www.reuters.com Open in urlscan Pro
13.226.155.95 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-crimi...
Effective URL:
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-crimi...
Submission: On August 12 via api (August 12th 2020, 5:31:33 pm UTC) from US

Summary HTTP 164 Redirects Links 25 Behaviour Indicators

Summary

This website contacted 54 IPs in 8 countries across 37 domains to perform 164 HTTP transactions. The main IP is 13.226.155.95, located in Seattle, United States and belongs to AMAZON-02, US. The main domain is www.reuters.com.
TLS certificate: Issued by Amazon on March 4th 2020. Valid for: a year.

This is the only time www.reuters.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5	13.226.155.95 13.226.155.95	16509 (AMAZON-02) (AMAZON-02)
11	13.226.155.12 13.226.155.12	16509 (AMAZON-02) (AMAZON-02)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:2b	20446 (HIGHWINDS3) (HIGHWINDS3)
2	2600:9000:218... 2600:9000:2182:ea00:18:1fcd:34e:d2a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:218... 2600:9000:2182:ac00:1e:ef1b:aa40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:821::2008	15169 (GOOGLE) (GOOGLE)
4	13.226.155.87 13.226.155.87	16509 (AMAZON-02) (AMAZON-02)
1	13.226.155.40 13.226.155.40	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
7	2.20.168.134 2.20.168.134	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2406:da00:ff0... 2406:da00:ff00::36eb:b8ea	14618 (AMAZON-AES) (AMAZON-AES)
1	13.226.155.108 13.226.155.108	16509 (AMAZON-02) (AMAZON-02)
1	13.226.132.149 13.226.132.149	16509 (AMAZON-02) (AMAZON-02)
11	104.18.22.230 104.18.22.230	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:1b:... 2a04:4e42:1b::714	54113 (FASTLY) (FASTLY)
3	2606:4700:20:... 2606:4700:20::ac43:4af5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6811:b8b1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:818::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:4f6b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2600:9000:218... 2600:9000:2182:9800:10:27b4:f500:93a1	16509 (AMAZON-02) (AMAZON-02)
3	3.222.135.156 3.222.135.156	14618 (AMAZON-AES) (AMAZON-AES)
1 3	104.108.64.33 104.108.64.33	16625 (AKAMAI-AS) (AKAMAI-AS)
1	35.201.93.216 35.201.93.216	15169 (GOOGLE) (GOOGLE)
1	2600:1f18:624... 2600:1f18:624f:b000:1a0c:44be:c431:52fe	14618 (AMAZON-AES) (AMAZON-AES)
5	23.210.250.97 23.210.250.97	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:9000:218... 2600:9000:2182:9000:1:af78:4c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	66.81.204.228 66.81.204.228	40034 (CONFLUENC...) (CONFLUENCE-NETWORK-INC)
2	23.62.140.165 23.62.140.165	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.73.249.152 52.73.249.152	14618 (AMAZON-AES) (AMAZON-AES)
7	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:815::2002	15169 (GOOGLE) (GOOGLE)
6	216.58.212.130 216.58.212.130	15169 (GOOGLE) (GOOGLE)
2	54.201.25.196 54.201.25.196	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 1	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
3 5	2a00:1450:400... 2a00:1450:4001:800::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81a::2003	15169 (GOOGLE) (GOOGLE)
6	52.18.153.122 52.18.153.122	16509 (AMAZON-02) (AMAZON-02)
2	13.226.155.2 13.226.155.2	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:819::2001	15169 (GOOGLE) (GOOGLE)
19	2a00:1450:400... 2a00:1450:4001:825::2001	15169 (GOOGLE) (GOOGLE)
1	52.73.105.22 52.73.105.22	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:9000:218... 2600:9000:2182:ca00:5:9a4c:9b00:93a1	16509 (AMAZON-02) (AMAZON-02)
2 4	172.217.23.134 172.217.23.134	15169 (GOOGLE) (GOOGLE)
1 1	151.101.114.137 151.101.114.137	54113 (FASTLY) (FASTLY)
5	151.101.14.137 151.101.14.137	54113 (FASTLY) (FASTLY)
4	23.210.250.213 23.210.250.213	16625 (AKAMAI-AS) (AKAMAI-AS)
2	35.178.2.28 35.178.2.28	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:218... 2600:9000:2182:4e00:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
5	3.136.223.216 3.136.223.216	16509 (AMAZON-02) (AMAZON-02)
4	104.244.39.20 104.244.39.20	7415 (ADSAFE-1) (ADSAFE-1)
1	13.226.155.49 13.226.155.49	16509 (AMAZON-02) (AMAZON-02)
2	13.226.155.42 13.226.155.42	16509 (AMAZON-02) (AMAZON-02)
164	54

5 13.226.155.95 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-95.dus51.r.cloudfront.net

www.reuters.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 13.226.155.12 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-12.dus51.r.cloudfront.net

static.reuters.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2182:ea00:18:1fcd:34e:d2a1 (United States)

ASN16509 (AMAZON-02, US)

static.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2182:ac00:1e:ef1b:aa40:93a1 (United States)

