bobsullivan.net Open in urlscan Pro
35.209.88.245 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/aK0WMEVMUG
Effective URL:
https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
Submission: On September 25 via api (September 25th 2020, 1:27:27 pm UTC) from US

Summary HTTP 64 Redirects Links 26 Behaviour Indicators

Summary

This website contacted 20 IPs in 3 countries across 15 domains to perform 64 HTTP transactions. The main IP is 35.209.88.245, located in Mountain View, United States and belongs to GOOGLE-2, US. The main domain is bobsullivan.net.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 12th 2020. Valid for: 3 months.

This is the only time bobsullivan.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
11	35.209.88.245 35.209.88.245	19527 (GOOGLE-2) (GOOGLE-2)
14	192.0.77.37 192.0.77.37	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:817::200a	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81e::2001	15169 (GOOGLE) (GOOGLE)
3	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:821::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81b::2003	15169 (GOOGLE) (GOOGLE)
2	2600:9000:214... 2600:9000:214f:3600:e:7a:f180:93a1	16509 (AMAZON-02) (AMAZON-02)
1	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC)
4	52.71.102.21 52.71.102.21	14618 (AMAZON-AES) (AMAZON-AES)
1	2a03:2880:f02... 2a03:2880:f02d:e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:81a::200e	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
2	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:818::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:801::2001	15169 (GOOGLE) (GOOGLE)
64	20

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 35.209.88.245 (Mountain View, United States)

ASN19527 (GOOGLE-2, US)
PTR: 245.88.209.35.bc.googleusercontent.com

bobsullivan.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 192.0.77.37 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

c0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:214f:3600:e:7a:f180:93a1 (United States)

ASN16509 (AMAZON-02, US)

redtape.substack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

widgets.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.71.102.21 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-71-102-21.compute-1.amazonaws.com

app.alertme.news	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f02d:e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i2.wp.com

i1.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	wp.com c0.wp.com stats.wp.com widgets.wp.com pixel.wp.com i1.wp.com	119 KB
11	bobsullivan.net bobsullivan.net	137 KB
7	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	196 KB
6	doubleclick.net googleads.g.doubleclick.net
4	alertme.news app.alertme.news	61 KB
4	gstatic.com fonts.gstatic.com	37 KB
3	google-analytics.com www.google-analytics.com	19 KB
2	substack.com redtape.substack.com
1	googletagservices.com www.googletagservices.com	27 KB
1	google.com adservice.google.com	168 B
1	google.de adservice.google.de	168 B
1	facebook.com graph.facebook.com	356 B
1	ampproject.org cdn.ampproject.org	7 KB
1	googleapis.com fonts.googleapis.com	1 KB
1	t.co t.co	416 B
64	15

	Domain	Requested by
14	c0.wp.com	bobsullivan.net
11	bobsullivan.net	t.co bobsullivan.net c0.wp.com
6	googleads.g.doubleclick.net	pagead2.googlesyndication.com
5	pagead2.googlesyndication.com	bobsullivan.net pagead2.googlesyndication.com
4	app.alertme.news	bobsullivan.net app.alertme.news
4	fonts.gstatic.com	fonts.googleapis.com
3	www.google-analytics.com	bobsullivan.net www.google-analytics.com
2	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
2	i1.wp.com	bobsullivan.net
2	pixel.wp.com	bobsullivan.net
2	redtape.substack.com	bobsullivan.net
1	www.googletagservices.com	pagead2.googlesyndication.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	graph.facebook.com	c0.wp.com
1	widgets.wp.com	bobsullivan.net
1	stats.wp.com	bobsullivan.net
1	cdn.ampproject.org	bobsullivan.net
1	fonts.googleapis.com	bobsullivan.net
1	t.co
64	20

This site contains links to these domains. Also see Links.

Domain
i2.wp.com
www.fbi.gov
www.sophos.com
redtape.substack.com
sanford.duke.edu
law.duke.edu
www.johnreedstark.com
i0.wp.com
i1.wp.com
akismet.com
anchor.fm
amzn.to

Subject Issuer	Validity	Valid
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
bobsullivan.net cPanel, Inc. Certification Authority	`2020-08-12` - `2020-11-10`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
upload.video.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
substack.com Amazon	`2020-01-20` - `2021-02-20`	a year	crt.sh
alertme.news Amazon	`2019-10-26` - `2020-11-26`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh

This page contains 12 frames:

Primary Page: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
Frame ID: 36368AD3803DA5764C796F6AF5032107
Requests: 55 HTTP requests in this frame

Frame: https://redtape.substack.com/embed
Frame ID: 6C270EAD2BC0A053A337E2116A9EC46B
Requests: 1 HTTP requests in this frame

Frame: https://redtape.substack.com/embed
Frame ID: F826D651104FCCB865CE0B44E465DAF1
Requests: 1 HTTP requests in this frame

Frame: https://widgets.wp.com/likes/master.html?ver=202039
Frame ID: 5EF240FC71AC3AE216D04AD1524573AA
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20200923/r20190131/zrt_lookup.html
Frame ID: ABCD53F1146C68428125C6094183E33B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4295962267558415&output=html&h=280&slotname=7549700399&adk=142460716&adf=2448473013&w=1080&fwrn=4&fwrnh=100&lmt=1601040429&rafmt=1&psa=0&guci=1.2.0.0.2.2.0.0&format=1080x280&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&dt=1601040429196&bpp=50&bdt=1161&idt=192&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=5183999559803&frm=20&pv=2&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=576198493077552&dssz=40&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=260&ady=25&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeoE%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=1&uci=a!1&fsb=1&xpc=rBHQFyKY3A&p=https%3A//bobsullivan.net&dtd=235
Frame ID: 7B90E2890412EF413DE244A758891385
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4295962267558415&output=html&adk=3826760629&adf=1341073466&lmt=1601040429&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&ea=0&flash=0&pra=5&wgl=1&dt=1601040429246&bpp=5&bdt=1211&idt=212&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1080x280&nras=1&correlator=5183999559803&frm=20&pv=1&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=2827998306762800&dssz=41&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&dtd=222
Frame ID: D50C4626FAD9DAB7BFD41ACA10143D7F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4295962267558415&output=html&h=250&adk=3321845778&adf=3521685246&w=326&fwrn=4&fwrnh=100&lmt=1601040429&rafmt=1&to=qs&pwprc=7168360279&psa=0&guci=1.2.0.0.2.2.0.0&format=326x250&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1601040429643&bpp=2&bdt=1608&idt=-M&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1080x280%2C0x0&nras=1&correlator=5183999559803&frm=20&pv=1&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=2827998306762800&dssz=41&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=285&ady=1273&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=szE786Y9yw&p=https%3A//bobsullivan.net&dtd=36
Frame ID: 26BF32A29F5FFA46C280F88AE8F45D19
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4295962267558415&output=html&h=250&adk=2116024476&adf=1633717941&w=326&fwrn=4&fwrnh=100&lmt=1601040429&rafmt=1&to=qs&pwprc=7168360279&psa=0&guci=1.2.0.0.2.2.0.0&format=326x250&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1601040429643&bpp=1&bdt=1608&idt=-M&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1080x280%2C0x0%2C326x250&nras=1&correlator=5183999559803&frm=20&pv=1&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=2827998306762800&dssz=41&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=285&ady=2993&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=exFsSC1r4O&p=https%3A//bobsullivan.net&dtd=52
Frame ID: 2F7A9A98ACB8C134DFF1CCEBF6580C37
Requests: 1 HTTP requests in this frame

Frame: https://app.alertme.news/set-cookie
Frame ID: 4AFEF08B79A5FDE824A54197E06F630F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4295962267558415&output=html&h=188&adk=2763969839&adf=1810995841&w=678&lmt=1601040429&nsk=4413e68a&rafmt=11&pwprc=7168360279&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=678x188&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&flash=0&pra=3&wgl=1&fa=26&adsid=NT&dt=1601040429643&bpp=7&bdt=1608&idt=7&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1080x280%2C0x0%2C326x250%2C326x250&nras=2&correlator=5183999559803&frm=20&pv=1&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=2827998306762800&dssz=41&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=637&ady=11355&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=0&fc=768&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8320&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=IuB8nffSZM&p=https%3A//bobsullivan.net&dtd=85
Frame ID: E640F8FB73C5102EEC2EE90728503477
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/216/runner.html
Frame ID: 3EA5291BB587DB1B378825EC0929A302
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://t.co/aK0WMEVMUG Page URL
https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /react.*\.js/i

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

64
Requests

100 %
HTTPS

63 %
IPv6

15
Domains

20
Subdomains

20
IPs

3
Countries

623 kB
Transfer

1557 kB
Size

5
Cookies

26 Outgoing links

These are links going to different origins than the main page.

