beta.documentcloud.org Open in urlscan Pro
2a03:b0c0:3:e0::298:6001 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc
Submission: On November 23 via manual (November 23rd 2020, 1:37:13 pm UTC) from US

Summary HTTP 15 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 15 HTTP transactions. The main IP is 2a03:b0c0:3:e0::298:6001, located in Frankfurt am Main, Germany and belongs to DIGITALOCEAN-ASN, US. The main domain is beta.documentcloud.org.
TLS certificate: Issued by Let's Encrypt Authority X3 on September 29th 2020. Valid for: 3 months.

This is the only time beta.documentcloud.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
4	2a03:b0c0:3:e... 2a03:b0c0:3:e0::298:6001	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
8	2606:4700:10:... 2606:4700:10::6816:3bd5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE)
15	5

4 2a03:b0c0:3:e0::298:6001 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)

beta.documentcloud.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700:10::6816:3bd5 (United States)

ASN13335 (CLOUDFLARENET, US)

api.beta.documentcloud.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
assets.documentcloud.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	documentcloud.org beta.documentcloud.org api.beta.documentcloud.org assets.documentcloud.org	795 KB
2	gstatic.com fonts.gstatic.com	26 KB
1	googleapis.com fonts.googleapis.com	896 B
15	3

	Domain	Requested by
4	assets.documentcloud.org
4	api.beta.documentcloud.org	beta.documentcloud.org
4	beta.documentcloud.org	beta.documentcloud.org
2	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	beta.documentcloud.org
15	5

This site contains links to these domains. Also see Links.

Domain
assets.documentcloud.org

Subject Issuer	Validity	Valid
beta.documentcloud.org Let's Encrypt Authority X3	`2020-09-29` - `2020-12-28`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
documentcloud.org Cloudflare Inc ECC CA-3	`2020-06-30` - `2021-06-30`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc
Frame ID: 9E79F6EF818AE6FA8D44A56A6F7EF6B5
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Netlify (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^Netlify/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Svelte () Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+class=\"[^\"]+\ssvelte-[\w]*\"/i

Page Statistics

15
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

5
Subdomains

5
IPs

2
Countries

822 kB
Transfer

1843 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://assets.documentcloud.org/documents/20413525/fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc.pdf
Title: Original Document (PDF) »

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request 20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc Show response
beta.documentcloud.org/documents/ 495 B
707 B 100ms
6ms Document
text/html 2a03:b0c0:3:e0::298:6001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a03:b0c0:3:e0::298:6001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

49ab0de3ef1c85afd914461e24efbaa9b3e41f0d330ddce9ab1d5ec0b5215c0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: beta.documentcloud.org
:scheme: https
:path: /documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cache-control: public, max-age=0, must-revalidate
content-length: 495
content-type: text/html; charset=UTF-8
date: Fri, 20 Nov 2020 22:00:43 GMT
etag: "dd6f0ea1f7e229429c381372e855ef88-ssl"
strict-transport-security: max-age=31536000
age: 228974
server: Netlify
x-nf-request-id: fb68c299-9dff-439c-adec-b5025881610e-280869

GET
H2 200 css
fonts.googleapis.com/ 9 KB
896 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,400i,600,700&display=swap

Requested by

Host: beta.documentcloud.org
URL: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4ba9a1e936fe7d253ce4df166f7bb2cc73d5e5947bbcd23a0a3b480f56775050

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 23 Nov 2020 12:50:37 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
date: Mon, 23 Nov 2020 13:36:57 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Mon, 23 Nov 2020 13:36:57 GMT

GET
H2 200 global.css
beta.documentcloud.org/ 141 B
296 B 7ms
6ms Stylesheet
text/css 2a03:b0c0:3:e0::298:6001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://beta.documentcloud.org/global.css

Requested by

Host: beta.documentcloud.org
URL: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a03:b0c0:3:e0::298:6001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

6a9608dc8a209d47f434ad7f7c1bde256525dfc72b4b2ae80f5e60be45da658a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id: fb68c299-9dff-439c-adec-b5025881610e-280872
date: Thu, 19 Nov 2020 22:09:23 GMT
server: Netlify
age: 314854
etag: "3ca51ad62e709842e8401ea9a82ba32d-ssl"
strict-transport-security: max-age=31536000
content-type: text/css; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
content-length: 141

GET
H2 200 bundle.css
beta.documentcloud.org/ 83 KB
14 KB 7ms
6ms Stylesheet
text/css 2a03:b0c0:3:e0::298:6001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://beta.documentcloud.org/bundle.css