ASN16509 (AMAZON-02, US)

queso-cdn.prod.reuters.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.226.155.87 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-87.dus51.r.cloudfront.net

s3.reutersmedia.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.40 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-40.dus51.r.cloudfront.net

s4.reutersmedia.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:814::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2.20.168.134 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-20-168-134.deploy.static.akamaitechnologies.com

c.evidon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2406:da00:ff00::36eb:b8ea (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

usasync01.admantx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.108 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-108.dus51.r.cloudfront.net

cdn.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.132.149 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-132-149.dus51.r.cloudfront.net

cdn.segment.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 104.18.22.230 (United States)

ASN13335 (CLOUDFLARENET, US)

www.dianomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:1b::714 (Ascension Island)

ASN54113 (FASTLY, US)

mab.chartbeat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:20::ac43:4af5 (United States)

ASN13335 (CLOUDFLARENET, US)

tru.am	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
beacon.tru.am	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6811:b8b1 (United States)

ASN13335 (CLOUDFLARENET, US)

experience.tinypass.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.tinypass.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4f6b (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2182:9800:10:27b4:f500:93a1 (United States)

ASN16509 (AMAZON-02, US)

iabmap.evidon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.222.135.156 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-222-135-156.compute-1.amazonaws.com

l.betrad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.108.64.33 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-64-33.deploy.static.akamaitechnologies.com

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.93.216 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 216.93.201.35.bc.googleusercontent.com

gwiqcdn.globalwebindex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:624f:b000:1a0c:44be:c431:52fe (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

sope.prod.reuters.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.210.250.97 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-250-97.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2182:9000:1:af78:4c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

vendorlist.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.81.204.228 (Virgin Islands (British))

ASN40034 (CONFLUENCE-NETWORK-INC, VG)

s.mnet-ad.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.62.140.165 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-62-140-165.deploy.static.akamaitechnologies.com

cdneu-xch.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.73.249.152 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-73-249-152.compute-1.amazonaws.com

evidon.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:815::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 216.58.212.130 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f130.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.201.25.196 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-201-25-196.us-west-2.compute.amazonaws.com

api.segment.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9b (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:800::2004 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.18.153.122 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-153-122.eu-west-1.compute.amazonaws.com

pixel.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.226.155.2 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-2.dus51.r.cloudfront.net

get.s-onetag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dfp-gateway.s-onetag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

b16cdb5aef2c277f8dbd85c3c47d37a3.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:4001:825::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.73.105.22 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-73-105-22.compute-1.amazonaws.com

ping.chartbeat.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2182:ca00:5:9a4c:9b00:93a1 (United States)

ASN16509 (AMAZON-02, US)

beacon.s-onetag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.23.134 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s18-in-f134.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.114.137 (Frankfurt am Main, Germany) 1 redirects

ASN54113 (FASTLY, US)

cd.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.14.137 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

cds.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vid.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.210.250.213 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-250-213.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
reutersdfpcw319687550988.s.moatpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.178.2.28 (London, United Kingdom)

ASN16509 (AMAZON-02, US)

geo.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2182:4e00:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.136.223.216 (Seattle, United States)

ASN16509 (AMAZON-02, US)

capi.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.244.39.20 (United States)

ASN7415 (ADSAFE-1, US)
PTR: amidt.adsafeprotected.com

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.49 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-49.dus51.r.cloudfront.net

onetag-geo.s-onetag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.226.155.42 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-42.dus51.r.cloudfront.net

onetag-geo-grouping.s-onetag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	reuters.com www.reuters.com static.reuters.com	794 KB
14	googlesyndication.com b16cdb5aef2c277f8dbd85c3c47d37a3.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	63 KB
13	doubleclick.net 3 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net ad.doubleclick.net googleads.g.doubleclick.net	112 KB
13	adsafeprotected.com cdn.adsafeprotected.com pixel.adsafeprotected.com static.adsafeprotected.com dt.adsafeprotected.com	100 KB
11	connatix.com 1 redirects cd.connatix.com cds.connatix.com capi.connatix.com vid.connatix.com img.connatix.com	232 KB
11	dianomi.com www.dianomi.com	15 KB
10	ampproject.org cdn.ampproject.org	349 KB
8	evidon.com c.evidon.com iabmap.evidon.com	42 KB
7	media.net contextual.media.net cdneu-xch.media.net	207 KB
6	s-onetag.com get.s-onetag.com beacon.s-onetag.com dfp-gateway.s-onetag.com onetag-geo.s-onetag.com onetag-geo-grouping.s-onetag.com	23 KB
6	google.com 3 redirects adservice.google.com www.google.com	1 KB
6	google-analytics.com www.google-analytics.com	78 KB
5	reutersmedia.net s3.reutersmedia.net s4.reutersmedia.net	87 KB
3	moatpixel.com reutersdfpcw319687550988.s.moatpixel.com	759 B
3	moatads.com z.moatads.com geo.moatads.com	104 KB
3	googletagservices.com www.googletagservices.com	73 KB
3	scorecardresearch.com 1 redirects sb.scorecardresearch.com	3 KB
3	betrad.com l.betrad.com	360 B
3	tinypass.com experience.tinypass.com cdn.tinypass.com	125 KB
3	tru.am tru.am beacon.tru.am	13 KB
3	chartbeat.com static.chartbeat.com mab.chartbeat.com	32 KB
2	facebook.com www.facebook.com	348 B
2	segment.io api.segment.io	282 B
2	google.de adservice.google.de www.google.de	1 KB
2	consensu.org vendorlist.consensu.org evidon.mgr.consensu.org	19 KB
2	facebook.net connect.facebook.net	167 KB
2	reuters.tv queso-cdn.prod.reuters.tv sope.prod.reuters.tv	26 KB
1	chartbeat.net ping.chartbeat.net	168 B
1	mnet-ad.net s.mnet-ad.net	355 B
1	globalwebindex.net gwiqcdn.globalwebindex.net	6 KB
1	cloudflare.com cdnjs.cloudflare.com	2 KB
1	ytimg.com s.ytimg.com	33 KB
1	segment.com cdn.segment.com	96 KB
1	admantx.com usasync01.admantx.com	663 B
1	youtube.com www.youtube.com	1 KB
1	googletagmanager.com www.googletagmanager.com	92 KB
1	jquery.com code.jquery.com	30 KB
164	37