URL: https://i2.wp.com/cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9126f5af-a866-467d-817b-2d91ba8c5cd6_600x376.png?ssl=1
Title: <img src="https://i1.wp.com/cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9126f5af-a866-467d-817b-2d91ba8c5cd6_600x376.png?w=678&ssl=1" alt="" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9126f5af-a866-467d-817b-2d91ba8c5cd6_600x376.png","height":376,"width":600,"resizeWidth":null,"bytes":363754,"alt":null,"title":null,"type":"image/png","href":null}" data-recalc-dims="1" />

Search URL Search Domain Scan URL

URL: https://www.fbi.gov/video-repository/psa-ransomware.mp4/view
Title: FBI image

Search URL Search Domain Scan URL

URL: https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/ransomware
Title: don’t pay ransomware gangs

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/medialibrary/Gated-Assets/white-papers/sophos-the-state-of-ransomware-2020-wp.pdf
Title: roughly half of U.S. corporations report

Search URL Search Domain Scan URL

URL: https://redtape.substack.com/p/nyts-kashmir-hill-and-learning-to
Title: about Facial Recognition

Search URL Search Domain Scan URL

URL: https://sanford.duke.edu/people/faculty/hoffman-david-alfred
Title: David Hoffman

Search URL Search Domain Scan URL

URL: https://law.duke.edu/fac/stansbury/
Title: Shane Stansbury

Search URL Search Domain Scan URL

URL: https://www.johnreedstark.com/
Title: John Reed Stark.

Search URL Search Domain Scan URL

URL: https://i2.wp.com/cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F6599096f-2fe7-4b49-ae2b-b7d6bd4687a2_75x91.png?ssl=1
Title: <img src="https://i1.wp.com/cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F6599096f-2fe7-4b49-ae2b-b7d6bd4687a2_75x91.png?w=678&ssl=1" alt="" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/6599096f-2fe7-4b49-ae2b-b7d6bd4687a2_75x91.png","height":91,"width":75,"resizeWidth":null,"bytes":13800,"alt":null,"title":null,"type":"image/png","href":null}" data-recalc-dims="1" />

Search URL Search Domain Scan URL

URL: https://i0.wp.com/cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc57cfa93-beae-4303-82b9-94a406259b44_75x75.png?ssl=1
Title: <img src="https://i2.wp.com/cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fc57cfa93-beae-4303-82b9-94a406259b44_75x75.png?w=678&ssl=1" alt="" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/c57cfa93-beae-4303-82b9-94a406259b44_75x75.png","height":75,"width":75,"resizeWidth":null,"bytes":8910,"alt":null,"title":null,"type":"image/png","href":null}" data-recalc-dims="1" />

Search URL Search Domain Scan URL

URL: https://i1.wp.com/cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdd90bd3a-4a59-477f-91ba-7ec7e8beedc8_75x85.png?ssl=1
Title: <img src="https://i2.wp.com/cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fdd90bd3a-4a59-477f-91ba-7ec7e8beedc8_75x85.png?w=678&ssl=1" alt="" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/dd90bd3a-4a59-477f-91ba-7ec7e8beedc8_75x85.png","height":85,"width":75,"resizeWidth":null,"bytes":12604,"alt":null,"title":null,"type":"image/png","href":null}" data-recalc-dims="1" />

Search URL Search Domain Scan URL

URL: https://i0.wp.com/cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbb2805aa-105d-4ea1-8748-981c766d9807_75x93.png?ssl=1
Title: <img src="https://i1.wp.com/cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fbb2805aa-105d-4ea1-8748-981c766d9807_75x93.png?w=678&ssl=1" alt="" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/bb2805aa-105d-4ea1-8748-981c766d9807_75x93.png","height":93,"width":75,"resizeWidth":null,"bytes":16527,"alt":null,"title":null,"type":"image/png","href":null}" data-recalc-dims="1" />

Search URL Search Domain Scan URL

URL: https://i1.wp.com/cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9438e603-8f6e-4046-b6e3-91faa64ad4dd_75x75.png?ssl=1
Title: <img src="https://i2.wp.com/cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9438e603-8f6e-4046-b6e3-91faa64ad4dd_75x75.png?w=678&ssl=1" alt="" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/9438e603-8f6e-4046-b6e3-91faa64ad4dd_75x75.png","height":75,"width":75,"resizeWidth":null,"bytes":8910,"alt":null,"title":null,"type":"image/png","href":null}" data-recalc-dims="1" />

Search URL Search Domain Scan URL

URL: https://i1.wp.com/cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F7511c645-a91f-4109-8ff8-04adb73326d9_75x85.png?ssl=1
Title: <img src="https://i2.wp.com/cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F7511c645-a91f-4109-8ff8-04adb73326d9_75x85.png?w=678&ssl=1" alt="" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/7511c645-a91f-4109-8ff8-04adb73326d9_75x85.png","height":85,"width":75,"resizeWidth":null,"bytes":12604,"alt":null,"title":null,"type":"image/png","href":null}" data-recalc-dims="1" />

Search URL Search Domain Scan URL

URL: https://i1.wp.com/cdn.substack.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fad4a2614-d00c-44ac-800c-517ccb53a93d_75x91.png?ssl=1
Title: <img src="https://i1.wp.com/cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2Fad4a2614-d00c-44ac-800c-517ccb53a93d_75x91.png?w=678&ssl=1" alt="" data-attrs="{"src":"https://bucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com/public/images/ad4a2614-d00c-44ac-800c-517ccb53a93d_75x91.png","height":91,"width":75,"resizeWidth":null,"bytes":14051,"alt":null,"title":null,"type":"image/png","href":null}" data-recalc-dims="1" />

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: https://anchor.fm/s/1fca0e30/podcast/rss

Search URL Search Domain Scan URL

URL: https://anchor.fm/bobsullivan/episodes/Dirty-digital-politics-Brainwashing-and-a-virus-attacking-democracy-ejfoaa
Title: Dirty digital politics: 'Brainwashing' and a virus attacking democracy

Search URL Search Domain Scan URL

URL: https://anchor.fm/bobsullivan/episodes/Why-arent-housing-prices-going-down-ehampr
Title: Why aren't housing prices going down?

Search URL Search Domain Scan URL

URL: https://anchor.fm/bobsullivan/episodes/Up-All-Night-with-Lisa-Napoli-The-birth-of-CNN-and-24-hour-news-egd5qd
Title: Up All Night with Lisa Napoli: The birth of CNN and 24-hour news

Search URL Search Domain Scan URL

URL: https://anchor.fm/bobsullivan/episodes/How-to-Lose-the-Information-War-eg5000
Title: How to Lose the Information War

Search URL Search Domain Scan URL

URL: https://anchor.fm/bobsullivan/episodes/Will-consumers-have-to-pay-their-banks-interest-efqq2t
Title: Will consumers have to pay their banks interest?

Search URL Search Domain Scan URL

URL: https://amzn.to/2B7TTpH
Title: <img class="wp-image-10781 size-medium" src="https://i1.wp.com/bobsullivan.net/wp-content/uploads/2020/05/Gotcha.jpg?resize=200%2C300&ssl=1" alt="" width="200" height="300" data-recalc-dims="1" />

Search URL Search Domain Scan URL

URL: https://amzn.to/2XDxdFp
Title: <img class="aligncenter wp-image-10782 size-medium" src="https://i0.wp.com/bobsullivan.net/wp-content/uploads/2020/05/Stop.jpg?resize=194%2C300&ssl=1" alt="" width="194" height="300" data-recalc-dims="1" />

Search URL Search Domain Scan URL

URL: https://amzn.to/3grlGl2
Title: <img class="aligncenter wp-image-10783 size-medium" src="https://i2.wp.com/bobsullivan.net/wp-content/uploads/2020/05/Your-Evil-Twin.jpg?resize=209%2C300&ssl=1" alt="" width="209" height="300" data-recalc-dims="1" />

Search URL Search Domain Scan URL

URL: https://amzn.to/3djachk
Title: <img class="wp-image-10220 size-full" src="https://i1.wp.com/bobsullivan.net/wp-content/uploads/2019/08/BArstool-cover-Edited-e1590593285156.jpg?resize=200%2C200&ssl=1" alt="" width="200" height="200" data-recalc-dims="1" />

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/aK0WMEVMUG Page URL
https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

64 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 aK0WMEVMUG Show response
t.co/ 430 B
416 B 165ms
165ms Document
text/html 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/aK0WMEVMUG

