blogs.akamai.com Open in urlscan Pro
2a02:26f0:6c00:18a::2469 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
Submission: On October 14 via api (October 14th 2019, 10:16:55 am UTC) from CH

Summary HTTP 84 Redirects Links 71 Behaviour Indicators

Summary

This website contacted 28 IPs in 6 countries across 25 domains to perform 84 HTTP transactions. The main IP is 2a02:26f0:6c00:18a::2469, located in Ascension Island and belongs to AKAMAI-ASN1, US. The main domain is blogs.akamai.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on March 12th 2019. Valid for: a year.

This is the only time blogs.akamai.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
16	2a02:26f0:6c0... 2a02:26f0:6c00:18a::2469	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	23.210.248.44 23.210.248.44	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
24	2a02:26f0:6c0... 2a02:26f0:6c00:180::6a3	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a00:1450:400... 2a00:1450:4001:808::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:820::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
4	2a00:1450:400... 2a00:1450:4001:815::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a01:4a0:1338... 2a01:4a0:1338:28::c38a:ff0b	201011 (NETZBETRI...) (NETZBETRIEB-GMBH)
1	2a00:1450:400... 2a00:1450:4001:81a::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a02:26f0:6c0... 2a02:26f0:6c00:293::3adf	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	216.58.206.2 216.58.206.2	15169 (GOOGLE) (GOOGLE - Google LLC)
2	104.111.251.133 104.111.251.133	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	143.204.101.63 143.204.101.63	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
2	143.204.101.21 143.204.101.21	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus)
2 2	185.33.223.210 185.33.223.210	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus)
1	13.224.196.10 13.224.196.10	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE - Google LLC)
1 3	2a00:1450:400... 2a00:1450:4001:81d::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1 2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN - LinkedIn Corporation)
1 1	2620:119:50e3... 2620:119:50e3:101::6cae:b41	14413 (LINKEDIN) (LINKEDIN - LinkedIn Corporation)
2	2a00:1450:400... 2a00:1450:4001:81d::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	143.204.101.122 143.204.101.122	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 2	52.213.182.186 52.213.182.186	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 2	143.204.101.75 143.204.101.75	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	54.164.52.76 54.164.52.76	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
2	2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
1	2a01:4a0:1338... 2a01:4a0:1338:28::c38a:ff09	201011 (NETZBETRI...) (NETZBETRIEB-GMBH)
2	2a03:2880:f01... 2a03:2880:f01c:20e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK - Facebook)
84	28

16 2a02:26f0:6c00:18a::2469 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

blogs.akamai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 2a02:26f0:6c00:180::6a3 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

www.akamai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

lh5.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

lh4.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:815::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:4a0:1338:28::c38a:ff0b (Germany)

ASN201011 (NETZBETRIEB-GMBH, DE)

ds-aksb-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:293::3adf (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

sjs.bizographics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.206.2 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s20-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.251.133 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-251-133.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.101.63 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-101-63.fra50.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.101.21 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-101-21.fra50.r.cloudfront.net

s.idio.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (United States) 1 redirects

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.223.210 (Netherlands) 2 redirects

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
PTR: 307.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.196.10 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-224-196-10.fra2.r.cloudfront.net

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9b (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81d::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland) 1 redirects

ASN14413 (LINKEDIN - LinkedIn Corporation, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:119:50e3:101::6cae:b41 (United States) 1 redirects

ASN14413 (LINKEDIN - LinkedIn Corporation, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.101.122 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-101-122.fra50.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.213.182.186 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-213-182-186.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.101.75 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-101-75.fra50.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.164.52.76 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-164-52-76.compute-1.amazonaws.com

a.idio.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)

642-skn-449.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8083:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:4a0:1338:28::c38a:ff09 (Germany)

ASN201011 (NETZBETRIEB-GMBH, DE)

jag1z17ozci-ds-aksb-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:20e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
40	akamai.com blogs.akamai.com www.akamai.com	2 MB
4	facebook.com www.facebook.com graph.facebook.com	1 KB
4	idio.co s.idio.co a.idio.co	7 KB
4	google-analytics.com www.google-analytics.com	18 KB
3	company-target.com 1 redirects api.company-target.com segments.company-target.com	2 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	1 KB
3	google.de www.google.de	329 B
3	google.com 1 redirects www.google.com	748 B
3	doubleclick.net 1 redirects stats.g.doubleclick.net googleads.g.doubleclick.net	3 KB
3	googleusercontent.com lh5.googleusercontent.com lh4.googleusercontent.com	2 MB
3	addthis.com s7.addthis.com	190 KB
2	bidr.io 2 redirects match.prod.bidr.io	752 B
2	adnxs.com 2 redirects secure.adnxs.com	2 KB
2	facebook.net connect.facebook.net	87 KB
2	bing.com bat.bing.com	7 KB
2	marketo.net munchkin.marketo.net	6 KB
2	googleadservices.com www.googleadservices.com	18 KB
2	akamaihd.net ds-aksb-a.akamaihd.net jag1z17ozci-ds-aksb-a.akamaihd.net	5 KB
1	mktoresp.com 642-skn-449.mktoresp.com	303 B
1	ml-api.io attr.ml-api.io	484 B
1	ml-attr.com 1 redirects s.ml-attr.com	276 B
1	demandbase.com scripts.demandbase.com	18 KB
1	bizographics.com sjs.bizographics.com	2 KB
1	addthisedge.com v1.addthisedge.com	2 KB
1	googletagmanager.com www.googletagmanager.com	64 KB
84	25

	Domain	Requested by
24	www.akamai.com	blogs.akamai.com
16	blogs.akamai.com	blogs.akamai.com s7.addthis.com
4	www.google-analytics.com	blogs.akamai.com
3	www.google.de	blogs.akamai.com
3	www.google.com	1 redirects blogs.akamai.com
3	s7.addthis.com	blogs.akamai.com s7.addthis.com
2	graph.facebook.com	s7.addthis.com
2	www.facebook.com	blogs.akamai.com
2	a.idio.co	blogs.akamai.com
2	segments.company-target.com	1 redirects blogs.akamai.com
2	match.prod.bidr.io	2 redirects
2	googleads.g.doubleclick.net	www.googleadservices.com
2	px.ads.linkedin.com	1 redirects blogs.akamai.com
2	secure.adnxs.com	2 redirects
2	s.idio.co	blogs.akamai.com
2	connect.facebook.net	blogs.akamai.com connect.facebook.net
2	bat.bing.com	blogs.akamai.com
2	munchkin.marketo.net	blogs.akamai.com munchkin.marketo.net
2	www.googleadservices.com	www.googletagmanager.com
2	lh5.googleusercontent.com	blogs.akamai.com
1	jag1z17ozci-ds-aksb-a.akamaihd.net
1	642-skn-449.mktoresp.com	munchkin.marketo.net
1	api.company-target.com	scripts.demandbase.com
1	www.linkedin.com	1 redirects
1	stats.g.doubleclick.net	1 redirects
1	attr.ml-api.io	blogs.akamai.com
1	s.ml-attr.com	1 redirects
1	scripts.demandbase.com	blogs.akamai.com
1	sjs.bizographics.com	www.googletagmanager.com
1	v1.addthisedge.com	s7.addthis.com
1	www.googletagmanager.com	blogs.akamai.com
1	ds-aksb-a.akamaihd.net	blogs.akamai.com
1	lh4.googleusercontent.com	blogs.akamai.com
84	33

This site contains links to these domains. Also see Links.

Domain
www.akamai.com
www.ir.akamai.com
developer.akamai.com
control.akamai.com
akamai.com
learn.akamai.com
community.akamai.com
unit42.paloaltonetworks.com
www.facebook.com
www.linkedin.com
twitter.com
www.youtube.com

Subject Issuer	Validity	Valid
blogs.akamai.com DigiCert SHA2 Secure Server CA	`2019-03-12` - `2020-05-10`	a year	crt.sh
odc-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2019-10-10` - `2020-09-04`	a year	crt.sh
www.akamai.com DigiCert ECC Secure Server CA	`2018-12-26` - `2020-03-26`	a year	crt.sh
*.googleusercontent.com GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
*.google.com GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2019-08-13` - `2020-08-12`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
js.bizographics.com DigiCert SHA2 Secure Server CA	`2018-04-13` - `2020-04-17`	2 years	crt.sh
www.googleadservices.com GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2018-12-24` - `2020-03-24`	a year	crt.sh
*.demandbase.com Go Daddy Secure Certificate Authority - G2	`2018-09-20` - `2020-11-19`	2 years	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-09-22` - `2019-12-20`	3 months	crt.sh
idio.co Let's Encrypt Authority X3	`2019-08-27` - `2019-11-25`	3 months	crt.sh
*.ml-api.io Amazon	`2019-02-22` - `2020-03-22`	a year	crt.sh
www.google.de GTS CA 1O1	`2019-10-03` - `2019-12-26`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2019-05-29` - `2021-06-29`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
*.company-target.com Go Daddy Secure Certificate Authority - G2	`2019-06-19` - `2021-08-18`	2 years	crt.sh
*.mktoresp.com GeoTrust RSA CA 2018	`2018-02-05` - `2020-02-05`	2 years	crt.sh
www.google.com GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
Frame ID: 58C0C5A94235B7FA805BD48247A3C3B6
Requests: 85 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

AddThis (Widgets) Expand

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

84
Requests

100 %
HTTPS

59 %
IPv6

25
Domains

33
Subdomains

28
IPs

6
Countries

3780 kB
Transfer

6180 kB
Size

10
Cookies

71 Outgoing links

These are links going to different origins than the main page.