	Domain	Requested by
11	www.dianomi.com	static.reuters.com www.dianomi.com www.reuters.com
11	static.reuters.com	www.reuters.com
10	cdn.ampproject.org	securepubads.g.doubleclick.net
9	tpc.googlesyndication.com	securepubads.g.doubleclick.net www.reuters.com tpc.googlesyndication.com
7	c.evidon.com	static.reuters.com c.evidon.com
6	pixel.adsafeprotected.com	cdn.adsafeprotected.com www.reuters.com
6	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net www.reuters.com
6	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.reuters.com
5	capi.connatix.com	cds.connatix.com
5	www.google.com	3 redirects www.reuters.com
5	contextual.media.net	static.reuters.com contextual.media.net www.reuters.com
5	www.reuters.com	static.reuters.com www.googletagmanager.com c.evidon.com
4	dt.adsafeprotected.com
4	pagead2.googlesyndication.com	securepubads.g.doubleclick.net
4	ad.doubleclick.net	2 redirects www.reuters.com
4	s3.reutersmedia.net	www.reuters.com
3	reutersdfpcw319687550988.s.moatpixel.com
3	cds.connatix.com	www.reuters.com cds.connatix.com
3	www.googletagservices.com	contextual.media.net securepubads.g.doubleclick.net
3	sb.scorecardresearch.com	1 redirects www.reuters.com
3	l.betrad.com	www.reuters.com
2	onetag-geo-grouping.s-onetag.com	beacon.s-onetag.com
2	static.adsafeprotected.com	pixel.adsafeprotected.com www.reuters.com
2	geo.moatads.com	z.moatads.com
2	googleads.g.doubleclick.net	www.reuters.com
2	www.facebook.com	www.reuters.com connect.facebook.net
2	api.segment.io	cdn.segment.com
2	cdneu-xch.media.net	www.reuters.com
2	connect.facebook.net	cdn.segment.com connect.facebook.net
2	experience.tinypass.com	www.reuters.com cdn.tinypass.com
2	tru.am	www.googletagmanager.com tru.am
2	static.chartbeat.com	www.reuters.com
1	onetag-geo.s-onetag.com	beacon.s-onetag.com
1	img.connatix.com
1	vid.connatix.com	cds.connatix.com
1	dfp-gateway.s-onetag.com	get.s-onetag.com
1	z.moatads.com	securepubads.g.doubleclick.net
1	cd.connatix.com	1 redirects
1	beacon.s-onetag.com	get.s-onetag.com
1	ping.chartbeat.net
1	b16cdb5aef2c277f8dbd85c3c47d37a3.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	get.s-onetag.com	www.googletagmanager.com
1	www.google.de	www.reuters.com
1	stats.g.doubleclick.net	1 redirects
1	adservice.google.com	www.googletagservices.com
1	adservice.google.de	www.googletagservices.com
1	evidon.mgr.consensu.org	c.evidon.com
1	s.mnet-ad.net	www.reuters.com
1	vendorlist.consensu.org	c.evidon.com
1	beacon.tru.am	tru.am
1	sope.prod.reuters.tv	static.reuters.com
1	gwiqcdn.globalwebindex.net	www.reuters.com
1	iabmap.evidon.com	c.evidon.com
1	cdn.tinypass.com	experience.tinypass.com
1	cdnjs.cloudflare.com	www.dianomi.com
1	s.ytimg.com	www.youtube.com
1	mab.chartbeat.com	static.chartbeat.com
1	cdn.segment.com	www.reuters.com
1	cdn.adsafeprotected.com	static.reuters.com
1	usasync01.admantx.com	static.reuters.com
1	www.youtube.com	www.reuters.com
1	s4.reutersmedia.net	www.reuters.com
1	www.googletagmanager.com	www.reuters.com
1	queso-cdn.prod.reuters.tv	www.reuters.com
1	code.jquery.com	www.reuters.com
164	65

This site contains links to these domains. Also see Links.