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

bd2f8c756a48a309e52bd91d4b0002f7f95fdfef7b0f74dbbbe9e1ba53c5cc6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

:method: GET
:authority: t.co
:scheme: https
:path: /aK0WMEVMUG
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
cache-control: private,max-age=300
content-encoding: gzip
content-length: 227
content-type: text/html; charset=utf-8
date: Fri, 25 Sep 2020 13:27:07 GMT
expires: Fri, 25 Sep 2020 13:32:07 GMT
server: tsa_o
set-cookie: muc=30346743-3eb2-4850-b15a-86e7e3d89acf; Max-Age=63072000; Expires=Sun, 25 Sep 2022 13:27:07 GMT; Domain=t.co; Secure; SameSite=None
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: 98f94f75b38de15310a2c5b52d9d41a9
x-response-time: 126
x-xss-protection: 0

GET
H2 200 Primary Request / Show response
bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/ 91 KB
23 KB 685ms
422ms Document
text/html 35.209.88.245
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL

https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Requested by

Host: t.co
URL: https://t.co/aK0WMEVMUG

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.209.88.245 Mountain View, United States, ASN19527 (GOOGLE-2, US),

Reverse DNS

245.88.209.35.bc.googleusercontent.com

Software

LiteSpeed / PHP/5.6.40

Resource Hash

c6bf23c3ba24a7676920eb1004fc3a36e78068e58699f5a47e64e9d4b7e83882

Security Headers

Name	Value
Strict-Transport-Security	max-age=30

Request headers

:method: GET
:authority: bobsullivan.net
:scheme: https
:path: /cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://t.co/aK0WMEVMUG
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://t.co/aK0WMEVMUG

Response headers

status: 200
x-powered-by: PHP/5.6.40
content-type: text/html; charset=UTF-8
x-pingback: https://bobsullivan.net/xmlrpc.php
link: <https://bobsullivan.net/wp-json/>; rel="https://api.w.org/" <https://bobsullivan.net/?p=11095>; rel=shortlink
content-encoding: br
vary: Accept-Encoding
date: Fri, 25 Sep 2020 13:27:07 GMT
server: LiteSpeed
strict-transport-security: max-age=30
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000

GET
H2 200 style.min.css
c0.wp.com/c/5.4.2/wp-includes/css/dist/block-library/ 52 KB
7 KB 95ms
30ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.4.2/wp-includes/css/dist/block-library/style.min.css

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Fri, 24 Apr 2020 15:32:14 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Sat, 25 Sep 2021 13:27:08 GMT

GET
H3-Q050 200 style.css
bobsullivan.net/wp-content/themes/mh-magazine/ 82 KB
14 KB 292ms
151ms Stylesheet
text/css 35.209.88.245
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL

https://bobsullivan.net/wp-content/themes/mh-magazine/style.css?ver=3.5.0

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

35.209.88.245 Mountain View, United States, ASN19527 (GOOGLE-2, US),

Reverse DNS

245.88.209.35.bc.googleusercontent.com

Software

LiteSpeed /

Resource Hash

d954e1c14b10a1fc7e22db9c9ad5fe8bae7a6586da5b226300e67e8e475c3dd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=30

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Wed, 05 Oct 2016 16:21:47 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=604800
strict-transport-security: max-age=30
accept-ranges: bytes
content-length: 14147
expires: Fri, 02 Oct 2020 13:27:08 GMT

GET
H3-Q050 200 font-awesome.min.css
bobsullivan.net/wp-content/themes/mh-magazine/includes/ 28 KB
6 KB 280ms
140ms Stylesheet
text/css 35.209.88.245
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL

https://bobsullivan.net/wp-content/themes/mh-magazine/includes/font-awesome.min.css

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

35.209.88.245 Mountain View, United States, ASN19527 (GOOGLE-2, US),

Reverse DNS

245.88.209.35.bc.googleusercontent.com

Software

LiteSpeed /

Resource Hash

008a1d103902f15fdb1c191fcb1ce8954330e7b8de43d09abb08555ba609f420

Security Headers

Name	Value
Strict-Transport-Security	max-age=30

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Wed, 05 Oct 2016 16:21:47 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=604800
strict-transport-security: max-age=30
accept-ranges: bytes
content-length: 6281
expires: Fri, 02 Oct 2020 13:27:08 GMT

GET
H2 200 css
fonts.googleapis.com/ 12 KB
1 KB 36ms
14ms Stylesheet
text/css 2a00:1450:4001:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8be5c6301da1b9998a2eda72be2f3fa24ae903241e176be45031da127cb7f4ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Origin: https://bobsullivan.net
Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 25 Sep 2020 13:21:02 GMT
server: ESF
date: Fri, 25 Sep 2020 13:27:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 25 Sep 2020 13:27:08 GMT

GET
H2 200 social-logos.min.css
c0.wp.com/p/jetpack/8.3/_inc/social-logos/ 26 KB
18 KB 92ms
31ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/8.3/_inc/social-logos/social-logos.min.css

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2e1ced1bd0736a56a0c44fd7b3bf8134850398ecddd52a0f5e6e437c5d527999

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Wed, 27 Jun 2018 01:03:44 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Sat, 25 Sep 2021 13:27:08 GMT

GET
H3-Q050 200 wp-emoji-release.min.js Show response
bobsullivan.net/wp-includes/js/ 14 KB
4 KB 155ms
138ms Script
application/javascript 35.209.88.245
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL

https://bobsullivan.net/wp-includes/js/wp-emoji-release.min.js?ver=5.4.2

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

35.209.88.245 Mountain View, United States, ASN19527 (GOOGLE-2, US),

Reverse DNS

245.88.209.35.bc.googleusercontent.com

Software

LiteSpeed /

Resource Hash

96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=30

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Wed, 01 Apr 2020 21:37:55 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800
strict-transport-security: max-age=30
accept-ranges: bytes
content-length: 4276
expires: Fri, 02 Oct 2020 13:27:08 GMT

GET
H2 200 jetpack.css
c0.wp.com/p/jetpack/8.3/css/ 70 KB
12 KB 38ms
37ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/8.3/css/jetpack.css

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

9dd1db00ed32d1cf4187f2ae448791d5c1f1478521cf9fa6ac2c63d65f0c6cfe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Tue, 25 Feb 2020 15:20:36 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Sat, 25 Sep 2021 13:27:08 GMT

GET
H2 200 jquery.js Show response
c0.wp.com/c/5.4.2/wp-includes/js/jquery/ 95 KB
32 KB 44ms
44ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.4.2/wp-includes/js/jquery/jquery.js

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Fri, 17 May 2019 04:25:54 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Sat, 25 Sep 2021 13:27:08 GMT

GET
H2 200 jquery-migrate.min.js Show response
c0.wp.com/c/5.4.2/wp-includes/js/jquery/ 10 KB
4 KB 37ms
34ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.4.2/wp-includes/js/jquery/jquery-migrate.min.js

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Fri, 20 May 2016 06:11:28 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Sat, 25 Sep 2021 13:27:08 GMT

GET
H2 200 related-posts.min.js Show response
c0.wp.com/p/jetpack/8.3/_inc/build/related-posts/ 5 KB
2 KB 37ms
35ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/8.3/_inc/build/related-posts/related-posts.min.js

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

71275c06e498f0aa672ac51e995d317cf07f26295d9ec48adebb000df8b3e7f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Tue, 29 Oct 2019 16:30:02 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Sat, 25 Sep 2021 13:27:08 GMT

GET
H3-Q050 200 scripts.js Show response
bobsullivan.net/wp-content/themes/mh-magazine/js/ 38 KB
11 KB 184ms
140ms Script
application/javascript 35.209.88.245
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL

https://bobsullivan.net/wp-content/themes/mh-magazine/js/scripts.js?ver=5.4.2

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

35.209.88.245 Mountain View, United States, ASN19527 (GOOGLE-2, US),

Reverse DNS

245.88.209.35.bc.googleusercontent.com

Software

LiteSpeed /

Resource Hash

6345ca63b5e66801b37b60884897ce0c2caaccf1aea5827c84c902a9faeb226b

Security Headers

Name	Value
Strict-Transport-Security	max-age=30

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Wed, 05 Oct 2016 16:21:47 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800
strict-transport-security: max-age=30
accept-ranges: bytes
content-length: 11564
expires: Fri, 02 Oct 2020 13:27:08 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 128 KB
44 KB 41ms
22ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d4147dcd6bc797c23a38c4a6632f5fe4a3c9c5bd6954febe63c4d8d783fdfaa0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 45179
x-xss-protection: 0
server: cafe
etag: 13529903371893424946
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 25 Sep 2020 13:27:08 GMT