URL: https://www.akamai.com/us/en/about/
Title: Overview

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/about/careers/workplace-diversity.jsp
Title: Diversity

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/about/company-history.jsp
Title: Company History

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/about/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/locations.jsp
Title: Locations

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/about/news/
Title: Newsroom

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/about/leadership/
Title: Leadership

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/about/corporate-responsibility/
Title: Corporate Responsibility

Search URL Search Domain Scan URL

URL: http://www.ir.akamai.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/about/events/
Title: Events

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/our-thinking/
Title: Our Thinking

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/partners/
Title: Our Partners

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/contact-us.jsp
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/cdn/
Title: CDN

Search URL Search Domain Scan URL

URL: https://developer.akamai.com/
Title: Developers

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/akamai-free-trials.jsp
Title: Free Trials

Search URL Search Domain Scan URL

URL: https://control.akamai.com/
Title: Customer Login

Search URL Search Domain Scan URL

URL: https://akamai.com/
Title: Akamai.com

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/what-we-do/world-class-digital-experiences.jsp
Title: Overview

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/what-we-do/intelligent-platform/
Title: Intelligent Edge Platform

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/what-we-do/threat-research.jsp
Title: Threat Research

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/security.jsp
Title: Security

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/solutions/performance/
Title: Web Performance

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/solutions/media/ott-media-delivery.jsp
Title: Media Delivery

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/solutions/performance/devops.jsp
Title: DevOps

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/solutions/
Title: View All Solutions

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/solutions/industries/financial-cdn-services.jsp
Title: Financial Services

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/solutions/industries/hotel-travel-cdn-services.jsp
Title: Hotel & Travel

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/solutions/industries/media-entertainment-cdn-services.jsp
Title: Media & Entertainment

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/solutions/industries/public-sector-cdn-services.jsp
Title: Public Sector

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/solutions/industries/retail-consumer-cdn-services.jsp
Title: Retail & Consumer Goods

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/solutions/industries/software-technology-cdn-services.jsp
Title: Software & Technology

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/solutions/industries/
Title: View All Solutions

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/products/security/
Title: Security

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/products/performance/
Title: Web Performance

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/products/media-delivery/
Title: Media Delivery

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/products/network-operator/
Title: Network Operator

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/services/
Title: Services

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/our-customers.jsp
Title: Case Studies

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/resources/visualizing-akamai/
Title: Insights

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/resources/our-thinking/
Title: Overview

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/resources/our-thinking/information-security/
Title: Information Security

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/resources/our-thinking/threat-advisories/
Title: Threat Advisories

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/resources/our-thinking/for-cios/
Title: For CIOs

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/resources/our-thinking/state-of-the-internet-report/
Title: State of the Internet Report

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/library.jsp
Title: Document Library

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/resources/cdn-and-cloud-services-glossary.jsp
Title: Glossary

Search URL Search Domain Scan URL

URL: https://learn.akamai.com/
Title: Documentation

Search URL Search Domain Scan URL

URL: https://community.akamai.com/
Title: Community

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/resources/library.jsp
Title: FEATURED Our Library Search our library for helpful resources on topics you care about. Learn More

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/support/global-support-phone-numbers.jsp
Title: Global Support Phone Numbers

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/support/
Title: Support Resources

Search URL Search Domain Scan URL

URL: https://community.akamai.com/customers/s/support
Title: Support on Community

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/contact-us/stop-ddos-attacks.jsp
Title: UNDER ATTACK Are You Under Attack? Contact the DDoS Attack Hotline for emergency DDoS protection. Act Now

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/contact-us/
Title: CONTACT Get in touch Want to get in touch with us? There are multiple ways to contact an Akamai representative. Contact Now

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.com/unit42-exploit-wild-drupalgeddon2-analysis-cve-2018-7600/
Title: CVE-2018-7600

Search URL Search Domain Scan URL

URL: http://www.ir.akamai.com/phoenix.zhtml?c=75943&p=irol-irhome
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/about/compliance/
Title: Compliance

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/about/careers/student-jobs-internships.jsp
Title: Students

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/about/careers/working-at-akamai.jsp
Title: Working at Akamai

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/about/news/media-resources.jsp
Title: Media Resources

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/about/news/press-contacts.jsp
Title: Press Contacts

Search URL Search Domain Scan URL

URL: https://www.facebook.com/AkamaiTechnologies/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/akamai-technologies
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/Akamai
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/akamaitechnologies
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/about/compliance/data-protection-at-akamai.jsp
Title: TRUST CENTER

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/privacy-policies/
Title: Policy Details

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/
Title: www.akamai.com

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/privacy-policies/legal-notices.jsp
Title: EMEA Legal Notices

Search URL Search Domain Scan URL

URL: https://www.akamai.com/us/en/contact-us/contact-webmaster.jsp
Title: Webmaster

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 57

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dakamai.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dakamai.com%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dakamai.com%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=akamai.com&pId=4774029948342084043

Request Chain 59

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-34796267-1&cid=1243634182.1571048200&jid=335652528&gjid=1734755558&_gid=601795686.1571048200&_u=aGDAgEAB~&z=1911409668 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-34796267-1&cid=1243634182.1571048200&jid=335652528&_v=j79&z=1911409668 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-34796267-1&cid=1243634182.1571048200&jid=335652528&_v=j79&z=1911409668&slf_rd=1&random=87269794

Request Chain 62

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=62114&url=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&time=1571048199640 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D62114%26url%3Dhttps%253A%252F%252Fblogs.akamai.com%252Fsitr%252F2019%252F10%252Fdrupalgeddon2-still-used-in-attack-campaigns.html%26time%3D1571048199640%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=62114&url=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&time=1571048199640&liSync=true

Request Chain 67

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
https://segments.company-target.com/log?vendor=choca&user_id=AACVE067SJYAAD_H_q0Acg HTTP 303
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AACVE067SJYAAD_H_q0Acg&verifyHash=92fc47374fdfbe300ebd3122ecc88980fac07e83

84 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request drupalgeddon2-still-used-in-attack-campaigns.html Show response
blogs.akamai.com/sitr/2019/10/ 149 KB
24 KB 112ms
75ms Document
text/html 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

da6bdc9f57b941b0d1acdbb19a06bcaaf9595c42f8833f545a3e79a52ec5ce38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: blogs.akamai.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

Last-Modified: Mon, 07 Oct 2019 14:15:01 GMT
ETag: "24dff-59452ad730493-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/html
X-Akamai-Transformed: 9 23970 0 pmb=mNONE,1mRUM,1
Date: Mon, 14 Oct 2019 10:16:39 GMT
Content-Length: 24503
Connection: keep-alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Strict-Transport-Security: max-age=31536000

GET
H/1.1 200
OK styles-31.css
blogs.akamai.com/sitr/ 524 B
643 B 42ms
37ms Stylesheet
text/css 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.akamai.com/sitr/styles-31.css

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

cc7464e88981e97063d3b29b9d76e3bcdbddfc429ce9e06f74067c7d83d3ad0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Content-Encoding: gzip
Referrer-Policy: same-origin
Last-Modified: Wed, 21 Aug 2019 08:50:20 GMT
ETag: "20c-5909ca9b999db-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
X-XSS-Protection: 1; mode=block
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 201
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK mt.js Show response
blogs.akamai.com/ 31 KB
9 KB 39ms
21ms Script
application/javascript 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.akamai.com/mt.js

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

106969490b1744d2aa77535706a3196f1815b82e67c71c63690fe5cd856823fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Content-Encoding: gzip
Referrer-Policy: same-origin
Last-Modified: Fri, 11 Oct 2019 20:39:45 GMT
ETag: "7b5b-594a884bc199f-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
X-XSS-Protection: 1; mode=block
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 8780
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK jquery-3.3.1.min.js Show response
blogs.akamai.com/js/ 85 KB
30 KB 41ms
22ms Script
application/javascript 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.akamai.com/js/jquery-3.3.1.min.js

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Content-Encoding: gzip
Referrer-Policy: same-origin
Last-Modified: Wed, 21 Aug 2019 08:50:19 GMT
ETag: "1538f-5909ca9aeeb3e-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
X-XSS-Protection: 1; mode=block
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 30307
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK amp.min.js Show response
blogs.akamai.com/js/amp/ 295 KB
73 KB 40ms
21ms Script
application/javascript 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.akamai.com/js/amp/amp.min.js

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

edfc6dedf98d3024cc61633b2ee53ab4398e59ad287b132ecf6a41a0acb47d68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Content-Encoding: gzip
Referrer-Policy: same-origin
Last-Modified: Wed, 21 Aug 2019 08:50:19 GMT
ETag: "49d3c-5909ca9aefadf-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
X-XSS-Protection: 1; mode=block
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 73861
X-Content-Type-Options: nosniff

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 349 KB
113 KB 14ms
9ms Script
application/javascript 23.210.248.44
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

a95ebbca9b2c9a1cbd25f9b5070862c532bf98170e12f9d53b0212e2569622c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Thu, 10 Oct 2019 17:01:35 GMT
server: nginx/1.15.8
etag: "5d9f63ef-573ea"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Mon, 14 Oct 2019 10:16:39 GMT
x-host: s7.addthis.com
content-length: 114882

GET
H/1.1 200
OK ga-events-new.js Show response
blogs.akamai.com/ 3 KB
1 KB 37ms
19ms Script
application/javascript 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.akamai.com/ga-events-new.js

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

837b1df4e6afd164cddafe91e5801b3dfe5758c32418d1d5236d6c8a23eaf003

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Content-Encoding: gzip
Referrer-Policy: same-origin
Last-Modified: Wed, 21 Aug 2019 08:50:19 GMT
ETag: "cba-5909ca9a90f1d-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
X-XSS-Protection: 1; mode=block
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 787
X-Content-Type-Options: nosniff

GET
H2 200 what-we-do-overview.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 15 KB
15 KB 212ms
171ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/what-we-do-overview.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e399c39d72dbbe18ba5ef873f7744ab674d3a4c02edeacf61108f01cc0173ac0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:10 GMT
x-frame-options: SAMEORIGIN
etag: "1d7f4-592e0fcdb9e75"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416940
server-timing: cdn-cache; desc=HIT, edge; dur=17
content-length: 15294
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:05:39 GMT

GET
H2 200 what-we-do-intelligent-platform.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 37 KB
38 KB 181ms
171ms Image
image/jpeg 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/what-we-do-intelligent-platform.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

0072430f2794bb8c8f1f4ad130f433a4a189de8c7b4e112ccaad88f9ee8ae657

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:08 GMT
x-frame-options: SAMEORIGIN
etag: "4b459-592e0fccf9976"
strict-transport-security: max-age=31536000
content-type: image/jpeg
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416950
server-timing: cdn-cache; desc=HIT, edge; dur=28
content-length: 38105
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:05:49 GMT

GET
H2 200 what-we-do-threat-research.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 49 KB
49 KB 90ms
86ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/what-we-do-threat-research.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