Domain
www.refinitiv.com
www.thomsonreuters.com
www.reutersagency.com
risk.thomsonreuters.com
blogs.thomsonreuters.com
innovation.thomsonreuters.com
reuters.zendesk.com
www.twitter.com
www.facebook.com
thomsonreuters.com
newslink.reuters.com
sales.reuters.com
info.evidon.com
twitter.com
www.youtube.com
instagram.com
www.linkedin.com

Subject Issuer	Validity	Valid
www.reuters.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
static.reuters.com Amazon	`2019-11-25` - `2020-12-25`	a year	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
*.chartbeat.com Thawte RSA CA 2018	`2020-06-01` - `2021-06-02`	a year	crt.sh
*.prod.reuters.tv Amazon	`2019-12-31` - `2021-01-31`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
*.evidon.com DigiCert Secure Site ECC CA-1	`2020-04-29` - `2021-07-29`	a year	crt.sh
*.admantx.com SSL.com RSA SSL subCA	`2019-03-29` - `2021-06-25`	2 years	crt.sh
*.adsafeprotected.com COMODO RSA Domain Validation Secure Server CA	`2018-08-20` - `2020-09-17`	2 years	crt.sh
*.segment.com DigiCert SHA2 Secure Server CA	`2020-06-12` - `2021-07-27`	a year	crt.sh
dianomi.com Cloudflare Inc ECC CA-3	`2020-07-02` - `2021-07-02`	a year	crt.sh
f6.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-06-13` - `2021-04-24`	10 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-20` - `2021-07-20`	a year	crt.sh
ssl802628.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2020-05-20` - `2020-11-26`	6 months	crt.sh
cdnjs.cloudflare.com DigiCert ECC Secure Server CA	`2020-08-12` - `2022-08-17`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-07-21` - `2020-10-12`	3 months	crt.sh
l.betrad.com Go Daddy Secure Certificate Authority - G2	`2019-04-25` - `2021-06-24`	2 years	crt.sh
sb.scorecardresearch.com DigiCert Secure Site ECC CA-1	`2020-07-17` - `2021-06-02`	a year	crt.sh
*.globalwebindex.net RapidSSL RSA CA 2018	`2017-12-13` - `2020-12-19`	3 years	crt.sh
*.media.net DigiCert SHA2 Secure Server CA	`2020-02-25` - `2021-05-26`	a year	crt.sh
vendorlist.consensu.org Amazon	`2020-02-07` - `2021-03-07`	a year	crt.sh
*.mnet-ad.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-06` - `2021-04-14`	a year	crt.sh
evidon.mgr.consensu.org Amazon	`2020-07-25` - `2021-08-25`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
fw.adsafeprotected.com Amazon	`2020-03-14` - `2021-04-14`	a year	crt.sh
*.s-onetag.com Amazon	`2020-03-03` - `2021-04-03`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
*.chartbeat.net Thawte RSA CA 2018	`2019-12-16` - `2020-12-30`	a year	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-07-15` - `2020-10-07`	3 months	crt.sh
*.connatix.com Go Daddy Secure Certificate Authority - G2	`2019-09-05` - `2020-10-19`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
*.moatads.com DigiCert SHA2 Secure Server CA	`2019-03-12` - `2021-06-10`	2 years	crt.sh
static.adsafeprotected.com Amazon	`2019-11-01` - `2020-12-01`	a year	crt.sh

This page contains 12 frames:

Primary Page: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Frame ID: D53A297C90FC4AAC1B64792996DD4C63
Requests: 122 HTTP requests in this frame

Frame: https://www.dianomi.com/smartads.epl?id=4728&num_ads=5&shuffle=0&cf=545.4.Reuters%20Feed&url=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Frame ID: 450596F0249D6B23BA6776123288C690
Requests: 1 HTTP requests in this frame

Frame: https://www.dianomi.com/recirculation.epl?id=98&cf=545.4.Reuters%20Feed
Frame ID: 5FBCBBCBE466D82B124640A8894B1AC5
Requests: 1 HTTP requests in this frame

Frame: https://www.dianomi.com/recirculation.epl?id=99&start=6&cf=545.4.Reuters%20Feed
Frame ID: 16D29D771878882AD454B12ADF84AA4A
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8CUF1VN4G&prvid=3%2C23%2C28%2C29%2C33%2C38%2C41%2C51%2C54%2C56%2C59%2C69%2C72%2C74%2C76%2C77%2C80%2C82%2C84%2C97%2C106%2C108%2C109%2C113%2C117%2C118%2C122%2C126%2C138%2C139%2C141%2C145%2C147%2C159%2C172%2C173%2C174%2C175%2C178%2C182%2C184%2C188%2C193%2C201%2C203%2C208%2C214%2C222%2C225%2C226%2C3004%2C3007%2C3008%2C3010%2C3012%2C3014%2C3015%2C3017&rtime=480&https=1&gdpr=1&gdprconsent=0&usp_status=0&usp_consent=1
Frame ID: 65C938E47EF7A542B1D156F0ED226257
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012007302351000/amp4ads-v0.js
Frame ID: D90288730A35A9FA15207B4A4527CBD9
Requests: 14 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012007302351000/amp4ads-v0.js
Frame ID: A2808B39140B49C83F9447B2470A7771
Requests: 14 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvzfMNk9tFqga30Wszi0khNscXS6Zh_E1uWKZUhLWnCDc6kcUMppDBrjxSBj-sJmvrIkdPt0R0gXLmMZMEiUWkAP0a2ZrA4oKD4iKnUN-7AvlnMmuVFsiN-3jhcgy-YaJEqCWmbTNQ_7KClCJoyDIaGJBh0a9wiXpNfUqvAYlLjVbXr3jAPc4kyZPTq1zA4e9yBVJcykMxfwpFZYI4IWuLHUYAaowKIZH8AWTK5GeHZl-lvJwemv_HTU_QEwri8tDVgrVtwmgRSaC-8cEAjloVkod3bfNDwspaLQBl1XDo&sai=AMfl-YTx54BlouE9yXlcaB-VGejM9GjgE5rmTezY1YoL1IxiozGzB0NugzBTZ3XPDxpaoT2-hrQJ-XxQtMsElU75t1Engc4oWZNEZZvl2VfZLJyg0EmC45MozWK5YTfqHTE&sig=Cg0ArKJSzH95cg_m7vslEAE&urlfix=1&adurl=
Frame ID: 05869E5D418A55A5B01FC22089262063
Requests: 9 HTTP requests in this frame