GET
H2 200 amp-auto-ads-0.1.js Show response
cdn.ampproject.org/v0/ 20 KB
7 KB 77ms
39ms Script
text/javascript 2a00:1450:4001:81e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-auto-ads-0.1.js

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

99289d338f9d55d6d3edd986d104029ecfc7020a82a6162f2b947737a8ff39d0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6299
x-xss-protection: 0
server: sffe
date: Fri, 25 Sep 2020 13:27:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "f3945f768dcbb73e"
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 25 Sep 2020 13:27:08 GMT

GET
H3-Q050 200 rss.png
bobsullivan.net/wp-includes/images/ 608 B
665 B 155ms
141ms Image
image/png 35.209.88.245
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bobsullivan.net/wp-includes/images/rss.png

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

35.209.88.245 Mountain View, United States, ASN19527 (GOOGLE-2, US),

Reverse DNS

245.88.209.35.bc.googleusercontent.com

Software

LiteSpeed /

Resource Hash

0c6daa646e0a867e5f721b5017c98cfd2c82c26c60b614531ddae8a5d9986be8

Security Headers

Name	Value
Strict-Transport-Security	max-age=30

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:08 GMT
last-modified: Fri, 20 Dec 2019 16:40:13 GMT
server: LiteSpeed
strict-transport-security: max-age=30
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 608
expires: Fri, 02 Oct 2020 13:27:08 GMT

GET
H3-Q050 200 loading.gif
bobsullivan.net/wp-content/plugins/jetpack/modules/sharedaddy/images/ 2 KB
3 KB 155ms
140ms Image
image/gif 35.209.88.245
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bobsullivan.net/wp-content/plugins/jetpack/modules/sharedaddy/images/loading.gif

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

35.209.88.245 Mountain View, United States, ASN19527 (GOOGLE-2, US),

Reverse DNS

245.88.209.35.bc.googleusercontent.com

Software

LiteSpeed /

Resource Hash

3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82

Security Headers

Name	Value
Strict-Transport-Security	max-age=30

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:08 GMT
last-modified: Wed, 01 Apr 2020 18:06:34 GMT
server: LiteSpeed
strict-transport-security: max-age=30
content-type: image/gif
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 2530
expires: Fri, 02 Oct 2020 13:27:08 GMT

GET
H2 200 photon.min.js Show response
c0.wp.com/p/jetpack/8.3/_inc/build/photon/ 755 B
420 B 31ms
31ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/8.3/_inc/build/photon/photon.min.js

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

dc844732bd61279e509bda7247ed7fca55e5fced96db9c79eed48ca084e5ce0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Tue, 22 Oct 2019 15:04:13 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Sat, 25 Sep 2021 13:27:08 GMT

GET
H2 200 comment-reply.min.js Show response
c0.wp.com/c/5.4.2/wp-includes/js/ 2 KB
1 KB 31ms
31ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.4.2/wp-includes/js/comment-reply.min.js

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

a37ca4608218cccdfb8b6d4edbdfbf375d0e1368b46397e3b7049e0cbf5bc1f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Mon, 11 Nov 2019 11:51:03 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Sat, 25 Sep 2021 13:27:08 GMT

GET
H2 200 lazy-images.min.js Show response
c0.wp.com/p/jetpack/8.3/_inc/build/lazy-images/js/ 9 KB
3 KB 48ms
27ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/8.3/_inc/build/lazy-images/js/lazy-images.min.js

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

4c2d889ee46270fb2ae51c5ef8804efb7f03b4d5f2ab24a9fdd7a6400f75ea6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Fri, 21 Jun 2019 10:15:39 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Sat, 25 Sep 2021 13:27:08 GMT

GET
H2 200 wp-embed.min.js Show response
c0.wp.com/c/5.4.2/wp-includes/js/ 1 KB
721 B 48ms
28ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.4.2/wp-includes/js/wp-embed.min.js

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Sat, 26 Oct 2019 00:17:07 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Sat, 25 Sep 2021 13:27:08 GMT

GET
H2 200 postmessage.min.js Show response
c0.wp.com/p/jetpack/8.3/_inc/build/ 9 KB
4 KB 50ms
29ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/8.3/_inc/build/postmessage.min.js

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

96cae96a73c65ceed190aa0b4a9a86f0233798e9a17f27ca57855f4f79ebf678

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Wed, 01 May 2019 01:21:49 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Sat, 25 Sep 2021 13:27:08 GMT

GET
H2 200 jquery.jetpack-resize.min.js Show response
c0.wp.com/p/jetpack/8.3/_inc/build/ 3 KB
1022 B 50ms
30ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/8.3/_inc/build/jquery.jetpack-resize.min.js

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

265c34f4c62e6423e270cecb0c422b735dfb0f18cea04c2ac343b6f22106661e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Wed, 01 May 2019 01:21:49 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Sat, 25 Sep 2021 13:27:08 GMT

GET
H2 200 queuehandler.min.js Show response
c0.wp.com/p/jetpack/8.3/_inc/build/likes/ 6 KB
2 KB 51ms
30ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/8.3/_inc/build/likes/queuehandler.min.js

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ed9451e768c2d762d3d158e05ebed9bd87cdbf6aeb885b3c55e25e8c909ec6da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Wed, 01 May 2019 01:21:49 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Sat, 25 Sep 2021 13:27:08 GMT

GET
H3-Q050 200 form.js Show response
bobsullivan.net/wp-content/plugins/akismet/_inc/ 700 B
299 B 157ms
142ms Script
application/javascript 35.209.88.245
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL

https://bobsullivan.net/wp-content/plugins/akismet/_inc/form.js?ver=4.1.4

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

35.209.88.245 Mountain View, United States, ASN19527 (GOOGLE-2, US),

Reverse DNS

245.88.209.35.bc.googleusercontent.com

Software

LiteSpeed /

Resource Hash

0515cbd1f8aee97e1c8e0d1d015ca96c86def13e90d2e73bf813072ccc23d531

Security Headers

Name	Value
Strict-Transport-Security	max-age=30

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Wed, 01 Apr 2020 18:06:17 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=604800
strict-transport-security: max-age=30
accept-ranges: bytes
content-length: 250
expires: Fri, 02 Oct 2020 13:27:08 GMT

GET
H2 200 sharing.min.js Show response
c0.wp.com/p/jetpack/8.3/_inc/build/sharedaddy/ 8 KB
2 KB 52ms
31ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/8.3/_inc/build/sharedaddy/sharing.min.js

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

1e99034e4b75a1fb7ba372a3a950fa19ff4688d8561479b1a34dfcbde83ff3d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: br
last-modified: Tue, 27 Aug 2019 13:22:22 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
expires: Sat, 25 Sep 2021 13:27:08 GMT

GET
H2 200 e-202039.js Show response
stats.wp.com/ 9 KB
3 KB 107ms
29ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202039.js
Requested by: Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:08 GMT
content-encoding: gzip
server: nginx
etag: W/"5c6340e3-350a"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=31536000
expires: Mon, 20 Sep 2021 04:07:56 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 22ms
6ms Script
text/javascript 2a00:1450:4001:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 688
date: Fri, 25 Sep 2020 13:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Fri, 25 Sep 2020 15:15:40 GMT

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3-Q050 200 background-image.png
bobsullivan.net/wp-content/uploads/2016/10/ 2 KB
2 KB 156ms
141ms Image
image/png 35.209.88.245
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bobsullivan.net/wp-content/uploads/2016/10/background-image.png

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

35.209.88.245 Mountain View, United States, ASN19527 (GOOGLE-2, US),

Reverse DNS

245.88.209.35.bc.googleusercontent.com

Software

LiteSpeed /

Resource Hash

b1d587d9247d51907364770dde3650954517a9dc90d9e0346ddd70d990e06096

Security Headers

Name	Value
Strict-Transport-Security	max-age=30

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:08 GMT
last-modified: Tue, 04 Oct 2016 20:48:09 GMT
server: LiteSpeed
strict-transport-security: max-age=30
content-type: image/png
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 2018
expires: Fri, 02 Oct 2020 13:27:08 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 19ms
9ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://bobsullivan.net
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:23:18 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:28 GMT
server: sffe
age: 241430
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9132
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:23:18 GMT

GET
H2 200 mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 15ms
8ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://bobsullivan.net
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:25:30 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:27 GMT
server: sffe
age: 241298
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9080
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:25:30 GMT