Requested by

Host: beta.documentcloud.org
URL: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a03:b0c0:3:e0::298:6001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

4c295d6115baa201f0d5c2a968515ecd6c798efff243ab8ca5524f00cf1a071a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id: fb68c299-9dff-439c-adec-b5025881610e-280873
date: Thu, 19 Nov 2020 22:09:04 GMT
content-encoding: br
server: Netlify
age: 314873
etag: "9e1795bcdb1aa8e60dc77651cf4ab4a6-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: public, max-age=0, must-revalidate
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 13784

GET
H2 200 bundle.js Show response
beta.documentcloud.org/ 1 MB
182 KB 11ms
11ms Script
application/javascript 2a03:b0c0:3:e0::298:6001
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://beta.documentcloud.org/bundle.js

Requested by

Host: beta.documentcloud.org
URL: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a03:b0c0:3:e0::298:6001 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

Netlify /

Resource Hash

bf284d774d6885969668ffef141a938445349ae7b740aa852d6d2fd735c5f153

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nf-request-id: fb68c299-9dff-439c-adec-b5025881610e-280874
date: Thu, 19 Nov 2020 22:09:07 GMT
content-encoding: br
server: Netlify
age: 314871
etag: "a2705a2bc606c2a0bef98866abac5cf8-ssl-df"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=0, must-revalidate
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 186178

OPTIONS
H2 204 /
api.beta.documentcloud.org/api/documents/20413525/ 0
0 441ms
411ms Other 2606:4700:10::6816:3bd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.beta.documentcloud.org/api/documents/20413525/?expand=user%2Corganization%2Cnotes%2Csections%2Cnotes.organization%2Cnotes.user
Protocol: H2
Server: 2606:4700:10::6816:3bd5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-requested-with
Origin: https://beta.documentcloud.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 23 Nov 2020 13:36:57 GMT
access-control-allow-origin: https://beta.documentcloud.org
access-control-allow-credentials: true
access-control-allow-methods: DELETE, GET, OPTIONS, PATCH, POST, PUT
access-control-allow-headers: accept, accept-encoding, authorization, content-type, dnt, origin, user-agent, x-csrftoken, x-requested-with
access-control-max-age: 1728000
via: 1.1 vegur
cf-cache-status: DYNAMIC
cf-request-id: 0696eb768100002c3ab42b6000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5f6b48373e4b2c3a-FRA

OPTIONS
H2 204 /
api.beta.documentcloud.org/api/users/me/ 0
0 503ms
474ms Other 2606:4700:10::6816:3bd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.beta.documentcloud.org/api/users/me/?expand=user%2Corganization
Protocol: H2
Server: 2606:4700:10::6816:3bd5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: x-requested-with
Origin: https://beta.documentcloud.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 23 Nov 2020 13:36:57 GMT
access-control-allow-origin: https://beta.documentcloud.org
access-control-allow-credentials: true
access-control-allow-methods: DELETE, GET, OPTIONS, PATCH, POST, PUT
access-control-allow-headers: accept, accept-encoding, authorization, content-type, dnt, origin, user-agent, x-csrftoken, x-requested-with
access-control-max-age: 1728000
via: 1.1 vegur
cf-cache-status: DYNAMIC
cf-request-id: 0696eb768200002c3abb937000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5f6b48373e4f2c3a-FRA

GET
H2 200 / Show response
api.beta.documentcloud.org/api/documents/20413525/ 1 KB
1 KB 530ms
514ms XHR
application/json 2606:4700:10::6816:3bd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.beta.documentcloud.org/api/documents/20413525/?expand=user%2Corganization%2Cnotes%2Csections%2Cnotes.organization%2Cnotes.user

Requested by

Host: beta.documentcloud.org
URL: https://beta.documentcloud.org/bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3bd5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5656f15e6f613e746c0b30fc87b55afe38d373a2740d6222e7e213191c4e3e4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=60; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 23 Nov 2020 13:36:58 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: MISS
content-type: application/json
content-encoding: gzip
vary: Cookie, Accept, Origin, Accept-Language, Accept-Encoding
cf-request-id: 0696eb782f000097ba0c203000000001
allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
server: cloudflare
x-frame-options: DENY
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=60; includeSubDomains; preload
content-language: en
access-control-allow-origin: https://beta.documentcloud.org
x-xss-protection: 1; mode=block
cache-control: public, max-age=300
access-control-allow-credentials: true
cf-ray: 5f6b4839e82d97ba-FRA

GET
H2 404 / Show response
api.beta.documentcloud.org/api/users/me/ 23 B
179 B 492ms
491ms XHR
application/json 2606:4700:10::6816:3bd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.beta.documentcloud.org/api/users/me/?expand=user%2Corganization