Frame: https://cds.connatix.com/p/44384/connatix.player.dc.js
Frame ID: 5557CD7862E4855172CAE6CB09E550CF
Requests: 7 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=10764&campId=1100x420&pubId=20159232&chanId=247866432&placementId=4806613891&pubCreative=138288736159&pubOrder=453477432&cb=1762126263&custom=connatix&custom2=20000&custom3=0&adsafe_par&impId=
Frame ID: 4D4AC0844D3117EBA7711A485ACC8F15
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: 566E81E377BC7C98234CE183E4A21B66
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.4.114.js
Frame ID: 65578635FE05B017FA451583E74A2128
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

164
Requests

100 %
HTTPS

47 %
IPv6

37
Domains

65
Subdomains

54
IPs

8
Countries

3146 kB
Transfer

8783 kB
Size

16
Cookies

25 Outgoing links

These are links going to different origins than the main page.

URL: https://www.refinitiv.com/en
Title: Financial

Search URL Search Domain Scan URL

URL: https://www.thomsonreuters.com/en/products-services/government-solutions.html
Title: Government Solutions

Search URL Search Domain Scan URL

URL: https://www.thomsonreuters.com/en/products-services/legal.html
Title: Legal

Search URL Search Domain Scan URL

URL: https://www.reutersagency.com/?utm_source=website&utm_medium=reutersdotcom&utm_campaign=site-referral&utm_content=united_states&utm_term=0
Title: Reuters News Agency

Search URL Search Domain Scan URL

URL: https://risk.thomsonreuters.com/en.html
Title: Risk Management Solutions

Search URL Search Domain Scan URL

URL: https://www.thomsonreuters.com/en/products-services/tax-accounting.html
Title: Tax & Accounting

Search URL Search Domain Scan URL

URL: https://blogs.thomsonreuters.com/answerson/
Title: Blog: Answers On

Search URL Search Domain Scan URL

URL: https://innovation.thomsonreuters.com/en.html
Title: Innovation @ Thomson Reuters

Search URL Search Domain Scan URL

URL: https://www.thomsonreuters.com/en/global-gateway.html
Title: Directory of sites

Search URL Search Domain Scan URL

URL: https://www.thomsonreuters.com/en/login.html
Title: Login

Search URL Search Domain Scan URL

URL: https://reuters.zendesk.com/hc/en-us/articles/216467423-Contact-Reuters
Title: Contact

Search URL Search Domain Scan URL

URL: https://reuters.zendesk.com/hc/en-us
Title: Support

Search URL Search Domain Scan URL

URL: https://www.twitter.com/share?url=https%3A%2F%2Freut.rs%2F3jXvpRY&text=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Freut.rs%2F3jXvpRY&t=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals

Search URL Search Domain Scan URL

URL: http://thomsonreuters.com/en/about-us/trust-principles.html
Title: The Thomson Reuters Trust Principles.

Search URL Search Domain Scan URL

URL: https://newslink.reuters.com/join/subscribe
Title: Newsletters

Search URL Search Domain Scan URL

URL: https://sales.reuters.com/en/
Title: Advertise with Us

Search URL Search Domain Scan URL

URL: https://info.evidon.com/pub_info/285
Title: Cookies

Search URL Search Domain Scan URL

URL: https://www.thomsonreuters.com/en/privacy-statement.html
Title: Privacy

Search URL Search Domain Scan URL

URL: https://twitter.com/reuters

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Reuters

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/ReutersVideo

Search URL Search Domain Scan URL

URL: https://instagram.com/reuters/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/10256858/

Search URL Search Domain Scan URL

URL: https://www.thomsonreuters.com/en/policies/copyright.html
Title: © 2020 Reuters. All Rights Reserved.