GET
H3-Q050 200 fontawesome-webfont.woff2
bobsullivan.net/wp-content/themes/mh-magazine/fonts/ 70 KB
70 KB 148ms
142ms Font
font/woff2 35.209.88.245
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL

https://bobsullivan.net/wp-content/themes/mh-magazine/fonts/fontawesome-webfont.woff2?v=4.6.3

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/wp-content/themes/mh-magazine/includes/font-awesome.min.css

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

35.209.88.245 Mountain View, United States, ASN19527 (GOOGLE-2, US),

Reverse DNS

245.88.209.35.bc.googleusercontent.com

Software

LiteSpeed /

Resource Hash

7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Security Headers

Name	Value
Strict-Transport-Security	max-age=30

Request headers

Origin: https://bobsullivan.net
Referer: https://bobsullivan.net/wp-content/themes/mh-magazine/includes/font-awesome.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:08 GMT
last-modified: Wed, 05 Oct 2016 16:21:48 GMT
server: LiteSpeed
strict-transport-security: max-age=30
content-type: font/woff2
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 71896
expires: Fri, 02 Oct 2020 13:27:08 GMT

GET
H3-Q050 200 mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 29ms
14ms Font
font/woff2 2a00:1450:4001:81b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://bobsullivan.net
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:22:51 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:49 GMT
server: sffe
age: 241457
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9180
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:22:51 GMT

GET
H2 200 embed
redtape.substack.com/ Frame 6C27 0
0 375ms
326ms Document
text/html 2600:9000:214f:3600:e:7a:f180:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://redtape.substack.com/embed

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:3600:e:7a:f180:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: redtape.substack.com
:scheme: https
:path: /embed
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Response headers

status: 200
content-type: text/html; charset=utf-8
server: Cowboy
x-powered-by: Express
strict-transport-security: max-age=31536000
cache-control: no-cache
set-cookie: ajs_anonymous_id=%2249a20155-41fd-42e7-abc2-79a479988be4%22; Max-Age=31536000; Path=/; Expires=Sat, 25 Sep 2021 13:27:08 GMT
etag: W/"5fb9-Iibas9KRsnUAMQK34lL7TQTFVwQ"
date: Fri, 25 Sep 2020 13:27:08 GMT
via: 1.1 vegur, 1.1 7549433a09d06354ea864d169b689e51.cloudfront.net (CloudFront)
content-encoding: gzip
vary: Accept-Encoding
x-cache: Miss from cloudfront
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: rQeUA2uzDp2UuyM2FybnkdUuNO5R-C6u4Uch5zP2VzbNvKyLhAgVcA==

GET
H2 200 embed
redtape.substack.com/ Frame F826 0
0 534ms
489ms Document
text/html 2600:9000:214f:3600:e:7a:f180:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://redtape.substack.com/embed

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:214f:3600:e:7a:f180:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cowboy / Express

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: redtape.substack.com
:scheme: https
:path: /embed
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Response headers

status: 200
content-type: text/html; charset=utf-8
server: Cowboy
x-powered-by: Express
strict-transport-security: max-age=31536000
cache-control: no-cache
set-cookie: ajs_anonymous_id=%2220785b48-80c4-4832-aae9-a119df6b14b2%22; Max-Age=31536000; Path=/; Expires=Sat, 25 Sep 2021 13:27:08 GMT
etag: W/"5fb9-7K2CVFnycCGr7x+n+SoqRc30PMI"
date: Fri, 25 Sep 2020 13:27:08 GMT
via: 1.1 vegur, 1.1 7549433a09d06354ea864d169b689e51.cloudfront.net (CloudFront)
content-encoding: gzip
vary: Accept-Encoding
x-cache: Miss from cloudfront
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: MAM8yDALH_gQHXCjRtVrvlmH3jpfDgZKgvfw6mX2T78bYsAl2CO53A==

GET
DATA 200
OK truncated
/ 18 KB
18 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 94b293e2c7affa223f0e3a5cfd950030c8aacee84bc93ec5f0d35c7f4e91381b

Request headers

Origin: https://bobsullivan.net
Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H3-Q050 200 mem6YaGs126MiZpBA-UFUK0Zdc1GAK6b.woff2
fonts.gstatic.com/s/opensans/v18/ 10 KB
10 KB 11ms
6ms Font
font/woff2 2a00:1450:4001:81b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem6YaGs126MiZpBA-UFUK0Zdc1GAK6b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ffcde34efda55a63cb66dbec4bf10acb531014d581e2d8e511836b84e08c2305

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://bobsullivan.net
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400italic,600,700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 18:23:23 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:34 GMT
server: sffe
age: 241425
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9728
x-xss-protection: 0
expires: Wed, 22 Sep 2021 18:23:23 GMT

GET
H2 200 master.html
widgets.wp.com/likes/ Frame 5EF2 0
0 104ms
30ms Document
text/html 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.wp.com/likes/master.html?ver=202039
Requested by: Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash

Request headers

:method: GET
:authority: widgets.wp.com
:scheme: https
:path: /likes/master.html?ver=202039
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Response headers

status: 200
server: nginx
date: Fri, 25 Sep 2020 13:27:08 GMT
content-type: text/html
last-modified: Wed, 26 Aug 2020 21:12:41 GMT
vary: Accept-Encoding
etag: W/"5f46d049-84e"
content-encoding: gzip
x-ac: 4.ams _dfw
x-nc: HIT ams 2

GET
H/1.1 200
OK button.js Show response
app.alertme.news/build/ 133 KB
52 KB 583ms
216ms Script
application/javascript 52.71.102.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://app.alertme.news/build/button.js
Requested by: Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.102.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-102-21.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: 2ed6ff9cc5402b5f1e821b567dc283526287c54ea3df3a6ba4f373f21f1c2591

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 25 Sep 2020 13:27:09 GMT
Content-Encoding: gzip
Last-Modified: Thu, 27 Aug 2020 21:50:23 GMT
Server: nginx/1.12.1
ETag: W/"5f482a9f-215de"
transfer-encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=3600, public
Connection: keep-alive
Expires: Fri, 25 Sep 2020 14:27:09 GMT

GET
H3-Q050 200 / Show response
bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/ 3 KB
3 KB 440ms
437ms XHR
application/json 35.209.88.245
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL

https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/?relatedposts=1

Requested by

Host: c0.wp.com
URL: https://c0.wp.com/c/5.4.2/wp-includes/js/jquery/jquery.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

35.209.88.245 Mountain View, United States, ASN19527 (GOOGLE-2, US),

Reverse DNS

245.88.209.35.bc.googleusercontent.com

Software

LiteSpeed / PHP/5.6.40

Resource Hash

3d9ecde73dadd5771992cff267370ef707e86a59bb86d3c31586849eb73c8951

Security Headers

Name	Value
Strict-Transport-Security	max-age=30
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:09 GMT
x-content-type-options: nosniff
server: LiteSpeed
x-powered-by: PHP/5.6.40
x-pingback: https://bobsullivan.net/xmlrpc.php
content-type: application/json; charset=utf-8
status: 200
strict-transport-security: max-age=30
content-length: 2839

GET
H2 200 / Show response
graph.facebook.com/ 244 B
356 B 38ms
34ms Script
text/javascript 2a03:2880:f02d:e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?callback=WPCOMSharing.update_facebook_count&ids=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&_=1601040428377

Requested by

Host: c0.wp.com
URL: https://c0.wp.com/c/5.4.2/wp-includes/js/jquery/jquery.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

159fb7772ef0ba3a81a8dea12d3f6f2fe089a0ded490c929afd1a55f0c0f002c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
status: 200
x-fb-rev: 1002724208
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 181
pragma: no-cache
x-fb-debug: K5fGB8reZSzmjg6ehqFuIQXbhHi2OlYrMQcgLVI7FURUtKjvZ64Kv4Po51c6CNAbj55GmTrelxgc/BWuPODHuw==
x-fb-trace-id: Bj9YpsePR92
date: Fri, 25 Sep 2020 13:27:08 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
x-fb-request-id: AeKiIzQmSOTeEK290hompoI
cache-control: no-store
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
115 B 42ms
30ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=wpcom-no-pv&x_sharing-count-request=facebook&r=0.2950981420861556
Requested by: Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 25 Sep 2020 13:27:09 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
125 B 53ms
15ms XHR
text/plain 2a00:1450:4001:81a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=1028952051&t=pageview&_s=1&dl=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&dr=https%3A%2F%2Ft.co%2FaK0WMEVMUG&ul=en-us&de=UTF-8&dt=What%27s%20it%20really%20like%20to%20negotiate%20with%20ransomware%20gangs%3F%20%E2%80%94%20bobsullivan.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=2122997110&gjid=290970789&cid=944338413.1601040429&tid=UA-1136492-3&_gid=2092476396.1601040429&_r=1&_slc=1&z=1248784056