06930952a5d69830d75e5378607a20156e9fc1cd8d14d95a678cb33186bddac0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:10 GMT
x-frame-options: SAMEORIGIN
etag: "e1258-592e0fcdc465d"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=417007
server-timing: cdn-cache; desc=HIT, edge; dur=21
content-length: 49936
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:06:46 GMT

GET
H2 200 what-we-do-free-trials.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 17 KB
17 KB 90ms
86ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/what-we-do-free-trials.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

a6149a35d7911d72fd5e1480523ed83afabe14087f0c0bc48413224a8d9eab3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:09 GMT
x-frame-options: SAMEORIGIN
etag: "29b47-592e0fcdbcd3e"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416755
server-timing: cdn-cache; desc=HIT, edge; dur=23
content-length: 16966
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:02:34 GMT

GET
H2 200 globe-background.png
www.akamai.com/us/en/multimedia/images/custom/2019/ 4 KB
4 KB 135ms
131ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/custom/2019/globe-background.png?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

6b19a44995e1a5403cb6712b02af04e4b207cf3aa0a0b2ee2f0ba8ad69e789c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:09 GMT
x-frame-options: SAMEORIGIN
etag: "ed45-592e0fcd0d1f7"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416743
server-timing: cdn-cache; desc=HIT, edge; dur=17
content-length: 3748
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:02:22 GMT

GET
H2 200 threats-can-come-from-anywhere-nav-image.png
www.akamai.com/us/en/multimedia/images/navigation/ 38 KB
39 KB 136ms
132ms Image
image/jpeg 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/threats-can-come-from-anywhere-nav-image.png?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

59b013d5975b9960f4533dae13bf97e4605c0ec274de2af55ac7cea4c1014eb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:08 GMT
x-frame-options: SAMEORIGIN
etag: "c6be5-592e0fcd07ffe"
strict-transport-security: max-age=31536000
content-type: image/jpeg
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416941
server-timing: cdn-cache; desc=HIT, edge; dur=31
content-length: 39258
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:05:40 GMT

GET
H2 200 products-web-performance.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 12 KB
12 KB 172ms
168ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/products-web-performance.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

b72ee5d64d3a356e76f2d3c3a2a94ef24507b7f0c13f3825d08e2f6e24f07c72

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:10 GMT
x-frame-options: SAMEORIGIN
etag: "1d7f9-592e0fcda4e97"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=417001
server-timing: cdn-cache; desc=HIT, edge; dur=25
content-length: 12256
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:06:40 GMT

GET
H2 200 products-media-delivery.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 18 KB
18 KB 193ms
189ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/products-media-delivery.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

c79a4fb2eeb2ff5707f38fb7829098963292d8a491b5158b0910f0433dad2339

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:09 GMT
x-frame-options: SAMEORIGIN
etag: "2af11-592e0fcd99ad0"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416830
server-timing: cdn-cache; desc=HIT, edge; dur=17
content-length: 18130
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:03:49 GMT

GET
H2 200 products-network-operator.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 16 KB
17 KB 211ms
207ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/products-network-operator.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

7b453661007c576174c4882eee250fd72838fe83487714eb6feedb1150db04c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:10 GMT
x-frame-options: SAMEORIGIN
etag: "1e340-592e0fcd06496"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416930
server-timing: cdn-cache; desc=HIT, edge; dur=22
content-length: 16544
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:05:29 GMT

GET
H2 200 products-services.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 13 KB
14 KB 232ms
228ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/products-services.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

631d19df49a86922bbeb380a9f8e054a17d7173273bb32dd229801ad3c4cafce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:10 GMT
x-frame-options: SAMEORIGIN
etag: "20b48-592e0fccfdbe1"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416815
server-timing: cdn-cache; desc=HIT, edge; dur=19
content-length: 13568
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:03:34 GMT

GET
H2 200 products-developers.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 22 KB
22 KB 232ms
228ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/products-developers.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

1b9f154f577a241f4fc98b5e3c26682d824a6ebffba0f0048c336cb396c93b37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:09 GMT
x-frame-options: SAMEORIGIN
etag: "2a716-592e0fcdb6fa3"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416909
server-timing: cdn-cache; desc=HIT, edge; dur=20
content-length: 22278
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:05:08 GMT

GET
H2 200 resources-case-studies.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 33 KB
33 KB 269ms
266ms Image
image/jpeg 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/resources-case-studies.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

cbf1259e3215bfc0b508f508734cf001fea399e4b4247a7a9b4d0b3ac5a673ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:08 GMT
x-frame-options: SAMEORIGIN
etag: "46797-592e0fccfc476"
strict-transport-security: max-age=31536000
content-type: image/jpeg
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416892
server-timing: cdn-cache; desc=HIT, edge; dur=20
content-length: 33306
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:04:51 GMT

GET
H2 200 resources-insights.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 43 KB
43 KB 297ms
293ms Image
image/jpeg 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/resources-insights.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

64d7608c31960c632fac13a3a29445d47a8724518ba827de0152aa989d3d3877

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:09 GMT
x-frame-options: SAMEORIGIN
etag: "5808d-592e0fccfad0a"
strict-transport-security: max-age=31536000
content-type: image/jpeg
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416867
server-timing: cdn-cache; desc=HIT, edge; dur=26
content-length: 43712
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:04:26 GMT

GET
H2 200 resources-soti.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 33 KB
34 KB 297ms
294ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/resources-soti.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

4a63333c48f499dbf9d046021ccf0265e1f27e550fa6750df3a94042e279f1fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:11 GMT
x-frame-options: SAMEORIGIN
etag: "65bc8-592e0fcd9b275"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416924
server-timing: cdn-cache; desc=HIT, edge; dur=22
content-length: 34256
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:05:23 GMT

GET
H2 200 resources-document-library.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 20 KB
21 KB 331ms
328ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/resources-document-library.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

bff8156b385dfeeeb7252ede19fa952a93e2aaef8265a23a982127316b2acd9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:09 GMT
x-frame-options: SAMEORIGIN
etag: "27653-592e0fcd98742"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416888
server-timing: cdn-cache; desc=HIT, edge; dur=23
content-length: 20654
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:04:47 GMT

GET
H2 200 resources-cdn.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 37 KB
37 KB 331ms
328ms Image
image/jpeg 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/resources-cdn.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

656d4642f6cce59f21736b878e7fa42d20f91024063c88d3d41dea6f0f9c28bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:09 GMT
x-frame-options: SAMEORIGIN
etag: "5745c-592e0fcdbb5e2"
strict-transport-security: max-age=31536000
content-type: image/jpeg
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416871
server-timing: cdn-cache; desc=HIT, edge; dur=17
content-length: 37880
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:04:30 GMT

GET
H2 200 resources-glossary.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 11 KB
12 KB 367ms
364ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/resources-glossary.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

f0f25a208a27fa745102622d93b1482857d578f0d89c2eb62e0d772c937373b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:09 GMT
x-frame-options: SAMEORIGIN
etag: "15e1b-592e0fcda3343"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416784
server-timing: cdn-cache; desc=HIT, edge; dur=22
content-length: 11422
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:03:03 GMT

GET
H2 200 resources-documentation.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 17 KB
17 KB 388ms
385ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/resources-documentation.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

d310a14bf95ae03d677cb678a4c563525192846e6988871ad77ae09885b1070e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:09 GMT
x-frame-options: SAMEORIGIN
etag: "2788c-592e0fcda1bc7"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416946
server-timing: cdn-cache; desc=HIT, edge; dur=17
content-length: 17406
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:05:45 GMT

GET
H2 200 resources-for-developers.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 28 KB
29 KB 406ms
403ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/resources-for-developers.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

3140c297aa50fa1c340e5bc1a395eda800bb596a2f2ee98a4515aa182d71c145

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:09 GMT
x-frame-options: SAMEORIGIN
etag: "33d16-592e0fccf2067"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416957
server-timing: cdn-cache; desc=HIT, edge; dur=22
content-length: 29082
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:05:56 GMT

GET
H2 200 resources-community.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 19 KB
20 KB 427ms
424ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/resources-community.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e2604fecfa3a9c69ae23e7938deeebb8c49448c498577074f7c0433e16ba9bd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:10 GMT
x-frame-options: SAMEORIGIN
etag: "38645-592e0fccf10c2"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416826
server-timing: cdn-cache; desc=HIT, edge; dur=19
content-length: 19900
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:03:45 GMT

GET
H2 200 products-security.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 12 KB
12 KB 427ms
425ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/products-security.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

4864f547b1c401eab77b887f010c9a7582a434b955732fc6b7f309f26a2d4f0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:10 GMT
x-frame-options: SAMEORIGIN
etag: "1ceb8-592e0fccf33e6"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416880
server-timing: cdn-cache; desc=HIT, edge; dur=21
content-length: 12016
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:04:39 GMT

GET
H2 200 contact-locations.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 53 KB
54 KB 465ms
462ms Image
image/jpeg 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/contact-locations.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

6129fb7e2a56fe9e46be0cd2b5413789243bce76bfa06a54de9e6992404c5c71

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:09 GMT
x-frame-options: SAMEORIGIN
etag: "5ae34-592e0fcd00ac9"
strict-transport-security: max-age=31536000
content-type: image/jpeg
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416957
server-timing: cdn-cache; desc=HIT, edge; dur=19
content-length: 54529
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:05:56 GMT

GET
H2 200 contact-us-featured.jpg
www.akamai.com/us/en/multimedia/images/navigation/ 29 KB
29 KB 471ms
468ms Image
image/webp 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/navigation/contact-us-featured.jpg?imwidth=320

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

f0806cc1a451fd5f8e707725ce05ef31d7addc1ee747f03cbe62a1e7615380d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Thu, 19 Sep 2019 06:05:11 GMT
x-frame-options: SAMEORIGIN
etag: "2016f-592e0fcdc139c"
strict-transport-security: max-age=31536000
content-type: image/webp
status: 200
x-xss-protection: 1; mode=block
cache-control: private, no-transform, max-age=416867
server-timing: cdn-cache; desc=HIT, edge; dur=22
content-length: 29232
x-content-type-options: nosniff
expires: Sat, 19 Oct 2019 06:04:26 GMT

GET
H/1.1 200
OK blogs-banner.jpg
blogs.akamai.com/images/patterns/ 55 KB
56 KB 23ms
21ms Image
image/jpeg 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.akamai.com/images/patterns/blogs-banner.jpg?imwidth=1366