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 67

https://sb.scorecardresearch.com/b?c1=2&c2=6035630&ns__t=1597253476860&ns_c=UTF-8&cv=3.5&c8=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals%20-%20Reuters&c7=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=6035630&ns__t=1597253476860&ns_c=UTF-8&cv=3.5&c8=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals%20-%20Reuters&c7=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&c9=&cs_ak_ss=1

Request Chain 82

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j83&tid=UA-24152976-22&cid=1909816365.1597253476&jid=39896364&gjid=207877150&_gid=346266412.1597253476&_u=aGDAiEAjR~&z=403939372 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=1909816365.1597253476&jid=39896364&_v=j83&z=403939372 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=1909816365.1597253476&jid=39896364&_v=j83&z=403939372&slf_rd=1&random=1460258331

Request Chain 116

https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046029;dc_trk_aid=461813821;dc_trk_cid=106332843;ord=2562882285;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046029;dc_pre=CKzutPGYlusCFdkK4AodhjsP5A;dc_trk_aid=461813821;dc_trk_cid=106332843;ord=2562882285;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=

Request Chain 126

https://cd.connatix.com/connatix.player.js HTTP 302
https://cds.connatix.com/p/44384/connatix.player.dc.js

Request Chain 131

https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046119;dc_trk_aid=461813884;dc_trk_cid=106332843;ord=520064935;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046119;dc_pre=CIr2tfGYlusCFdXJuwgdz6ML8g;dc_trk_aid=461813884;dc_trk_cid=106332843;ord=520064935;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=

Request Chain 138

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 141

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

164 HTTP transactions
10 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W Show response
www.reuters.com/article/us-cyber-cwt-ransom/ 228 KB
58 KB 100ms
49ms Document
text/html 13.226.155.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-95.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 6d2fabee27b52615cbaf082c6978c5011db4561b641e93c7211656938bb37eb2

Request headers

:method: GET
:authority: www.reuters.com
:scheme: https
:path: /article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
content-type: text/html;charset=UTF-8
access-control-allow-headers: Access-Control-Allow-Origin,charset
access-control-allow-origin: http://admin.reuters.com
browser-expires: Wed, 12 Aug 2020 17:30:18 GMT
channel-name: RCOMUS_Cyberrisk
content-encoding: gzip
date: Wed, 12 Aug 2020 17:30:19 GMT
expires: Wed, 12 Aug 2020 17:45:18 GMT
last-updateda: Fri, 31 Jul 2020 15:03:18 GMT
server: nginx
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: V4mk2l6grQaoXUq6VU60w2DPqA1W6Cv4x2eK1hhTstmkV7PvIM35hQ==
age: 56

GET
H2 200 article.bundle.css
static.reuters.com/resources_v2/react/cookie-reset-b74/ 149 KB
16 KB 80ms
29ms Stylesheet
text/css 13.226.155.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/article.bundle.css
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.12 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-12.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 6e198633e8651d2d219b18b644b77c8fac327d010d3d792be5d741f5bed10ff7

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:11:06 GMT
content-encoding: gzip
age: 1210
x-cache: Hit from cloudfront
status: 200
content-length: 16066
last-modified: Thu, 06 Aug 2020 21:01:29 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront)
cache-control: max-age=7200
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
x-amz-cf-id: mJyG5R0MWq9MgnM6d2Zl8cT1WYIj6a8QBptDcJ57AWzWtBqmcBNkFA==
expires: Wed, 12 Aug 2020 19:11:05 GMT

GET
H2 200 common.bundle.css
static.reuters.com/resources_v2/react/cookie-reset-b74/ 480 KB
279 KB 80ms
30ms Stylesheet
text/css 13.226.155.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.css
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.12 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-12.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 631b052c0fac425fdea5a7a644d5e3554283675424c4c95003960e8fa96f6060

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 16:09:06 GMT
content-encoding: gzip
last-modified: Thu, 06 Aug 2020 21:01:34 GMT
server: nginx
age: 4946
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
status: 200
cache-control: max-age=7200
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
x-amz-cf-id: xmcqbrI2VcxWiwIj1-O4w03TCUqMqK2iMWGtZUPxCjLqFL1WNhfqTw==
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront)
expires: Wed, 12 Aug 2020 18:08:49 GMT

GET
H2 200 jquery-3.4.1.min.js Show response
code.jquery.com/ 86 KB
30 KB 30ms
11ms Script
application/javascript 2001:4de0:ac19::1:b:2b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.4.1.min.js
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Origin: https://www.reuters.com

Response headers

date: Wed, 12 Aug 2020 17:31:15 GMT
content-encoding: gzip
last-modified: Wed, 01 May 2019 21:14:27 GMT
server: nginx
status: 200
etag: W/"5cca0c33-15851"
vary: Accept-Encoding
x-hw: 1597253475.dop160.fr8.t,1597253475.cds211.fr8.hc,1597253475.cds236.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30638

GET
H2 200 chartbeat_mab.js Show response
static.chartbeat.com/js/ 19 KB
8 KB 34ms
11ms Script
application/x-javascript 2600:9000:2182:ea00:18:1fcd:34e:d2a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat_mab.js
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2182:ea00:18:1fcd:34e:d2a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: c1acfa727754dab58bedc79995a642e235c6fde6449824c4fba4318fc060c91c

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:02:33 GMT
content-encoding: gzip
last-modified: Wed, 14 Aug 2019 01:44:12 GMT
server: nginx
age: 1722
etag: W/"5d53676c-4a99"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=7200
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: W5j4CH2xP8ogFtZRcjWqjIebpZamfOWOC-RPFDIB6EuGCLimxb4dsg==
via: 1.1 f6bd96409cae11d77ed75457d756ef80.cloudfront.net (CloudFront)
expires: Wed, 12 Aug 2020 19:02:33 GMT