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:27:09 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://bobsullivan.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
392 B 9ms
8ms Image
image/gif 2a00:1450:4001:81a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&a=1028952051&t=pageview&_s=2&dl=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&dr=https%3A%2F%2Ft.co%2FaK0WMEVMUG&ul=en-us&de=UTF-8&dt=What%27s%20it%20really%20like%20to%20negotiate%20with%20ransomware%20gangs%3F%20%E2%80%94%20bobsullivan.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=&gjid=&cid=944338413.1601040429&tid=UA-1136492-3&_gid=2092476396.1601040429&z=1055735775

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 09:27:56 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 14353
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/ 229 KB
86 KB 40ms
31ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54b6cf10b667bc74240725a385f0c33b9349f2d33dd14c9e89315fca83337b4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 87838
x-xss-protection: 0
server: cafe
etag: 497831285299538397
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 25 Sep 2020 13:27:09 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20200923/r20190131/ Frame ABCD 0
0 7ms
6ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20200923/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20200923/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Thu, 24 Sep 2020 21:37:36 GMT
expires: Thu, 08 Oct 2020 21:37:36 GMT
content-type: text/html; charset=UTF-8
etag: 17942277541989656716
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4728
x-xss-protection: 0
age: 56973
cache-control: public, max-age=1209600
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2 200 g.gif
pixel.wp.com/ 50 B
74 B 30ms
29ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A8.3&blog=58054615&post=11095&tz=-4&srv=bobsullivan.net&host=bobsullivan.net&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&fcp=1217&rand=0.9550036704042484
Requested by: Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 25 Sep 2020 13:27:09 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9126f5af-a866-467d-817b-2d91ba8c5cd6_600x376.png
i1.wp.com/cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/ 15 KB
16 KB 103ms
35ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9126f5af-a866-467d-817b-2d91ba8c5cd6_600x376.png?w=678&ssl=1

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

152cbc0a915603dec31a590be730f4f7e8866bbd416f2361a7f9523d6212f432

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 2
date: Fri, 25 Sep 2020 13:27:09 GMT
x-content-type-options: nosniff
last-modified: Fri, 25 Sep 2020 03:39:30 GMT
server: nginx
etag: "6430dde9af20a890"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://cdn.substack.com/image/fetch/w_1456,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com%2Fpublic%2Fimages%2F9126f5af-a866-467d-817b-2d91ba8c5cd6_600x376.png>; rel="canonical"
content-length: 15696
expires: Sun, 25 Sep 2022 15:39:30 GMT

GET
H2 200 Gotcha.jpg
i1.wp.com/bobsullivan.net/wp-content/uploads/2020/05/ 11 KB
11 KB 121ms
54ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/bobsullivan.net/wp-content/uploads/2020/05/Gotcha.jpg?resize=200%2C300&ssl=1

Requested by

Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i2.wp.com

Software

nginx /

Resource Hash

058869be3b5faed58cd97227553135d4aed437da393f01d718f3dd111a5ae1f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc: HIT ams 7
date: Fri, 25 Sep 2020 13:27:09 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Sep 2020 05:06:52 GMT
server: nginx
etag: "39dc95386a3d060f"
vary: Accept
content-type: image/webp
status: 200
cache-control: public, max-age=63115200
link: <https://bobsullivan.net/wp-content/uploads/2020/05/Gotcha.jpg>; rel="canonical"
content-length: 10890
expires: Thu, 22 Sep 2022 17:06:52 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
168 B 16ms
14ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=bobsullivan.net

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Sep 2020 13:27:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
168 B 17ms
16ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=bobsullivan.net

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Sep 2020 13:27:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 7B90 0
0 395ms
394ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4295962267558415&output=html&h=280&slotname=7549700399&adk=142460716&adf=2448473013&w=1080&fwrn=4&fwrnh=100&lmt=1601040429&rafmt=1&psa=0&guci=1.2.0.0.2.2.0.0&format=1080x280&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&dt=1601040429196&bpp=50&bdt=1161&idt=192&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=5183999559803&frm=20&pv=2&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=576198493077552&dssz=40&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=260&ady=25&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeoE%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=1&uci=a!1&fsb=1&xpc=rBHQFyKY3A&p=https%3A//bobsullivan.net&dtd=235

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Logo_GpaSiriusSingleIframe.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Logo_GpaSiriusSingleIframe.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNLUxrC0hOwCFYG-UQod2SUHyw&gqi=LfBtX4yeG5PDbOr6sMAB&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Logo_GpaSiriusSingleIframe.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4295962267558415&output=html&h=280&slotname=7549700399&adk=142460716&adf=2448473013&w=1080&fwrn=4&fwrnh=100&lmt=1601040429&rafmt=1&psa=0&guci=1.2.0.0.2.2.0.0&format=1080x280&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&dt=1601040429196&bpp=50&bdt=1161&idt=192&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=5183999559803&frm=20&pv=2&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=576198493077552&dssz=40&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=260&ady=25&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeoE%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=1&uci=a!1&fsb=1&xpc=rBHQFyKY3A&p=https%3A//bobsullivan.net&dtd=235
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Logo_GpaSiriusSingleIframe.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Logo_GpaSiriusSingleIframe.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CNLUxrC0hOwCFYG-UQod2SUHyw&gqi=LfBtX4yeG5PDbOr6sMAB&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Logo_GpaSiriusSingleIframe.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 25 Sep 2020 13:27:09 GMT
server: cafe
content-length: 22691
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Fri, 25-Sep-2020 13:42:09 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Fri, 25 Sep 2020 13:27:09 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 55ms
50ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3b142f2fc1b181088ebc5bd873a725bba5e4ea24b20874e7880b163f778765e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1600860702447659"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27610
x-xss-protection: 0
expires: Fri, 25 Sep 2020 13:27:09 GMT

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame D50C 0
0 74ms
70ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4295962267558415&output=html&adk=3826760629&adf=1341073466&lmt=1601040429&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&ea=0&flash=0&pra=5&wgl=1&dt=1601040429246&bpp=5&bdt=1211&idt=212&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1080x280&nras=1&correlator=5183999559803&frm=20&pv=1&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=2827998306762800&dssz=41&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&dtd=222

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4295962267558415&output=html&adk=3826760629&adf=1341073466&lmt=1601040429&plat=1%3A32776%2C2%3A32776%2C9%3A32776%2C10%3A32%2C11%3A32%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&ea=0&flash=0&pra=5&wgl=1&dt=1601040429246&bpp=5&bdt=1211&idt=212&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1080x280&nras=1&correlator=5183999559803&frm=20&pv=1&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=2827998306762800&dssz=41&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8192&bc=31&ifi=1&uci=a!1&fsb=1&dtd=222
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 25 Sep 2020 13:27:09 GMT
server: cafe
content-length: 1559
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Fri, 25-Sep-2020 13:42:09 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Fri, 25 Sep 2020 13:27:09 GMT
cache-control: private

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 26BF 0
0 509ms
505ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4295962267558415&output=html&h=250&adk=3321845778&adf=3521685246&w=326&fwrn=4&fwrnh=100&lmt=1601040429&rafmt=1&to=qs&pwprc=7168360279&psa=0&guci=1.2.0.0.2.2.0.0&format=326x250&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1601040429643&bpp=2&bdt=1608&idt=-M&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1080x280%2C0x0&nras=1&correlator=5183999559803&frm=20&pv=1&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=2827998306762800&dssz=41&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=285&ady=1273&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=szE786Y9yw&p=https%3A//bobsullivan.net&dtd=36

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4295962267558415&output=html&h=250&adk=3321845778&adf=3521685246&w=326&fwrn=4&fwrnh=100&lmt=1601040429&rafmt=1&to=qs&pwprc=7168360279&psa=0&guci=1.2.0.0.2.2.0.0&format=326x250&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1601040429643&bpp=2&bdt=1608&idt=-M&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1080x280%2C0x0&nras=1&correlator=5183999559803&frm=20&pv=1&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=2827998306762800&dssz=41&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=285&ady=1273&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=szE786Y9yw&p=https%3A//bobsullivan.net&dtd=36
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 25 Sep 2020 13:27:10 GMT
server: cafe
content-length: 26815
x-xss-protection: 0
set-cookie: IDE=AHWqTUnuXQvJ83uxKQ4wZzQzGMCo7CcjIn-7-LAY3EyfB3MauRfc-vc8cczDOCZe; expires=Wed, 20-Oct-2021 13:27:09 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Fri, 25 Sep 2020 13:27:10 GMT
cache-control: private