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

23f453477edb842eb3bb51cbf4de508fd21b2260e90bdc82a85c22617e04ca22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
X-Image-Server-Store-Time: 1566449319
X-Content-Type-Options: nosniff
X-Image-Server-Response: request-3795766-90151124-137d71
Connection: keep-alive
Content-Length: 56675
X-XSS-Protection: 1; mode=block
X-Image-Server-Product: AIC
Referrer-Policy: same-origin
Last-Modified: Wed, 21 Aug 2019 08:50:19 GMT
X-Image-Server-Cpu-Real: 32
X-Frame-Options: SAMEORIGIN
ETag: "54410-5909ca9a9bb01"
Strict-Transport-Security: max-age=31536000
X-IM-Original-Width: 1366
Cache-Control: no-transform, max-age=39194
Content-Type: image/jpeg
X-Image-Server-Original-Size: 345104

GET
H/1.1 200
OK userpic-381-100x100.png
blogs.akamai.com/mt-static/support/assets_c/userpics/ 21 KB
21 KB 63ms
61ms Image
image/png 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.akamai.com/mt-static/support/assets_c/userpics/userpic-381-100x100.png

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

58b6f242992840e43178e430af109d08353e4d330c7684b167f7f82670decdb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Referrer-Policy: same-origin
Last-Modified: Wed, 21 Aug 2019 15:29:20 GMT
X-Frame-Options: SAMEORIGIN
ETag: "520a-590a23cabb107"
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
X-XSS-Protection: 1; mode=block
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21002
X-Content-Type-Options: nosniff

GET
H2 200 NVuACRQ2lbeZ5-eWhrQSBocDO7hXGfBmI0hu3fk1mN5agofQg4J_ppCLXDVBkg0X4iVmziuYtvMXk3PMuwQSDrLWyEGF5t8A-VbMwJW8cgBA42lqHQ6VWbL1FdvbOgsRCf3p2VjU
lh5.googleusercontent.com/ 1 MB
1 MB 23ms
20ms Image
image/png 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh5.googleusercontent.com/NVuACRQ2lbeZ5-eWhrQSBocDO7hXGfBmI0hu3fk1mN5agofQg4J_ppCLXDVBkg0X4iVmziuYtvMXk3PMuwQSDrLWyEGF5t8A-VbMwJW8cgBA42lqHQ6VWbL1FdvbOgsRCf3p2VjU

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

e5a11e14dc9ef6b2638a773b512e7c31641b216b2b5f5b0d0d4b591e5c9890aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 06:23:52 GMT
x-content-type-options: nosniff
age: 13967
status: 200
content-disposition: inline;filename="Screen Shot 2019-09-13 at 7.51.52 AM.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1294447
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Tue, 15 Oct 2019 06:23:52 GMT

GET
H2 200 1PxGPgNC-G1QxiX6Paog2SIXCkTC6t94Us1FhbVoyspdeZnyPURkmTWhnXTMa-YaKGTsUh81jFfm-rBY2g_jhODoL8bQfItlrqyzeFYNHc2UbdU6Y40s5c1rJJ7pyRQ3oLkCHj2y
lh5.googleusercontent.com/ 152 KB
152 KB 10ms
8ms Image
image/jpeg 2a00:1450:4001:808::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh5.googleusercontent.com/1PxGPgNC-G1QxiX6Paog2SIXCkTC6t94Us1FhbVoyspdeZnyPURkmTWhnXTMa-YaKGTsUh81jFfm-rBY2g_jhODoL8bQfItlrqyzeFYNHc2UbdU6Y40s5c1rJJ7pyRQ3oLkCHj2y

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

d2212ac9e4fcd136970a0e41da534f8db842269afc494fb2fb3c102546a24b60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 06:23:53 GMT
x-content-type-options: nosniff
age: 13966
status: 200
content-disposition: inline;filename="batner.jpg"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 155221
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Tue, 15 Oct 2019 06:23:53 GMT

GET
H2 200 Zo4ymfyRVOVNpJb1GFo_4w17OjR8M6znI_uXQ2RoqXr5Ye4gTUF3oQP361UyDDCg3YYl9m9RBI_zs-Ba098adAR7Jf5fIq5DXPIPlJXzORJ4h4XNdQBWdHJSuEM5t1bTUn31jFLe
lh4.googleusercontent.com/ 139 KB
139 KB 28ms
7ms Image
image/png 2a00:1450:4001:820::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh4.googleusercontent.com/Zo4ymfyRVOVNpJb1GFo_4w17OjR8M6znI_uXQ2RoqXr5Ye4gTUF3oQP361UyDDCg3YYl9m9RBI_zs-Ba098adAR7Jf5fIq5DXPIPlJXzORJ4h4XNdQBWdHJSuEM5t1bTUn31jFLe

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

fife /

Resource Hash

b0fd279e84dcc1aa7869168d1d26e981271cae4470a7a10006649cee79dbe8db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 06:23:52 GMT
x-content-type-options: nosniff
age: 13967
status: 200
content-disposition: inline;filename="Screen Shot 2019-09-12 at 3.17.01 PM.png"
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 141900
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sun, 13 Oct 2019 22:00:36 GMT

GET
H/1.1 200
OK Screen%20Shot%202019-10-07%20at%2010.13.54%20AM.png
blogs.akamai.com/sitr/ 638 KB
638 KB 67ms
65ms Image
image/png 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.akamai.com/sitr/Screen%20Shot%202019-10-07%20at%2010.13.54%20AM.png

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

3dda61dc079c5685c10bef986d72f8757cf9bfcfcbde08f5f5461d5bc67bc8d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Referrer-Policy: same-origin
Last-Modified: Mon, 07 Oct 2019 14:14:50 GMT
X-Frame-Options: SAMEORIGIN
ETag: "9f7cf-59452acc2716e"
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
X-XSS-Protection: 1; mode=block
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 653263
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK screen3.css
blogs.akamai.com/mt-static/support/themes/akamai/ 856 KB
128 KB 23ms
21ms Stylesheet
text/css 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.akamai.com/mt-static/support/themes/akamai/screen3.css

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

b3b5a05e8b180cfb6d58884e4106df4c3e74c198e97f09c8d112a3645f265f71

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Content-Encoding: gzip
Referrer-Policy: same-origin
Last-Modified: Wed, 21 Aug 2019 08:50:20 GMT
ETag: "d61b9-5909ca9b4a81f-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
X-XSS-Protection: 1; mode=block
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 130439
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK blogs_theme3_1.css
blogs.akamai.com/mt-static/support/themes/akamai/ 39 KB
7 KB 14ms
12ms Stylesheet
text/css 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.akamai.com/mt-static/support/themes/akamai/blogs_theme3_1.css

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

f39a61e66003546766b27f747923d78e1d672792beb9001c7d5e6fa8ac632048

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Content-Encoding: gzip
Referrer-Policy: same-origin
Last-Modified: Mon, 26 Aug 2019 10:37:10 GMT
ETag: "9aea-59102bd04b67a-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
X-XSS-Protection: 1; mode=block
Connection: keep-alive
Strict-Transport-Security: max-age=31536000
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 7128
X-Content-Type-Options: nosniff

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:815::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 1349
date: Mon, 14 Oct 2019 09:54:10 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Mon, 14 Oct 2019 11:54:10 GMT

GET
H/1.1 200
OK aksb.min.js Show response
ds-aksb-a.akamaihd.net/ 13 KB
5 KB 28ms
4ms Script
application/x-javascript 2a01:4a0:1338:28::c38a:ff0b
NETZBETRIEB-GMBH

General

Check archive.org

Show headers Download Go to

Full URL: https://ds-aksb-a.akamaihd.net/aksb.min.js
Requested by: Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a01:4a0:1338:28::c38a:ff0b , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software: Apache /
Resource Hash: 7f06def529e0076b37f65c60085a6b1c65f1bbab0b1f87c72c188018b5094966

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Content-Encoding: gzip
Last-Modified: Thu, 30 Aug 2018 18:25:26 GMT
Server: Apache
ETag: "15de19f42b35806faf815298644157e0:1535653526"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=43200
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 4826

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 421 KB
64 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:81a::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MP7VKD

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8188e7fd0694cce66c79a2169a03ac86f9149af2280adfafef01b2f0aed2481c

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
content-encoding: br
last-modified: Mon, 14 Oct 2019 09:00:00 GMT
server: Google Tag Manager
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 65346
x-xss-protection: 0
expires: Mon, 14 Oct 2019 10:16:39 GMT

GET
H/1.1 200
OK ubuntu-l.woff2
blogs.akamai.com/fonts/ubuntu/ 28 KB
28 KB 501ms
501ms Font
text/plain 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.akamai.com/fonts/ubuntu/ubuntu-l.woff2

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

a857947279357bbad0e7ca0dba15dc108faee9e6c91422d6fa654382f5571c7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://blogs.akamai.com/mt-static/support/themes/akamai/blogs_theme3_1.css
Origin: https://blogs.akamai.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Referrer-Policy: same-origin
Last-Modified: Wed, 21 Aug 2019 08:50:19 GMT
X-Frame-Options: SAMEORIGIN
ETag: "7018-5909ca9a8c0fb"
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1; mode=block
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 28696
X-Content-Type-Options: nosniff

GET
H2 200 akamai-logo.png
www.akamai.com/us/en/multimedia/images/logo/ 4 KB
4 KB 450ms
450ms Image
image/png 2a02:26f0:6c00:180::6a3
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.akamai.com/us/en/multimedia/images/logo/akamai-logo.png

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00:180::6a3 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

3dbdbf1c436bc7ac645619e20285acf1b944a4670cb34062cd10538640932368

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
referrer-policy: same-origin
last-modified: Mon, 04 Mar 2019 09:09:02 GMT
x-frame-options: SAMEORIGIN
etag: "3077-583411b9c0988"
strict-transport-security: max-age=31536000
content-type: image/png
status: 200
x-xss-protection: 1; mode=block
cache-control: public, private, max-age=2295780
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 4118
x-content-type-options: nosniff
expires: Sat, 09 Nov 2019 23:59:39 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fb86d56383ff7fa14b5260253935ce2c27f97945519ab5ff22fde97094926914