GET
H2 200 embedder.bundle.js Show response
queso-cdn.prod.reuters.tv/new/assets/ 50 KB
13 KB 43ms
15ms Script
application/javascript 2600:9000:2182:ac00:1e:ef1b:aa40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://queso-cdn.prod.reuters.tv/new/assets/embedder.bundle.js
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2182:ac00:1e:ef1b:aa40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: b530d2f33467c65e254999ed904332bc40a5aa25c750229790295f6742938b6f

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:30:30 GMT
content-encoding: gzip
x-origin: i-0a9bb8cea211e1dd9.queso.prod.us.reuters.tv
age: 45
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Tue, 10 Dec 2019 21:26:03 GMT
server: nginx/1.14.0 (Ubuntu)
etag: W/"5df00d6b-c6f0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
via: 1.1 8ad073ef904d92431b3428f3430707af.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-C1
access-control-allow-headers: connection, range, accept-encoding, user-agent, referer, content-type
x-amz-cf-id: jlPH1v2-s2RT669YPp0AeC-sKovuCqd8i7MFx2HP625JB_hH9nvihA==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 314 KB
92 KB 29ms
14ms Script
application/javascript 2a00:1450:4001:821::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-W9SLGS

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

05570487bb3f6249f82ffaaf817889dc909225f80ae76d6f0e6c864465b8304f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:15 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 93256
x-xss-protection: 0
last-modified: Wed, 12 Aug 2020 16:09:45 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 12 Aug 2020 17:31:15 GMT

GET
H2 200 3aae9fd5da3557fba61d6444cb943643.png
static.reuters.com/resources_v2/react/cookie-reset-b74/ 1 KB
2 KB 74ms
33ms Image
image/png 13.226.155.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/3aae9fd5da3557fba61d6444cb943643.png
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.12 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-12.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 6346ee09058d555984eb04aac881775c926b5d9d4f73ca91493f7cb708ed90df

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 21:09:22 GMT
content-encoding: gzip
age: 73341
x-cache: Hit from cloudfront
status: 200
content-length: 1539
last-modified: Thu, 06 Aug 2020 21:01:24 GMT
server: nginx
vary: Accept-Encoding
content-type: image/png
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
x-amz-cf-id: fGbCPhb2YnMsnZ9HR36DuYtybUlpbcEPtj3ZVZtKWqdmXzk8FCyakw==
expires: Wed, 12 Aug 2020 21:08:54 GMT

GET
H2 200 /
s3.reutersmedia.net/resources/r/ 687 B
1 KB 85ms
24ms Image
image/jpeg 13.226.155.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.reutersmedia.net/resources/r/?m=02&d=20200731&t=2&i=1527877045&r=LYNXNPEG6U1D5&w=20
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.87 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-87.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: b5771462426214dd38f38352be4e5018e2d479df771d17d87723969efab65a49

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: PXHk6IkLtD2pt0PIqdPJZ3WIZqK3k.av
via: 1.1 92eff4f17f8a434975f912a39f575296.cloudfront.net (CloudFront)
x-amz-expiration: expiry-date="Mon, 31 Aug 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified: Fri, 31 Jul 2020 15:03:45 GMT
server: nginx
age: 34241
etag: "99ad09d534e9cd2cfa262e77d01586b5"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
date: Wed, 12 Aug 2020 08:00:34 GMT
x-amz-cf-pop: DUS51-C1
content-length: 687
x-amz-cf-id: 6twCMIXEKh4uvjimmB1AI5keoiW2pdFAHLkWikMYUQfZ9aHZg6vo9A==

GET
H2 200 /
s4.reutersmedia.net/resources/r/ 42 KB
42 KB 84ms
34ms Image
image/jpeg 13.226.155.40
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s4.reutersmedia.net/resources/r/?m=02&d=20200731&t=2&i=1527877047&r=LYNXNPEG6U1D9
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.40 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-40.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 09c52e5ea3fdb1ac6d74bf9c68a5411ae21355fb33afd30b8b37c434c3338e2a

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 17:43:13 GMT
via: 1.1 f6bd96409cae11d77ed75457d756ef80.cloudfront.net (CloudFront)
x-amz-expiration: expiry-date="Mon, 31 Aug 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified: Fri, 31 Jul 2020 15:03:45 GMT
server: nginx
age: 85682
etag: "d2c4ae5113a50834133f423b9565d7aa"
x-cache: Hit from cloudfront
x-amz-version-id: C0cntzZ8DoRgeITqsscUR_ZjzuW8xrP8
status: 200
x-amz-cf-pop: DUS51-C1
content-type: image/jpeg
content-length: 43013
x-amz-cf-id: 8miJjDPJEgcjAio_Wrp0Jlqim8-T9O8p9dUec4Qe79QU51RRdNG3ZQ==

GET
H2 200 common.bundle.js Show response
static.reuters.com/resources_v2/react/cookie-reset-b74/ 756 KB
182 KB 68ms
29ms Script
application/javascript 13.226.155.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.12 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-12.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 7a093c39bdbf0571cc22c594df90ec9f5b114be57bd9f565a192fa07545562f2