Requested by

Host: beta.documentcloud.org
URL: https://beta.documentcloud.org/bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3bd5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cacf8a32e69eabea7d57711f4ccbeed4d284e1bbd0789137936d388da707b9de

Security Headers

Name	Value
Strict-Transport-Security	max-age=60; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 23 Nov 2020 13:36:58 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-type: application/json
vary: Accept, Origin, Accept-Language, Cookie
content-length: 23
x-xss-protection: 1; mode=block
allow: GET, PUT, PATCH, HEAD, OPTIONS
server: cloudflare
x-frame-options: DENY
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=60; includeSubDomains; preload
content-language: en
access-control-allow-origin: https://beta.documentcloud.org
access-control-allow-credentials: true
cf-request-id: 0696eb785c000097bae8b12000000001
cf-ray: 5f6b483a286397ba-FRA

GET
DATA 200
OK truncated
/ 123 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 964f619d79d4ebc1522aa1780158dfe8457d5db1cef4dcc8d3aa25a254b381ad

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,400i,600,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://beta.documentcloud.org
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,400i,600,700&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 11:20:38 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:14 GMT
server: sffe
age: 526579
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13324
x-xss-protection: 0
expires: Wed, 17 Nov 2021 11:20:38 GMT

GET
H3-Q050 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 13 KB
13 KB 34ms
20ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,400i,600,700&display=swap

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

487f2e9da2ff0740755a5ef01dc15a2888b89537795895203a831b13b199d8bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://beta.documentcloud.org
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,400i,600,700&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 11:20:38 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:11 GMT
server: sffe
age: 526580
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12976
x-xss-protection: 0
expires: Wed, 17 Nov 2021 11:20:38 GMT

GET
H2 200 fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc-p1-thumbnail.gif
assets.documentcloud.org/documents/20413525/pages/ 5 KB
5 KB 551ms
541ms Image
image/gif 2606:4700:10::6816:3bd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.documentcloud.org/documents/20413525/pages/fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc-p1-thumbnail.gif?ts=1605901797402
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3bd5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fdc212c96bfb168d8388fb36a23a4fe6c71b3c6124ba1e5eecec1380b6231ea5

Request headers

Referer: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 23 Nov 2020 13:36:59 GMT
via: 1.1 b56f9b741cabfa29551ca2899d93a1e9.cloudfront.net (CloudFront)
cf-cache-status: MISS
x-amz-cf-pop: HEL50-C1
x-cache: RefreshHit from cloudfront
content-length: 4912
cf-request-id: 0696eb7a6c000097baf03f2000000001
last-modified: Fri, 20 Nov 2020 19:49:46 GMT
server: cloudflare
etag: "c8da61542266bffb386f56ddbee6071f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
accept-ranges: bytes
cf-ray: 5f6b483d7b3a97ba-FRA
x-amz-cf-id: eM-jG0nypZVEnHSfntGAwmjWkfX2Fy04V9O3D3MDI58UinLLhquLsQ==

GET
H2 200 fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc-p1-normal.gif
assets.documentcloud.org/documents/20413525/pages/ 303 KB
304 KB 563ms
553ms Image
image/gif 2606:4700:10::6816:3bd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.documentcloud.org/documents/20413525/pages/fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc-p1-normal.gif?ts=1605901797402
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3bd5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9d9a2d1ef3a886c6419077a3d8cc60358ad7a2ef3e82d753133b7313d72e57b

Request headers

Referer: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 23 Nov 2020 13:36:59 GMT
via: 1.1 b41c5c36f8ef3fb3917c7ce9f7687196.cloudfront.net (CloudFront)
cf-cache-status: MISS
x-amz-cf-pop: HEL50-C1
x-cache: RefreshHit from cloudfront
content-length: 310287
cf-request-id: 0696eb7a6a000097bae2ae7000000001
last-modified: Fri, 20 Nov 2020 19:49:46 GMT
server: cloudflare
etag: "85d9785f5b09411c89ff583659f030f2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
accept-ranges: bytes
cf-ray: 5f6b483d7b3797ba-FRA
x-amz-cf-id: VVWXpZh2i4RpcZlX-Id0GrDjgxuTL3zbx5ZpHJdvHvWGqLzJWMZTpQ==

GET
H2 200 fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc-p2-thumbnail.gif
assets.documentcloud.org/documents/20413525/pages/ 5 KB
5 KB 575ms
565ms Image
image/gif 2606:4700:10::6816:3bd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.documentcloud.org/documents/20413525/pages/fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc-p2-thumbnail.gif?ts=1605901797402
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3bd5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f071ba72936d3b267dd859a2a24800c18e2ba225ae09940b76aedffe6c84d83