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK icomoon.woff
blogs.akamai.com/fonts/icomoon/ 115 KB
115 KB 323ms
322ms Font
application/font-woff 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.akamai.com/fonts/icomoon/icomoon.woff

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

8073776d34872ade5733678679780ce4fdbe3f82fed48ce45da7bd19adc41c25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://blogs.akamai.com/mt-static/support/themes/akamai/blogs_theme3_1.css
Origin: https://blogs.akamai.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Referrer-Policy: same-origin
Last-Modified: Wed, 21 Aug 2019 08:50:19 GMT
X-Frame-Options: SAMEORIGIN
ETag: "1cbe8-5909ca9a8c0fb"
Strict-Transport-Security: max-age=31536000
Content-Type: application/font-woff
X-XSS-Protection: 1; mode=block
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 117736
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK ubuntu-r.woff2
blogs.akamai.com/fonts/ubuntu/ 29 KB
30 KB 244ms
237ms Font
text/plain 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.akamai.com/fonts/ubuntu/ubuntu-r.woff2

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e2154ebb7b77021bed35684bcbad20fb63e3d3eab099e8a17f0805b8f39f0fab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://blogs.akamai.com/mt-static/support/themes/akamai/blogs_theme3_1.css
Origin: https://blogs.akamai.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Referrer-Policy: same-origin
Last-Modified: Wed, 21 Aug 2019 08:50:19 GMT
X-Frame-Options: SAMEORIGIN
ETag: "7534-5909ca9a8c0fb"
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1; mode=block
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 30004
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK ubuntu-m.woff2
blogs.akamai.com/fonts/ubuntu/ 29 KB
30 KB 504ms
504ms Font
text/plain 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://blogs.akamai.com/fonts/ubuntu/ubuntu-m.woff2

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

22403b87ef9b9fa4bc05db8e00c78456d1065838ac242890accacb96e565c6c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Referer: https://blogs.akamai.com/mt-static/support/themes/akamai/blogs_theme3_1.css
Origin: https://blogs.akamai.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Referrer-Policy: same-origin
Last-Modified: Wed, 21 Aug 2019 08:50:19 GMT
X-Frame-Options: SAMEORIGIN
ETag: "74a0-5909ca9a8c0fb"
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1; mode=block
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29856
X-Content-Type-Options: nosniff

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
111 B 13ms
13ms Image
image/gif 2a00:1450:4001:815::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=103050720&t=pageview&_s=1&dl=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&ul=en-us&de=UTF-8&dt=Drupalgeddon2%20still%20used%20in%20attack%20campaigns%20-%20Akamai%20Security%20Intelligence%20and%20Threat%20Research%20Blog&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=1208666823&gjid=897047030&cid=1243634182.1571048200&tid=UA-34883906-1&_gid=601795686.1571048200&_r=1&z=941917915

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Oct 2019 10:16:39 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-54527f043b9dd729/ 12 KB
2 KB 16ms
15ms Script
application/javascript 23.210.248.44
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-54527f043b9dd729/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.8.v20180619) /
Resource Hash: ec0ef12b22c4df7e2a0a9f7bc3eeb70daaf7e5358beac2865fb3c1d43457ca80

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
content-encoding: gzip
surrogate-key: ra-54527f043b9dd729
server: Jetty(9.4.8.v20180619)
cache-tag: ra-54527f043b9dd729
etag: 1540161347--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=31, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 1586

GET
H/1.1 200
OK insight.min.js Show response
sjs.bizographics.com/ 3 KB
2 KB 12ms
11ms Script
application/x-javascript 2a02:26f0:6c00:293::3adf
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sjs.bizographics.com/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MP7VKD
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:293::3adf , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=49174
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 24 KB
9 KB 15ms
14ms Script
text/javascript 216.58.206.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MP7VKD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

cafe /

Resource Hash

a6b5e22c905bbb22ce9e7aad76eeca32474b5ba7c932893d554b0edfddc7f9e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9184
x-xss-protection: 0
server: cafe
etag: 4597387999763492622
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 14 Oct 2019 10:16:39 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 20ms
7ms Script
application/x-javascript 104.111.251.133
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.251.133 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-111-251-133.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 66f7eaa7a45f696c332cd450771f4be48e110f6afbe1fe7b39c7a95518aeef76

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Content-Encoding: gzip
Last-Modified: Fri, 05 Apr 2019 02:53:44 GMT
Server: Apache
ETag: "54520320df20b526337717d6d28181fc:1554432824"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 752

GET
H2 200 uDRtxOMd.min.js Show response
scripts.demandbase.com/ 69 KB
18 KB 31ms
9ms Script
application/javascript 143.204.101.63
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.demandbase.com/uDRtxOMd.min.js
Requested by: Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.101.63 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-101-63.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 47ccdf7d12992b10a12c307c552f74c59d606aaf62a136be43f30bf75e4393d9

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 09 Oct 2019 01:02:18 GMT
content-encoding: gzip
last-modified: Tue, 20 Aug 2019 00:20:14 GMT
server: AmazonS3
age: 296
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: FcCMifuxXDrA_Sc.PkQQDjdhVOUAuDWF
status: 200
cache-control: public, max-age=3600
x-amz-cf-pop: FRA50-C1
content-type: application/javascript
x-amz-cf-id: QOqR0w7Ku4YeASUeDEoeHOIaPDRgMqM9oJzfL6IxVzG4E3efafeIjw==
via: 1.1 cdb2dba3874dd4d7b53213b8c63a0997.cloudfront.net (CloudFront)

GET
H2 200 bat.js Show response
bat.bing.com/ 23 KB
7 KB 47ms
47ms Script
application/javascript 2620:1ec:c11::200
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash: b139982ce002c53ddfb65aec1e90704c0a3704fc5aa35247f9323b74a1d3f721

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
content-encoding: gzip
last-modified: Tue, 10 Sep 2019 18:57:28 GMT
x-msedge-ref: Ref A: DA95219D37BB44D2864FCBC7DEAA9409 Ref B: VIEEDGE0418 Ref C: 2019-10-14T10:16:39Z
status: 200
etag: "09c5197968d51:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 7148

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ 24 KB
9 KB 16ms
15ms Script
text/javascript 216.58.206.2
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MP7VKD

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

cafe /

Resource Hash

c6c59f99021c03392673132e9b28f9e1fc890710c531aa49b506b01adb5b8dcd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9364
x-xss-protection: 0
server: cafe
etag: 14275855663230401311
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 14 Oct 2019 10:16:39 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 103 KB
22 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

fe6062b8859b1cbec624e610c390a71f1830a3202eb0a2c4d8cd42aaf446a8cf

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
content-length: 22372
x-xss-protection: 0
pragma: public
x-fb-debug: X51ZtxFYovcA3WLyOJA8y9YnGh0SJzl4NasnJJh0GUCL7qO43douDDcDV48D6yxGfnVdGIVIaJtviQ8RCDkmDQ==
x-fb-trip-id: 1850256238
x-frame-options: DENY
date: Mon, 14 Oct 2019 10:16:39 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ip.js Show response
s.idio.co/ 12 KB
5 KB 38ms
12ms Script
application/javascript 143.204.101.21
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://s.idio.co/ip.js
Requested by: Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.101.21 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-101-21.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f236ed677909953b79151c3c3bf5f5801be1393faf15f9676e7133e596fc25ce

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:35 GMT
content-encoding: gzip
last-modified: Tue, 11 Dec 2018 12:15:21 GMT
server: AmazonS3
age: 5
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=300
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: ItcUQW0Eu18XZIVjzFwiEAVOyOwEXcfGdqvmn0ZQF8Atd3yBSldvvQ==
via: 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront)

GET
H2 200 ia.js Show response
s.idio.co/ 2 KB
1 KB 38ms
13ms Script
application/javascript 143.204.101.21
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://s.idio.co/ia.js
Requested by: Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.101.21 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-101-21.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 932ea76ee0e29b363a45f844e8ad42038536f70f7e8d8bcf56100c3e41590bac

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 13 Oct 2019 19:35:14 GMT
content-encoding: gzip
last-modified: Fri, 13 Jul 2018 12:51:13 GMT
server: AmazonS3
age: 52886
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=86400
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: yoiv0mq8Z95UAjcqrCd6FKByF1efUAYn0Xb7i2QBpst2nFc1ysCoVA==
via: 1.1 9c7c26f5beeb09381cea450ea3581b37.cloudfront.net (CloudFront)

GET
H/1.1

200
OK

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dakamai.com%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dakamai.com%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dakamai.com%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=akamai.com&pId=4774029948342084043

4 B
484 B

256ms
214ms

Image
image/jpeg

13.224.196.10
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=akamai.com&pId=4774029948342084043
Requested by: Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.196.10 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-224-196-10.fra2.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:40 GMT
Via: 1.1 8002c303d4f2295f77566a349deba122.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA2-C1
x-amzn-RequestId: 4d663cc6-bfe3-4f82-9e4e-0ba38c20a3da
X-Cache: Miss from cloudfront
Content-Type: image/jpeg
X-Amzn-Trace-Id: Root=1-5da44b08-d80271c0167e640cac8ddc30;Sampled=0
Connection: keep-alive
x-amz-apigw-id: BjCpRF2tIAMFj8w=
Content-Length: 4
X-Amz-Cf-Id: 4s7sDTaUA5xF7uLH_Me7ttjVr0aqXVTBOK2jUwwEnaWMkb9OZlnQTQ==

Redirect headers

Pragma: no-cache
Date: Mon, 14 Oct 2019 10:16:41 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 307.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.68:80
AN-X-Request-Uuid: d14e1394-9400-4dfc-8dce-88a3019ca2d5
Server: nginx/1.13.4
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://attr.ml-api.io/?domain=akamai.com&pId=4774029948342084043
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
109 B 7ms
6ms Image
image/gif 2a00:1450:4001:815::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j79&a=103050720&t=pageview&_s=1&dl=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&dp=%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html%3F&ul=en-us&de=UTF-8&dt=Drupalgeddon2%20still%20used%20in%20attack%20campaigns%20-%20Akamai%20Security%20Intelligence%20and%20Threat%20Research%20Blog&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGDAgEAB~&jid=335652528&gjid=1734755558&cid=1243634182.1571048200&tid=UA-34796267-1&_gid=601795686.1571048200&gtm=2wga21MP7VKD&cd1=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&cd27=botcategory%3DUnknown%20Bot%2Cbotname%3D&cd29=Unknown%20Bot&cd30=(not%20set)&cd31=(not%20set)&cd32=Unknown%20Bot&cd47=1243634182.1571048200&cd66=&z=1972672626