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 2F7A 0
0 281ms
280ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4295962267558415&output=html&h=250&adk=2116024476&adf=1633717941&w=326&fwrn=4&fwrnh=100&lmt=1601040429&rafmt=1&to=qs&pwprc=7168360279&psa=0&guci=1.2.0.0.2.2.0.0&format=326x250&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1601040429643&bpp=1&bdt=1608&idt=-M&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1080x280%2C0x0%2C326x250&nras=1&correlator=5183999559803&frm=20&pv=1&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=2827998306762800&dssz=41&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=285&ady=2993&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=exFsSC1r4O&p=https%3A//bobsullivan.net&dtd=52

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4295962267558415&output=html&h=250&adk=2116024476&adf=1633717941&w=326&fwrn=4&fwrnh=100&lmt=1601040429&rafmt=1&to=qs&pwprc=7168360279&psa=0&guci=1.2.0.0.2.2.0.0&format=326x250&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1601040429643&bpp=1&bdt=1608&idt=-M&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1080x280%2C0x0%2C326x250&nras=1&correlator=5183999559803&frm=20&pv=1&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=2827998306762800&dssz=41&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=285&ady=2993&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeEbr%7C&abl=CS&pfx=0&fu=8320&bc=31&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=exFsSC1r4O&p=https%3A//bobsullivan.net&dtd=52
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 25 Sep 2020 13:27:09 GMT
server: cafe
content-length: 25816
x-xss-protection: 0
set-cookie: IDE=AHWqTUmwpCbRO_LcYs9sbCxY6doURox23UkqtfhHQBCGjj7hWFwLzZwiH6YRsvOe; expires=Wed, 20-Oct-2021 13:27:09 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Fri, 25 Sep 2020 13:27:09 GMT
cache-control: private

GET
H3-Q050 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/ 145 KB
52 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/reactive_library_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50845df391333edf5527001d86d48ec35a97680a2c908ec38431bc0374eac364

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 53325
x-xss-protection: 0
server: cafe
etag: 6042794684332580431
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Fri, 25 Sep 2020 13:27:09 GMT

GET
H/1.1 200
OK button.css
app.alertme.news/build/ 30 KB
7 KB 124ms
124ms Stylesheet
text/css 52.71.102.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://app.alertme.news/build/button.css
Requested by: Host: app.alertme.news
URL: https://app.alertme.news/build/button.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.102.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-102-21.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: 3c13e961a233132a4cdbd4b9a1122a70792aaf9022eb6a713e654970cf99ae43

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Fri, 25 Sep 2020 13:27:09 GMT
Content-Encoding: gzip
Last-Modified: Thu, 27 Aug 2020 21:50:23 GMT
Server: nginx/1.12.1
ETag: W/"5f482a9f-771d"
Content-Type: text/css
Cache-Control: max-age=3600, public
Connection: keep-alive
Content-Length: 6978
Expires: Fri, 25 Sep 2020 14:27:09 GMT

GET
H/1.1 200
OK Cookie set set-cookie
app.alertme.news/ Frame 4AFE 0
0 308ms
179ms Document
text/html 52.71.102.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://app.alertme.news/set-cookie
Requested by: Host: app.alertme.news
URL: https://app.alertme.news/build/button.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.102.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-102-21.compute-1.amazonaws.com
Software: nginx/1.12.1 / PHP/7.0.29
Resource Hash

Request headers

Host: app.alertme.news
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Response headers

Cache-Control: no-cache
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Fri, 25 Sep 2020 13:27:10 GMT
Server: nginx/1.12.1
Set-Cookie: AlertMeSession=ivgsvgjicfeao99g60hvnik1f0; path=/; HttpOnly
X-Powered-By: PHP/7.0.29
Content-Length: 110
Connection: keep-alive

GET
H/1.1 200
OK pixel.gif
app.alertme.news/img/ 1 KB
1 KB 330ms
110ms Image
image/gif 52.71.102.21
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://app.alertme.news/img/pixel.gif?url=https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/&pub=12&1601040429841
Requested by: Host: bobsullivan.net
URL: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.71.102.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-71-102-21.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: ce38946e0d5de5f4f6793579c0521f2555aa0fb80d96c8091b1cd58d23640b2b

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 13:27:10 GMT
Last-Modified: Fri, 30 Jun 2017 20:29:36 GMT
Server: nginx/1.12.1
ETag: "5956b4b0-44d"
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1101

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame E640 0
0 315ms
315ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4295962267558415&output=html&h=188&adk=2763969839&adf=1810995841&w=678&lmt=1601040429&nsk=4413e68a&rafmt=11&pwprc=7168360279&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=678x188&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&flash=0&pra=3&wgl=1&fa=26&adsid=NT&dt=1601040429643&bpp=7&bdt=1608&idt=7&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1080x280%2C0x0%2C326x250%2C326x250&nras=2&correlator=5183999559803&frm=20&pv=1&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=2827998306762800&dssz=41&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=637&ady=11355&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=0&fc=768&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8320&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=IuB8nffSZM&p=https%3A//bobsullivan.net&dtd=85

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-4295962267558415&output=html&h=188&adk=2763969839&adf=1810995841&w=678&lmt=1601040429&nsk=4413e68a&rafmt=11&pwprc=7168360279&psa=0&guci=1.2.0.0.2.2.0.0&ad_type=text_image&format=678x188&url=https%3A%2F%2Fbobsullivan.net%2Fcybercrime%2Fwhats-it-really-like-to-negotiate-with-ransomware-gangs%2F&flash=0&pra=3&wgl=1&fa=26&adsid=NT&dt=1601040429643&bpp=7&bdt=1608&idt=7&shv=r20200923&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1080x280%2C0x0%2C326x250%2C326x250&nras=2&correlator=5183999559803&frm=20&pv=1&ga_vid=944338413.1601040429&ga_sid=1601040429&ga_hid=1028952051&ga_fc=0&iag=0&icsg=2827998306762800&dssz=41&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=637&ady=11355&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=182982100%2C182982300%2C21066434&oid=3&pvsid=2257722468082068&pem=773&ref=https%3A%2F%2Ft.co%2FaK0WMEVMUG&rx=0&eae=0&fc=768&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8320&bc=31&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=IuB8nffSZM&p=https%3A//bobsullivan.net&dtd=85
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Fri, 25 Sep 2020 13:27:10 GMT
server: cafe
content-length: 35933
x-xss-protection: 0
set-cookie: IDE=AHWqTUnbMh2G1Ti60RCbhGUBI_bntmlCRMuUYVT68S22GOaC-VIlP_poKfu0jb1j; expires=Wed, 20-Oct-2021 13:27:09 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
expires: Fri, 25 Sep 2020 13:27:10 GMT
cache-control: private

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 46ms
24ms XHR
application/json 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200923&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f886f0c9769b5154c7bec0542fe9825ac87c4524a3b753ddb231f6f40a73c08d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 25 Sep 2020 13:27:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6360
x-xss-protection: 0

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 16 KB
6 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200923/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1fcdc54759ab0ead6a9c0f35707e01926c8c4e13c6ce7ad59477a81a9e4acd47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 13:27:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1600730918364481"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5975
x-xss-protection: 0
expires: Fri, 25 Sep 2020 13:27:10 GMT