Request headers

Referer: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 23 Nov 2020 13:36:59 GMT
via: 1.1 ade5112c66aed0b9382e1d5c2fd9bde4.cloudfront.net (CloudFront)
cf-cache-status: MISS
x-amz-cf-pop: HEL50-C1
x-cache: Miss from cloudfront
content-length: 4624
cf-request-id: 0696eb7a6b000097ba0fb9e000000001
last-modified: Fri, 20 Nov 2020 19:49:48 GMT
server: cloudflare
etag: "86b300ba30786a79ee4bfde25a15bef1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
accept-ranges: bytes
cf-ray: 5f6b483d7b3997ba-FRA
x-amz-cf-id: F2NrMF_HygEaOJi_Cn-Ge060f8-xKq_9UGZVJHngZ6mTUWqcaTucWw==

GET
H2 200 fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc-p2-normal.gif
assets.documentcloud.org/documents/20413525/pages/ 283 KB
284 KB 660ms
651ms Image
image/gif 2606:4700:10::6816:3bd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.documentcloud.org/documents/20413525/pages/fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc-p2-normal.gif?ts=1605901797402
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:3bd5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cdb237ed399fc555c512feb0d4e66431e5913346b05e7577f17676dbf5be5fe

Request headers

Referer: https://beta.documentcloud.org/documents/20413525-fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 23 Nov 2020 13:36:59 GMT
via: 1.1 36168127cb283f921c7d9cd48f72214e.cloudfront.net (CloudFront)
cf-cache-status: MISS
x-amz-cf-pop: HEL50-C1
x-cache: Miss from cloudfront
content-length: 290014
cf-request-id: 0696eb7a6b000097ba179ed000000001
last-modified: Fri, 20 Nov 2020 19:49:48 GMT
server: cloudflare
etag: "8f737e54b4d81396a5b4e4f5dbb23e9b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
accept-ranges: bytes
cf-ray: 5f6b483d7b3897ba-FRA
x-amz-cf-id: 4duIPtT4iD4CrpNtCb-FmEnsuVKgB5MBN2R_b_oWFP10elgOLwLG_Q==

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.beta.documentcloud.org
assets.documentcloud.org
beta.documentcloud.org
fonts.googleapis.com
fonts.gstatic.com
2606:4700:10::6816:3bd5
2a00:1450:4001:808::200a
2a00:1450:4001:814::2003
2a03:b0c0:3:e0::298:6001
487f2e9da2ff0740755a5ef01dc15a2888b89537795895203a831b13b199d8bb
49ab0de3ef1c85afd914461e24efbaa9b3e41f0d330ddce9ab1d5ec0b5215c0f
4ba9a1e936fe7d253ce4df166f7bb2cc73d5e5947bbcd23a0a3b480f56775050
4c295d6115baa201f0d5c2a968515ecd6c798efff243ab8ca5524f00cf1a071a
5656f15e6f613e746c0b30fc87b55afe38d373a2740d6222e7e213191c4e3e4e
5f071ba72936d3b267dd859a2a24800c18e2ba225ae09940b76aedffe6c84d83
6a9608dc8a209d47f434ad7f7c1bde256525dfc72b4b2ae80f5e60be45da658a
6cdb237ed399fc555c512feb0d4e66431e5913346b05e7577f17676dbf5be5fe
964f619d79d4ebc1522aa1780158dfe8457d5db1cef4dcc8d3aa25a254b381ad
bf284d774d6885969668ffef141a938445349ae7b740aa852d6d2fd735c5f153
cacf8a32e69eabea7d57711f4ccbeed4d284e1bbd0789137936d388da707b9de
d9d9a2d1ef3a886c6419077a3d8cc60358ad7a2ef3e82d753133b7313d72e57b
ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c
fdc212c96bfb168d8388fb36a23a4fe6c71b3c6124ba1e5eecec1380b6231ea5

beta.documentcloud.org Open in urlscan Pro 2a03:b0c0:3:e0::298:6001 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

100 %IPv6

3 Domains

5 Subdomains

5 IPs

2 Countries

822 kBTransfer

1843 kBSize

0 Cookies

1 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

beta.documentcloud.org Open in urlscan Pro
2a03:b0c0:3:e0::298:6001 Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

5
Subdomains

5
IPs

2
Countries

822 kB
Transfer

1843 kB
Size

0
Cookies

15 HTTP transactions
1 data transactions