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Oct 2019 10:31:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 258322
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-34796267-1&cid=1243634182.1571048200&jid=335652528&gjid=1734755558&_gid=601795686.1571048200&_u=aGDAgEAB~&z=1911409668
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-34796267-1&cid=1243634182.1571048200&jid=335652528&_v=j79&z=1911409668
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-34796267-1&cid=1243634182.1571048200&jid=335652528&_v=j79&z=1911409668&slf_rd=1&random=87269794

42 B
109 B

29ms
28ms

Image
image/gif

2a00:1450:4001:800::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-34796267-1&cid=1243634182.1571048200&jid=335652528&_v=j79&z=1911409668&slf_rd=1&random=87269794

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Oct 2019 10:16:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 14 Oct 2019 10:16:39 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-34796267-1&cid=1243634182.1571048200&jid=335652528&_v=j79&z=1911409668&slf_rd=1&random=87269794
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1276761735802781 Show response
connect.facebook.net/signals/config/ 280 KB
65 KB 210ms
209ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1276761735802781?v=2.9.5&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

0254fcdb307c550528f1fb4dbd0a11c9bdd7a94811334983316012916192ca59

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-fb-trip-id: 1850256238
pragma: public
x-fb-debug: zP6tXadY5OkOCIrFmVFgm4R4r31QQjggs6ZeTAMpc6fptDgUhHE0JT6PFkSjslXSYEh7D00l8YkUT0IfnD5Prg==
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: DENY
date: Mon, 14 Oct 2019 10:16:39 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
status: 200
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
vary: Accept-Encoding
x-xss-protection: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 layers.ab5cd98fe1b9a38a4a9f.js Show response
s7.addthis.com/static/ 263 KB
76 KB 9ms
9ms Script
application/javascript 23.210.248.44
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Wed, 18 Sep 2019 14:16:17 GMT
server: nginx/1.15.8
etag: W/"5d823c31-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Mon, 14 Oct 2019 10:16:39 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77528

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=62114&url=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&time=1571048199640
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D62114%26url%3Dhttps%253A%252F%252Fblogs.akamai.com%252Fsitr%252F2019%252F10%252Fd...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=62114&url=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&time=1571048199640&liSync=true

0
70 B

106ms
105ms

Image
application/javascript

2a05:f500:10:101::b93f:9105
LinkedIn Corporation

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=62114&url=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&time=1571048199640&liSync=true
Requested by: Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
content-encoding: gzip
server: Play
vary: Accept-Encoding
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 20
x-li-uuid: WEo6mQN8zRXAAMrAfSsAAA==

Redirect headers

date: Mon, 14 Oct 2019 10:16:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 302
vary: Accept-Encoding
content-length: 20
x-li-uuid: iVPUkgN8zRVQvuOxOCsAAA==
server: Play
pragma: no-cache
x-li-pop: prod-eda6
x-frame-options: sameorigin
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=62114&url=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&time=1571048199640&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/849939417/ 2 KB
1 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:81d::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/849939417/?random=1571048199642&cv=9&fst=1571048199642&num=1&label=mlQrCKqk0n0Q2ZeklQM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&tiba=Drupalgeddon2%20still%20used%20in%20attack%20campaigns%20-%20Akamai%20Security%20Intelligence%20and%20Threat%20Research%20Blog&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

62559a625fe521ff4387936f23e60f1ce19fb4a152db53f3e62e1519e4dcb5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Oct 2019 10:16:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1064
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/155/ 9 KB
4 KB 8ms
7ms Script
application/x-javascript 104.111.251.133
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/155/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.251.133 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-111-251-133.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Content-Encoding: gzip
Last-Modified: Fri, 30 Nov 2018 03:18:20 GMT
Server: Apache
ETag: "c67dad42946949112916578f78706df8:1543547900"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 3923
Expires: Wed, 22 Jan 2020 10:16:39 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/849939417/ 2 KB
1 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:81d::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/849939417/?random=1571048199647&cv=9&fst=1571048199647&num=1&label=mlQrCKqk0n0Q2ZeklQM&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&tiba=Drupalgeddon2%20still%20used%20in%20attack%20campaigns%20-%20Akamai%20Security%20Intelligence%20and%20Threat%20Research%20Blog&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

3722bb3d2892317e10db5f1ae352d63fa490ad1e4db9faca72ae78d6815dea82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Oct 2019 10:16:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1053
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 1 KB
1 KB 122ms
95ms XHR
application/json 143.204.101.122
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&page_title=Drupalgeddon2%20still%20used%20in%20attack%20campaigns%20-%20Akamai%20Security%20Intelligence%20and%20Threat%20Research%20Blog&key=c07e50e50d026064d820ab45cdd46518636e8993&src=tag
Requested by: Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/uDRtxOMd.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.101.122 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-101-122.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: 33a15bf33e7643fab9cf81386e266828dbd8e2b5ef6895642f31102059c1e1ce

Request headers

Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
content-encoding: gzip
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
access-control-max-age: 1728000
request-id: f6b7cf10-8ab6-4dcb-ba68-f527fcec5a8f
x-amz-cf-id: hSAhct_0pUeAxXHLBAUQKYqE-zJBOCn22ZLEfqI-gguMdVHBx9-Hjg==
pragma: no-cache
access-control-allow-origin: https://blogs.akamai.com
server: nginx
vary: Accept-Encoding, Origin
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 9128c49d19c76fd86ec4c647434ccb0a.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
identification-source: CENTRAL
expires: Sun, 13 Oct 2019 10:16:39 GMT

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
https://segments.company-target.com/log?vendor=choca&user_id=AACVE067SJYAAD_H_q0Acg
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AACVE067SJYAAD_H_q0Acg&verifyHash=92fc47374fdfbe300ebd3122ecc88980fac07e83

26 B
409 B

99ms
98ms

Image
image/gif

143.204.101.75
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=choca&user_id=AACVE067SJYAAD_H_q0Acg&verifyHash=92fc47374fdfbe300ebd3122ecc88980fac07e83
Requested by: Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.101.75 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-101-75.fra50.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Via: 1.1 fb8c0300277bd0137c1693d3d64ab550.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA50-C1
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: fe44c16aa9c3b518
X-Amz-Cf-Id: z_NQxiWXWX9t5AcVBSkVF8LKmeyutWBFWpvRVl_LAtSLugiXP-33ZA==

Redirect headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Via: 1.1 fb8c0300277bd0137c1693d3d64ab550.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA50-C1
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=choca&user_id=AACVE067SJYAAD_H_q0Acg&verifyHash=92fc47374fdfbe300ebd3122ecc88980fac07e83
Connection: keep-alive
trace-id: f81d27930b296ce5
Content-Length: 0
X-Amz-Cf-Id: xhwqkkdDAV4dUREVwY0KWna8V3c5V84XCP5qjnqhNWhnkJr8I4CCJQ==

GET
H/1.1 200
OK ia.gif
a.idio.co/ 26 B
166 B 360ms
92ms Image
image/gif 54.164.52.76
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.idio.co/ia.gif?r=&s=b3fa62e7-3a64-4b34-9e81-9bc59258ad23&x%5Bidio_visitor_id%5D%5B0%5D=f98521bd-480c-47ee-8f6f-e98fefb5de41&c=akamai&d=1638&a=consume&u=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&l=1571048199668&z=0.3819216716235825
Requested by: Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.52.76 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-52-76.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:39 GMT
Server: nginx
Connection: keep-alive
Content-Length: 26
Content-Type: image/gif

GET
H2 204 0
bat.bing.com/action/ 0
92 B 47ms
47ms Image
text/plain 2620:1ec:c11::200
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5668197&Ver=2&mid=474fb7aa-9646-5ee9-9290-8e029ebdc7b6&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Drupalgeddon2%20still%20used%20in%20attack%20campaigns%20-%20Akamai%20Security%20Intelligence%20and%20Threat%20Research%20Blog&p=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&r=&lt=421&evt=pageLoad&msclkid=N&rn=546311
Requested by: Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Mon, 14 Oct 2019 10:16:39 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 3212B45C5B1A4584841875A11B335E83 Ref B: VIEEDGE0418 Ref C: 2019-10-14T10:16:39Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK visitWebPage Show response
642-skn-449.mktoresp.com/webevents/ 2 B
303 B 543ms
100ms XHR
text/plain 192.28.144.124
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://642-skn-449.mktoresp.com/webevents/visitWebPage?_mchNc=1571048199673&_mchCn=&_mchId=642-SKN-449&_mchTk=_mch-akamai.com-1571048199672-95210&_mchWs=j1RQ&_mchHo=blogs.akamai.com&_mchPo=&_mchRu=%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&_mchPc=https%3A&_mchVr=155&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/155/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software: akka-http/10.1.7 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 14 Oct 2019 10:16:40 GMT
Content-Encoding: gzip
Server: akka-http/10.1.7
Transfer-Encoding: chunked
X-Request-Id: 630a6a93-75d8-4c4e-b7fa-cd792ccb7194
Content-Type: text/plain; charset=UTF-8