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/216/ Frame 3EA5 0
0 10ms
6ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/216/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/216/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 4674
date: Fri, 25 Sep 2020 12:59:04 GMT
expires: Sat, 25 Sep 2021 12:59:04 GMT
last-modified: Mon, 21 Sep 2020 21:29:19 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1686
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
535 B 17ms
16ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=216&t=2&li=gda_r20200923&jk=2257722468082068&bg=!gYKlgppYHKct4M6775ECAAAAz1IAAAAfCgIa5TyevlKb6KuK0doPRWkLqRgiPm6lhNbPcxRQzfaDjFAOK3ptZ9XosNEnSmg3Ie9h0Nf30t2nGz3bKVLs78YBtFe4hh_uTMdbtxKqqRpjbn1pywRDMjmFJZZhpBPWScRb2O076pHOdvCe24v7EpjwPJjiFutBJII_6TUmhW4Du4dP19XkpwWsiczvXIbpM_fyxe752KqC10ejXLnL8KHOoJ-0Rg-hogtwI0pC-SS-GATjoCYSRPNyg4X6oQ9iLNT-qkzUqtckOrC95CrGa6j26s-SctocefTI5s6c94UbB39319eV0Ufa1HEQsyR7gT5LjahFBPcLzfU6uCJ7sZopxPXLpHIDXWvATvlo5U6CF6Vxhv495UrEiaEONuYIssshK83YVDM6exBmPfB36QHjE1zP5M44bve0OZ2FTn742fR8nLe57i4Zt9fmLYck24gRGV8ZT_siwvpRYTnzBDAqJjM-rW8p6En1YCmvoJcOMC3Uc8t3kgt5yq3VEUDt5k1h3SUj6zsEjgmqZAYffypGmyqFc4vf_KL1z0Uu75EY6CWttHi2WuwGePuQyW4TuIhfNMHjokLCVGnMP3jSTbUKg_5PJj0OtnLIbWh4pNaalZkpLS_-XoJKKHNnZok1fgCKAG6Hzid_-MMW_RTJYOUCDbikHy0cOzgEzsBm1Wdnm2HZkL4vS9SwLq7ev4L3M_h8OxR4G3iCA0IPoZkBqBo_JoO2TmTTdb--kRfiS-Uajk9JVi2iqd5J7wShisRCqNWmZvKbxee00CYDgCtI5YLN-DOi8NeG-5cz7d5VHRwGsyU_hs-HoUbBHUKbpS-Mk-chVZqEpJq6m3GGXpNyQKc4lA0HCHFz_RWtMicG05S-_G709Z5hbn1_VWWiNrmy7JLqzL3II1ILZ6TG3MYHvuJfHid2XoCPbV-YsDa-qknDp04zE_U5Xn6-_sNF2rjs8JXvJ6TG0sEz63CbfHdxsy3VI4OnjKNtVbGiCgVXef2RDp6EF6i7AW9KM8I086TebimPtti0N4kbpZwz9DP2Ctzhx8uF5ob0XTepMSx6lAvy0kPnWj245HJS0csPU-cHpVhw2hqg6Zf6P5uc2e04YXx4I3LEApHybbewZWwU47SytOvD0j_E_oaEn_rgGaZToGCEZyn-YUDES1wnJdPcMv-txfNi2kBPCDq6t66URhj1Xh57OAMPNRmn1MjuVFPYiF0_MJxWQ-BIr39T94ngQTtRGEVQAN7mauo2YT0NXvbyjS0sb6GF6V9fvUyJhQD75K3_WqoaJiE

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bobsullivan.net/cybercrime/whats-it-really-like-to-negotiate-with-ransomware-gangs/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 25 Sep 2020 13:27:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

92 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 12:44:04	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-19 22:05:36	Name: IDE Value: AHWqTUnbMh2G1Ti60RCbhGUBI_bntmlCRMuUYVT68S22GOaC-VIlP_poKfu0jb1j
.bobsullivan.net/	1970-01-19 12:44:00	Name: _gat Value: 1
.bobsullivan.net/	1970-01-19 12:45:26	Name: _gid Value: GA1.2.2092476396.1601040429
.bobsullivan.net/	1970-01-20 06:15:12	Name: _ga Value: GA1.2.944338413.1601040429

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://c0.wp.com/c/5.4.2/wp-includes/js/jquery/jquery-migrate.min.js(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
app.alertme.news
bobsullivan.net
c0.wp.com
cdn.ampproject.org
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
graph.facebook.com
i1.wp.com
pagead2.googlesyndication.com
pixel.wp.com
redtape.substack.com
stats.wp.com
t.co
tpc.googlesyndication.com
widgets.wp.com
www.google-analytics.com
www.googletagservices.com
104.244.42.69
192.0.76.3
192.0.77.2
192.0.77.32
192.0.77.37
2600:9000:214f:3600:e:7a:f180:93a1
2a00:1450:4001:800::2002
2a00:1450:4001:800::2003
2a00:1450:4001:801::2001
2a00:1450:4001:806::2002
2a00:1450:4001:817::200a
2a00:1450:4001:818::2002
2a00:1450:4001:81a::200e
2a00:1450:4001:81b::2003
2a00:1450:4001:81e::2001
2a00:1450:4001:821::200e
2a03:2880:f02d:e:face:b00c:0:2
35.209.88.245
52.71.102.21
008a1d103902f15fdb1c191fcb1ce8954330e7b8de43d09abb08555ba609f420
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0515cbd1f8aee97e1c8e0d1d015ca96c86def13e90d2e73bf813072ccc23d531
058869be3b5faed58cd97227553135d4aed437da393f01d718f3dd111a5ae1f2
0c6daa646e0a867e5f721b5017c98cfd2c82c26c60b614531ddae8a5d9986be8
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
152cbc0a915603dec31a590be730f4f7e8866bbd416f2361a7f9523d6212f432
159fb7772ef0ba3a81a8dea12d3f6f2fe089a0ded490c929afd1a55f0c0f002c
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e99034e4b75a1fb7ba372a3a950fa19ff4688d8561479b1a34dfcbde83ff3d8
1fcdc54759ab0ead6a9c0f35707e01926c8c4e13c6ce7ad59477a81a9e4acd47
265c34f4c62e6423e270cecb0c422b735dfb0f18cea04c2ac343b6f22106661e
2e1ced1bd0736a56a0c44fd7b3bf8134850398ecddd52a0f5e6e437c5d527999
2ed6ff9cc5402b5f1e821b567dc283526287c54ea3df3a6ba4f373f21f1c2591
3c13e961a233132a4cdbd4b9a1122a70792aaf9022eb6a713e654970cf99ae43
3d9ecde73dadd5771992cff267370ef707e86a59bb86d3c31586849eb73c8951
3fa54e29f88aee644eaaac38e11681ea07858eb1ea76b1baae12597aae83fe82
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4c2d889ee46270fb2ae51c5ef8804efb7f03b4d5f2ab24a9fdd7a6400f75ea6c
50845df391333edf5527001d86d48ec35a97680a2c908ec38431bc0374eac364
54b6cf10b667bc74240725a385f0c33b9349f2d33dd14c9e89315fca83337b4e
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6345ca63b5e66801b37b60884897ce0c2caaccf1aea5827c84c902a9faeb226b
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
71275c06e498f0aa672ac51e995d317cf07f26295d9ec48adebb000df8b3e7f8
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8be5c6301da1b9998a2eda72be2f3fa24ae903241e176be45031da127cb7f4ac
94b293e2c7affa223f0e3a5cfd950030c8aacee84bc93ec5f0d35c7f4e91381b
96cae96a73c65ceed190aa0b4a9a86f0233798e9a17f27ca57855f4f79ebf678
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea
99289d338f9d55d6d3edd986d104029ecfc7020a82a6162f2b947737a8ff39d0
9dd1db00ed32d1cf4187f2ae448791d5c1f1478521cf9fa6ac2c63d65f0c6cfe
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a37ca4608218cccdfb8b6d4edbdfbf375d0e1368b46397e3b7049e0cbf5bc1f6
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
b1d587d9247d51907364770dde3650954517a9dc90d9e0346ddd70d990e06096
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
bd2f8c756a48a309e52bd91d4b0002f7f95fdfef7b0f74dbbbe9e1ba53c5cc6b
c6bf23c3ba24a7676920eb1004fc3a36e78068e58699f5a47e64e9d4b7e83882
ce38946e0d5de5f4f6793579c0521f2555aa0fb80d96c8091b1cd58d23640b2b
d3b142f2fc1b181088ebc5bd873a725bba5e4ea24b20874e7880b163f778765e
d4147dcd6bc797c23a38c4a6632f5fe4a3c9c5bd6954febe63c4d8d783fdfaa0
d954e1c14b10a1fc7e22db9c9ad5fe8bae7a6586da5b226300e67e8e475c3dd7
dc844732bd61279e509bda7247ed7fca55e5fced96db9c79eed48ca084e5ce0a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed9451e768c2d762d3d158e05ebed9bd87cdbf6aeb885b3c55e25e8c909ec6da
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f886f0c9769b5154c7bec0542fe9825ac87c4524a3b753ddb231f6f40a73c08d
ffcde34efda55a63cb66dbec4bf10acb531014d581e2d8e511836b84e08c2305

bobsullivan.net Open in urlscan Pro 35.209.88.245 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

64 Requests

100 %HTTPS

63 %IPv6

15 Domains

20 Subdomains

20 IPs

3 Countries

623 kBTransfer

1557 kBSize

5 Cookies

26 Outgoing links

Page URL History

Redirected requests

64 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

bobsullivan.net Open in urlscan Pro
35.209.88.245 Public Scan

Screenshot
Live screenshot

Full Image

64
Requests

100 %
HTTPS

63 %
IPv6

15
Domains

20
Subdomains

20
IPs

3
Countries

623 kB
Transfer

1557 kB
Size

5
Cookies

64 HTTP transactions
2 data transactions