidc Value: "b=OGST06:s=O:r=O:a=O:p=O:g=2494:u=1:x=1:i=1664472162:t=1664558562:v=2:sig=AQHABTCr6QDV_DqBAfd-Yt5QpOUCHK0x"
.darktrace.com/	1970-01-20 15:06:48	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Thu+Sep+29+2022+17%3A22%3A42+GMT%2B0000+(GMT)&version=202208.1.0&isIABGlobal=false&hosts=&consentId=df03fe2e-e87d-494a-baaf-2ae19fe3652a&interactionCount=0&landingPath=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 15:06:48	Name: bscookie Value: "v=1&202209291722420b495791-dfe5-4f2c-8d41-9dff599beb5eAQEckizM6Aho3QpByI_Fy1h39S7cHjUA"
.linkedin.com/	1970-01-20 10:40:24	Name: li_gc Value: MTswOzE2NjQ0NzIxNjI7MjswMjGaUHNlQ+ie+CPHb074Lscq4fpjfj193OSiWwvcBiMBkw==
darktrace.com/	1970-01-20 06:21:13	Name: _dd_s Value: logs=1&id=cc6eb213-f8e7-456b-a438-47872546cc6f&created=1664472161496&expire=1664473061496

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://id.rlcdn.com/464526.gif Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9120626.fls.doubleclick.net
api.company-target.com
assets-global.website-files.com
assets.website-files.com
careers.darktrace.com
cdn-api.weglot.com
cdn-ukwest.onetrust.com
cdn.weglot.com
d3e54v103j8qbb.cloudfront.net
darktrace.com
geolocation.onetrust.com
googleads.g.doubleclick.net
id.rlcdn.com
ir.darktrace.com
match.prod.bidr.io
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
snap.licdn.com
tag.demandbase.com
www.darktrace.com
www.datadoghq-browser-agent.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
9120626.fls.doubleclick.net
match.prod.bidr.io
108.138.1.193
108.138.17.46
13.107.42.14
142.250.184.194
172.67.0.161
18.66.97.57
2001:4860:4802:34::36
2600:9000:211a:5800:11:3b84:d200:93a1
2600:9000:225e:7c00:1:28b3:b280:93a1
2600:9000:2490:6200:12:9e5f:cac0:93a1
2606:4700:4400::6812:2962
2620:1ec:21::14
2a00:1450:4001:806::2004
2a00:1450:4001:812::2003
2a00:1450:4001:827::2008
2a00:1450:4001:82a::2002
2a00:1450:400d:80a::2003
2a02:26f0:11a::6867:4868
35.244.174.68
52.222.232.99
52.84.174.99
54.194.170.100
06bf50fcb5c9880e0d70856a566698cc2f9d64570047dfa0ef636ed58519b548
0bfc17823fb88c2de136191f024c33fb90ba470d50c347926a54f9049010bc13
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
1a7f603a9dd1e0a381c028839fdc00b6c6bfa4869b4a8ba22ecda60037ebcaac
1ac14370a15095bf8ab55d13146970017c326c130e8d6e2b1b75b77eb256c495
1ce112404e88b01a6301e730a31e9df68dfd512ebd22e648d3f49025e5bf55ea
21dea0cdc956cea9bb658cc7338d5a7526ba4bee4a4e2c15b2d067b57734b3ab
286191ffcafae835f8ef58ac322c157d36a0bd1562f3c322e9c3ef9ac4f6ed12
3ef8145f66e52c663d816432e10af9dd07771e0948c4ab7f0879b138b8aa4c95
3f623ccadc235f1eefffd70383b9acca84b973e118c4aba4414dd53e260b8a4f
49b9b4996d1ff0a8e3de643a0c623255bf631f298f2799b949c29de93926ee7a
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
58afd37317e5adb23a1e2b5006169e2350cdbc8948ee7998250fce897f3fb699
5a6a6893ad73574488751b1c519b042b268ccbf65d96224c235f936fcb2aa0ab
61e7a7943f7444e87b2af6295044b34292a537a23dd3d9436886e3a2ccf620ca
63997947a96223955cf4d7d0497089d77905bed5a70b406f5dc7e957bad4f7ae
71e525f4a8cfaa33a6b13bf5ba608ca1c0c8e38b7616b031a18c33460ba690f2
79a7d5deff1189cba78946faa0ed6bd78a1c9292cfad4329b208d0be5a045ff7
7d67f38229c8dac8429af4c162d42073e4abd4337a86ec54a18d3ad7e010b2a8
8610afc6cdee1077fbaa76778cc7aa717047a83990d8ee8f92422324aa0043b1
8ad74b30972057e9efc8dd2c5d013ed97938050ceab38f1209780d584bcd6fb3
8eb91a0802b9e79aef3e47554a25b80de2f8ef73d3053b28c81820734179f4e9
9215591d842950b73dfde60917a48e309c617d3787046db80940902e4f8368ee
9270bbe635cc7cf73fcdaa51e5e9ea0ad367a2ca4eeec9b837c5779ceb45cd40
9948ae846979246ddfe993e604739594ce0e7cdfa77657412b9b0090009dcf23
9e99633019ba6c0b831c31db1434d00425281752f6a166672df04bc31d8a6c06
a6fd219289d32bb4cdc8e8831a6f56c5cc0e4246f324bb598277e0c9036753d4
adecd63acc4782d7f6bea59bda9e02bfcc6f90ed14ace7f83e06c6c814b58e2a
b0766007565870c9a9ce93e31236bc0119fd01fff87ed569848a2a486e931c0c
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
b59b82343b78feaa04fa094535c326c677790b720a2265af536515cd394aa783
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3e634eb4bc8fc909bd1ea389002b9036063e2fe86f1a423fb2eb577baaf7e1c
e52ba320502e2cd491874b86e0e3fbffbd189d8913f5f46c6092056ecfa24104
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6b6ed623b9789747d2e491b3ad692793d461be2f27bdf0c531b2d953fa670d
f42283e0ca17a52688c5250e714ecd1b6a53af8b0f6e54ac64546499b0ec1b19
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
fb7f87a6ab9c9ad7846ad408ff3b49a5b534ffe8fd356fe2d2ac5abe915c2f3c
fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f

darktrace.com Open in urlscan Pro 54.194.170.100 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

52 Requests

94 %HTTPS

55 %IPv6

19 Domains

28 Subdomains

22 IPs

4 Countries

1089 kBTransfer

3622 kBSize

19 Cookies

15 Outgoing links

Page URL History

Redirected requests

52 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

darktrace.com Open in urlscan Pro
54.194.170.100 Public Scan

Screenshot
Live screenshot

Full Image

52
Requests

94 %
HTTPS

55 %
IPv6

19
Domains

28
Subdomains

22
IPs

4
Countries

1089 kB
Transfer

3622 kB
Size

19
Cookies

52 HTTP transactions
1 data transactions