GET
H2 200 /
www.google.com/pagead/1p-user-list/849939417/ 42 B
144 B 21ms
21ms Image
image/gif 2a00:1450:4001:81d::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/849939417/?random=1571048199642&cv=9&fst=1571047200000&num=1&label=mlQrCKqk0n0Q2ZeklQM&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=0&url=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&tiba=Drupalgeddon2%20still%20used%20in%20attack%20campaigns%20-%20Akamai%20Security%20Intelligence%20and%20Threat%20Research%20Blog&async=1&fmt=3&is_vtc=1&random=2331030605&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Oct 2019 10:16:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/849939417/ 42 B
110 B 21ms
20ms Image
image/gif 2a00:1450:4001:800::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/849939417/?random=1571048199642&cv=9&fst=1571047200000&num=1&label=mlQrCKqk0n0Q2ZeklQM&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=0&url=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&tiba=Drupalgeddon2%20still%20used%20in%20attack%20campaigns%20-%20Akamai%20Security%20Intelligence%20and%20Threat%20Research%20Blog&async=1&fmt=3&is_vtc=1&random=2331030605&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Oct 2019 10:16:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/849939417/ 42 B
111 B 21ms
21ms Image
image/gif 2a00:1450:4001:81d::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/849939417/?random=1571048199647&cv=9&fst=1571047200000&num=1&label=mlQrCKqk0n0Q2ZeklQM&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&tiba=Drupalgeddon2%20still%20used%20in%20attack%20campaigns%20-%20Akamai%20Security%20Intelligence%20and%20Threat%20Research%20Blog&fmt=3&is_vtc=1&random=1784163934&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Oct 2019 10:16:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/849939417/ 42 B
110 B 20ms
20ms Image
image/gif 2a00:1450:4001:800::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/849939417/?random=1571048199647&cv=9&fst=1571047200000&num=1&label=mlQrCKqk0n0Q2ZeklQM&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&tiba=Drupalgeddon2%20still%20used%20in%20attack%20campaigns%20-%20Akamai%20Security%20Intelligence%20and%20Threat%20Research%20Blog&fmt=3&is_vtc=1&random=1784163934&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 14 Oct 2019 10:16:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
103 B 6ms
6ms Image
image/gif 2a00:1450:4001:815::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j79&a=103050720&t=event&ni=1&_s=2&dl=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&dp=%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html%3F&ul=en-us&de=UTF-8&dt=Drupalgeddon2%20still%20used%20in%20attack%20campaigns%20-%20Akamai%20Security%20Intelligence%20and%20Threat%20Research%20Blog&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aHDAiEABB~&jid=&gjid=&cid=1243634182.1571048200&tid=UA-34796267-1&_gid=601795686.1571048200&gtm=2wga21MP7VKD&cd1=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36&cd27=botcategory%3DUnknown%20Bot%2Cbotname%3D&cd29=Unknown%20Bot&cd30=(not%20set)&cd31=(not%20set)&cd32=Unknown%20Bot&cd47=1243634182.1571048200&cd66=&cd4=Bot&cd5=Sutter%20Health&cd6=Healthcare%20%26%20Medical&cd7=%242.5B%20-%20%245B&cd8=(Non-AccountWatch%20Visitor)&cd9=Facilities&cd10=United%20States&cd11=false&cd12=(Non-AccountWatch%20Visitor)&cd13=CA&cd14=(Non-AccountWatch%20Visitor)&cd15=(Non-AccountWatch%20Visitor)&cd16=(Non-AccountWatch%20Visitor)&cd17=(Non-AccountWatch%20Visitor)&cd18=(Non-AccountWatch%20Visitor)&cd19=8062&cd20=sutterhealth.org&cd24=(Non-AccountWatch%20Visitor)&cd51=673903&cd59=48277&z=1208017485

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 11 Oct 2019 10:31:17 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 258322
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
250 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1276761735802781&ev=PageView&dl=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&rl=&if=false&ts=1571048199862&sw=1600&sh=1200&v=2.9.5&r=stable&ec=0&o=30&fbp=fb.1.1571048199861.1559640111&it=1571048199634&coo=false&exp=w0&rqm=GET

Requested by

Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:39 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Mon, 14 Oct 2019 10:16:39 GMT

GET
H/1.1 200
OK ia.gif
a.idio.co/ 26 B
166 B 91ms
90ms Image
image/gif 54.164.52.76
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.idio.co/ia.gif?r=&s=b3fa62e7-3a64-4b34-9e81-9bc59258ad23&x%5Bidio_visitor_id%5D%5B0%5D=f98521bd-480c-47ee-8f6f-e98fefb5de41&c=akamai&d=1638&b%5BAudience%5D=Bot&b%5BCompany%20Name%5D=Sutter%20Health&b%5BIndustry%5D=Healthcare%20%26%20Medical&b%5BSub%20Industry%5D=Facilities&b%5BRegistry%20Company%20Name%5D=Hetzner%20Online%20GmbH&a=identify&u=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&l=1571048200113&z=0.9047468880621032
Requested by: Host: blogs.akamai.com
URL: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.164.52.76 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-164-52-76.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 14 Oct 2019 10:16:40 GMT
Server: nginx
Connection: keep-alive
Content-Length: 26
Content-Type: image/gif

GET
H/1.1 200
OK rvIZwUPgVPFK3zifW90oAtIWZYAdvTdQZIrMFH2a
blogs.akamai.com/cgi/mt/mt-comments.cgi/captcha/2/ 12 KB
12 KB 551ms
550ms Image
image/png 2a02:26f0:6c00:18a::2469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogs.akamai.com/cgi/mt/mt-comments.cgi/captcha/2/rvIZwUPgVPFK3zifW90oAtIWZYAdvTdQZIrMFH2a

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:18a::2469 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

7e99678e0ec71a4fe28088d8c8b5a7706da01fc42bcaef3252ab86b7585ed417

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 14 Oct 2019 10:16:40 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000
Content-Type: image/png; charset=ISO-8859-1
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 11950
X-XSS-Protection: 1; mode=block
Referrer-Policy: same-origin
Expires: -1

GET
H/1.1 204
No Content b
jag1z17ozci-ds-aksb-a.akamaihd.net/2/135745/ 0
269 B 168ms
4ms Image
text/html 2a01:4a0:1338:28::c38a:ff09
NETZBETRIEB-GMBH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jag1z17ozci-ds-aksb-a.akamaihd.net/2/135745/b?dE=18&cS=18&cE=36&rqS=36&rsS=111&rsE=117&sS=23&dl=121&di=415&fp=318&dlS=415&dlE=420&dc=1088&leS=1089&leE=1090&to=&ol=0&cr=4&mt=&mb=&b=273&u=https%3A//blogs.akamai.com/sitr/2019/10/drupalgeddon2-still-used-in-attack-campaigns.html&ua=Mozilla/5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/74.0.3729.169%20Safari/537.36&pl=Linux%20x86_64&us=&gh=2.16.187.22&t=&rid=2b59ca97&r=31715&akM=dscx&akN=ae&vc=14:17&bpcip=ag1z17ozci&akTX=1&akTI=2b59ca97&ai=197727&pmgn=rumBlogsAkamaiCom&pmgi=&pmp=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a01:4a0:1338:28::c38a:ff09 , Germany, ASN201011 (NETZBETRIEB-GMBH, DE),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 14 Oct 2019 10:16:40 GMT
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store, private
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 0
Expires: Mon, 14 Oct 2019 10:16:40 GMT

GET
H2 200 151.67aec2e0546e639563bb.js Show response
s7.addthis.com/static/ 2 KB
1 KB 8ms
8ms Script
application/javascript 23.210.248.44
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/151.67aec2e0546e639563bb.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

e1fa72e38624f68bc2039aded02a054eead1fbf24646f4df60abcacc665a8690

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Wed, 18 Sep 2019 14:16:17 GMT
server: nginx/1.15.8
etag: W/"5d823c31-68f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Mon, 14 Oct 2019 10:16:40 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 815

GET
H2 200 / Show response
graph.facebook.com/ 128 B
464 B 101ms
99ms Script
text/javascript 2a03:2880:f01c:20e:face:b00c:0:2
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_gyas0

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:20e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

882757c11c78e4e560ca5e22041fb55a4b037305179b6a593deaf87506c1ae50

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
etag: "3c10e3552c5c2c97e01ac2fbbd9b3f41c20807fd"
x-app-usage: {"call_count":0,"total_cputime":0,"total_time":0}
status: 200
x-fb-rev: 1001289209
content-length: 128
pragma: no-cache
x-fb-debug: Suy63bMseGWfFI4hAty6hmfS4mASOD/HSEigrawQ1cJG4z78UNoj2Dmn2ktFRGIbB3H/f128DmPiJ58O+QaMMA==
x-fb-trace-id: AXpzfYY48ub
date: Mon, 14 Oct 2019 10:16:40 GMT
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AopejgXkzo6yOPQTWGs2d95
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v2.10
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 / Show response
graph.facebook.com/ 127 B
312 B 130ms
129ms Script
text/javascript 2a03:2880:f01c:20e:face:b00c:0:2
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=http%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&fields=og_object%7Bengagement%7D&callback=_ate.cbs.rcb_48co0

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:20e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

65a8034f6f6791ce63b6b7406f000019c018cace719a50a636af86dbb522edea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
etag: "5ffc7cb0d40086f9f39126c7807892b07e2f633a"
x-app-usage: {"call_count":0,"total_cputime":0,"total_time":0}
status: 200
x-fb-rev: 1001289209
content-length: 127
pragma: no-cache
x-fb-debug: M6U88uJXGmjWoGVTiCjXn4UJlVUtSUqE2mkGqJgymbCvk1YH6wBX4qGbzjLxQ/Jhn7euVMtTQmUbRz2snbwdzA==
x-fb-trace-id: Gkz8UGlqMmB
date: Mon, 14 Oct 2019 10:16:40 GMT
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: ATAVyo4RPvZowHJczBAxvOr
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v2.10
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
149 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1276761735802781&ev=Microdata&dl=https%3A%2F%2Fblogs.akamai.com%2Fsitr%2F2019%2F10%2Fdrupalgeddon2-still-used-in-attack-campaigns.html&rl=&if=false&ts=1571048201365&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Drupalgeddon2%20still%20used%20in%20attack%20campaigns%20-%20Akamai%20Security%20Intelligence%20and%20Threat%20Research%20Blog%22%2C%22meta%3Adescription%22%3A%22While%20examining%20Akamai%27s%20network%20attack%20logs%2C%20I%20noticed%20an%20attack%20campaign%20leveraging%20Drupalgeddon2.%20Drupalgeddon2%20is%20an%20unauthenticated%20remote%20code%20execution%20vulnerability%20(CVE-2018-7600)%20in%20the%20Drupal%20CMS%20platform%20that%20was%20patched%20in%20March%202018....%22%2C%22meta%3Akeywords%22%3A%22%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.5&r=stable&ec=1&o=30&fbp=fb.1.1571048199861.1559640111&it=1571048199634&coo=false&es=automatic&exp=w0&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 14 Oct 2019 10:16:41 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
content-length: 44
expires: Mon, 14 Oct 2019 10:16:41 GMT

Verdicts & Comments Add Verdict or Comment

202 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.akamai.com/	1970-01-19 06:33:44	Name: _fbp Value: fb.1.1571048199861.1559640111
.akamai.com/	1970-01-19 21:55:20	Name: _mkto_trk Value: id:642-SKN-449&token:_mch-akamai.com-1571048199672-95210
.akamai.com/	1970-01-19 04:24:08	Name: _dc_gtm_UA-34796267-1 Value: 1
.akamai.com/	1970-01-19 04:24:09	Name: is Value: b3fa62e7-3a64-4b34-9e81-9bc59258ad23
blogs.akamai.com/	1970-01-19 04:24:09	Name: __atuvs Value: 5da44b07989c9170000
blogs.akamai.com/	1970-01-19 13:55:52	Name: __atuvc Value: 1%7C42
.akamai.com/	1970-01-19 04:24:08	Name: _gat Value: 1
.akamai.com/	1970-01-19 21:55:20	Name: iv Value: f98521bd-480c-47ee-8f6f-e98fefb5de41
.akamai.com/	1970-01-19 04:25:34	Name: _gid Value: GA1.2.601795686.1571048200
.akamai.com/	1970-01-19 21:55:20	Name: _ga Value: GA1.2.1243634182.1571048200

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	(Line 1) Message: in widgt code

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

642-skn-449.mktoresp.com
a.idio.co
api.company-target.com
attr.ml-api.io
bat.bing.com
blogs.akamai.com
connect.facebook.net
ds-aksb-a.akamaihd.net
googleads.g.doubleclick.net
graph.facebook.com
jag1z17ozci-ds-aksb-a.akamaihd.net
lh4.googleusercontent.com
lh5.googleusercontent.com
match.prod.bidr.io
munchkin.marketo.net
px.ads.linkedin.com
s.idio.co
s.ml-attr.com
s7.addthis.com
scripts.demandbase.com
secure.adnxs.com
segments.company-target.com
sjs.bizographics.com
stats.g.doubleclick.net
v1.addthisedge.com
www.akamai.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
104.111.251.133
13.224.196.10
143.204.101.122
143.204.101.21
143.204.101.63
143.204.101.75
185.33.223.210
192.28.144.124
216.58.206.2
23.210.248.44
2620:119:50e3:101::6cae:b41
2620:1ec:c11::200
2a00:1450:4001:800::2003
2a00:1450:4001:808::2001
2a00:1450:4001:815::200e
2a00:1450:4001:81a::2008
2a00:1450:4001:81d::2002
2a00:1450:4001:81d::2004
2a00:1450:4001:820::2001
2a00:1450:400c:c00::9b
2a01:4a0:1338:28::c38a:ff09
2a01:4a0:1338:28::c38a:ff0b
2a02:26f0:6c00:180::6a3
2a02:26f0:6c00:18a::2469
2a02:26f0:6c00:293::3adf
2a03:2880:f01c:20e:face:b00c:0:2
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
2a05:f500:10:101::b93f:9105
52.213.182.186
54.164.52.76
68.67.153.60
0072430f2794bb8c8f1f4ad130f433a4a189de8c7b4e112ccaad88f9ee8ae657
0254fcdb307c550528f1fb4dbd0a11c9bdd7a94811334983316012916192ca59
06930952a5d69830d75e5378607a20156e9fc1cd8d14d95a678cb33186bddac0
106969490b1744d2aa77535706a3196f1815b82e67c71c63690fe5cd856823fd
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1b9f154f577a241f4fc98b5e3c26682d824a6ebffba0f0048c336cb396c93b37
22403b87ef9b9fa4bc05db8e00c78456d1065838ac242890accacb96e565c6c7
23f453477edb842eb3bb51cbf4de508fd21b2260e90bdc82a85c22617e04ca22
3140c297aa50fa1c340e5bc1a395eda800bb596a2f2ee98a4515aa182d71c145
33a15bf33e7643fab9cf81386e266828dbd8e2b5ef6895642f31102059c1e1ce
3722bb3d2892317e10db5f1ae352d63fa490ad1e4db9faca72ae78d6815dea82
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3dbdbf1c436bc7ac645619e20285acf1b944a4670cb34062cd10538640932368
3dda61dc079c5685c10bef986d72f8757cf9bfcfcbde08f5f5461d5bc67bc8d1
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
47ccdf7d12992b10a12c307c552f74c59d606aaf62a136be43f30bf75e4393d9
4864f547b1c401eab77b887f010c9a7582a434b955732fc6b7f309f26a2d4f0b
4a63333c48f499dbf9d046021ccf0265e1f27e550fa6750df3a94042e279f1fb
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
58b6f242992840e43178e430af109d08353e4d330c7684b167f7f82670decdb1
59b013d5975b9960f4533dae13bf97e4605c0ec274de2af55ac7cea4c1014eb8
6129fb7e2a56fe9e46be0cd2b5413789243bce76bfa06a54de9e6992404c5c71
62559a625fe521ff4387936f23e60f1ce19fb4a152db53f3e62e1519e4dcb5d8
631d19df49a86922bbeb380a9f8e054a17d7173273bb32dd229801ad3c4cafce
64d7608c31960c632fac13a3a29445d47a8724518ba827de0152aa989d3d3877
656d4642f6cce59f21736b878e7fa42d20f91024063c88d3d41dea6f0f9c28bd
65a8034f6f6791ce63b6b7406f000019c018cace719a50a636af86dbb522edea
66f7eaa7a45f696c332cd450771f4be48e110f6afbe1fe7b39c7a95518aeef76
6b19a44995e1a5403cb6712b02af04e4b207cf3aa0a0b2ee2f0ba8ad69e789c9
7b453661007c576174c4882eee250fd72838fe83487714eb6feedb1150db04c0
7e99678e0ec71a4fe28088d8c8b5a7706da01fc42bcaef3252ab86b7585ed417
7f06def529e0076b37f65c60085a6b1c65f1bbab0b1f87c72c188018b5094966
8073776d34872ade5733678679780ce4fdbe3f82fed48ce45da7bd19adc41c25
8188e7fd0694cce66c79a2169a03ac86f9149af2280adfafef01b2f0aed2481c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
837b1df4e6afd164cddafe91e5801b3dfe5758c32418d1d5236d6c8a23eaf003
882757c11c78e4e560ca5e22041fb55a4b037305179b6a593deaf87506c1ae50
932ea76ee0e29b363a45f844e8ad42038536f70f7e8d8bcf56100c3e41590bac
a6149a35d7911d72fd5e1480523ed83afabe14087f0c0bc48413224a8d9eab3e
a6b5e22c905bbb22ce9e7aad76eeca32474b5ba7c932893d554b0edfddc7f9e2
a857947279357bbad0e7ca0dba15dc108faee9e6c91422d6fa654382f5571c7b
a95ebbca9b2c9a1cbd25f9b5070862c532bf98170e12f9d53b0212e2569622c2
b0fd279e84dcc1aa7869168d1d26e981271cae4470a7a10006649cee79dbe8db
b139982ce002c53ddfb65aec1e90704c0a3704fc5aa35247f9323b74a1d3f721
b3b5a05e8b180cfb6d58884e4106df4c3e74c198e97f09c8d112a3645f265f71
b72ee5d64d3a356e76f2d3c3a2a94ef24507b7f0c13f3825d08e2f6e24f07c72
bff8156b385dfeeeb7252ede19fa952a93e2aaef8265a23a982127316b2acd9d
c6c59f99021c03392673132e9b28f9e1fc890710c531aa49b506b01adb5b8dcd
c79a4fb2eeb2ff5707f38fb7829098963292d8a491b5158b0910f0433dad2339
cbf1259e3215bfc0b508f508734cf001fea399e4b4247a7a9b4d0b3ac5a673ab
cc7464e88981e97063d3b29b9d76e3bcdbddfc429ce9e06f74067c7d83d3ad0d
d2212ac9e4fcd136970a0e41da534f8db842269afc494fb2fb3c102546a24b60
d310a14bf95ae03d677cb678a4c563525192846e6988871ad77ae09885b1070e
da6bdc9f57b941b0d1acdbb19a06bcaaf9595c42f8833f545a3e79a52ec5ce38
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
e1fa72e38624f68bc2039aded02a054eead1fbf24646f4df60abcacc665a8690
e2154ebb7b77021bed35684bcbad20fb63e3d3eab099e8a17f0805b8f39f0fab
e2604fecfa3a9c69ae23e7938deeebb8c49448c498577074f7c0433e16ba9bd0
e399c39d72dbbe18ba5ef873f7744ab674d3a4c02edeacf61108f01cc0173ac0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5a11e14dc9ef6b2638a773b512e7c31641b216b2b5f5b0d0d4b591e5c9890aa
ec0ef12b22c4df7e2a0a9f7bc3eeb70daaf7e5358beac2865fb3c1d43457ca80
ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235
edfc6dedf98d3024cc61633b2ee53ab4398e59ad287b132ecf6a41a0acb47d68
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775
f0806cc1a451fd5f8e707725ce05ef31d7addc1ee747f03cbe62a1e7615380d7
f0f25a208a27fa745102622d93b1482857d578f0d89c2eb62e0d772c937373b9
f236ed677909953b79151c3c3bf5f5801be1393faf15f9676e7133e596fc25ce
f39a61e66003546766b27f747923d78e1d672792beb9001c7d5e6fa8ac632048
fb86d56383ff7fa14b5260253935ce2c27f97945519ab5ff22fde97094926914
fe6062b8859b1cbec624e610c390a71f1830a3202eb0a2c4d8cd42aaf446a8cf

blogs.akamai.com Open in urlscan Pro 2a02:26f0:6c00:18a::2469 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

84 Requests

100 %HTTPS

59 %IPv6

25 Domains

33 Subdomains

28 IPs

6 Countries

3780 kBTransfer

6180 kBSize

10 Cookies

71 Outgoing links

Redirected requests

84 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

blogs.akamai.com Open in urlscan Pro
2a02:26f0:6c00:18a::2469 Public Scan

Screenshot
Live screenshot

Full Image

84
Requests

100 %
HTTPS

59 %
IPv6

25
Domains

33
Subdomains

28
IPs

6
Countries

3780 kB
Transfer

6180 kB
Size

10
Cookies

84 HTTP transactions
1 data transactions