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:08:27 GMT
content-encoding: gzip
last-modified: Thu, 06 Aug 2020 21:01:35 GMT
server: nginx
age: 1383
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=7200
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
x-amz-cf-id: Pc5e57r98v7Yksc4wg7afNdgbYhhPrYeyxlaURqoH0i5RSrsFkfnHQ==
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront)
expires: Wed, 12 Aug 2020 19:08:12 GMT

GET
H2 200 article.bundle.js Show response
static.reuters.com/resources_v2/react/cookie-reset-b74/ 367 KB
53 KB 71ms
33ms Script
application/javascript 13.226.155.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/article.bundle.js
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.12 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-12.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 3234a9f00027b349b802fae240f760a270d6f4e7f39ecee827e77c3e282f7846

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:15:55 GMT
content-encoding: gzip
age: 6078
x-cache: Hit from cloudfront
status: 200
content-length: 53817
last-modified: Thu, 06 Aug 2020 21:01:30 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront)
cache-control: max-age=7200
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
x-amz-cf-id: PICAOY_lHAgkrjGXzTZRK3KWBggn2Oa6u_VNnWNGty347bxb-hh2kg==
expires: Wed, 12 Aug 2020 17:49:57 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 20ms
6ms Script
text/javascript 2a00:1450:4001:814::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W9SLGS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 04 Jun 2020 23:38:14 GMT
server: Golfe2
age: 3454
date: Wed, 12 Aug 2020 16:33:41 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18469
expires: Wed, 12 Aug 2020 18:33:41 GMT

GET
H2 200 js Show response
www.google-analytics.com/gtm/ 74 KB
29 KB 27ms
26ms Script
application/javascript 2a00:1450:4001:814::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-TBBXQQ&t=gtm2&cid=1909816365.1597253476

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5275e53dca9e7f8cb2741c3e11050df06b6d9167b088dbd8e0ce59052aa97556

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:15 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29782
x-xss-protection: 0
last-modified: Wed, 12 Aug 2020 16:09:45 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 12 Aug 2020 17:31:15 GMT

GET
H2 200 iframe_api Show response
www.youtube.com/ 859 B
1 KB 43ms
28ms Script
application/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

70cbe9dc327ec05a4738577250c3a149b4f760bb6417b2a2fd29f6e7068e779e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:15 GMT
x-content-type-options: nosniff
server: YouTube Frontend Proxy
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
status: 200
cache-control: no-cache
content-type: application/javascript
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Tue, 27 Apr 1971 19:44:06 GMT

GET
DATA 200
OK truncated
/ 49 KB
49 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f01d25f7a76e0682a7a43230c32bef653eaf28b8a6f7a683ebb88bf8c6aa4f50

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.reuters.com

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 49 KB
49 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7d62426c6b87d35cef5c2c873355aa44edffcf4a7f927f1c51b10694ea4f6ed

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.reuters.com

Response headers

Content-Type: application/font-woff

GET
DATA 200
OK truncated
/ 71 KB
71 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee0768f9d2def8b13df284410776f5d755109e77b5c0ca17d8895f65b343a0cd

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.reuters.com

Response headers

Content-Type: application/font-woff

GET
H2 200 evidon-sitenotice-tag.js Show response
c.evidon.com/sitenotice/ 56 KB
15 KB 82ms
20ms Script
application/x-javascript 2.20.168.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js
Requested by: Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.20.168.134 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-168-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 731ebb6e8eb86eb45b6e7269a9374d1ac90533bfca3a81774dfe51f84fee2f92

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:15 GMT
content-encoding: gzip
vary: Accept-Encoding
status: 200
content-length: 14733
last-modified: Wed, 05 Aug 2020 19:47:31 GMT
server: AkamaiNetStorage
etag: "9ed00dc4b4ef73cfa3427a0b9764a8d0:1596656851.752407"
access-control-max-age: 108000
access-control-allow-methods: GET,OPTIONS,POST
content-type: application/x-javascript
access-control-allow-origin
cache-control: max-age=86400, private;max-age=86400
accept-ranges: bytes
access-control-allow-headers: *
expires: Thu, 13 Aug 2020 17:31:15 GMT

GET
H2 200 country.js Show response
c.evidon.com/geo/ 294 B
477 B 93ms
32ms Script
application/x-javascript 2.20.168.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.evidon.com/geo/country.js
Requested by: Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.20.168.134 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-168-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 39699ef2ff7f4cfc54b00ba69dbc53473370396c94a44cb770e2e6fb09310168

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:15 GMT
content-encoding: gzip
last-modified: Sat, 14 Mar 2020 23:38:16 GMT
server: AkamaiNetStorage
status: 200
etag: "5dbb6cae5cbc58bc9b615e88f73e0b65:1584229096.969986"
vary: Accept-Encoding
access-control-allow-methods: GET,OPTIONS,POST
content-type: application/x-javascript
access-control-allow-origin
access-control-max-age: 108000
accept-ranges: bytes
access-control-allow-headers: *
content-length: 200

GET
H2 200 snthemes.js Show response
c.evidon.com/sitenotice/1237/ 48 KB
4 KB 94ms
32ms Script
application/x-javascript 2.20.168.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.evidon.com/sitenotice/1237/snthemes.js
Requested by: Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.20.168.134 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-168-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 78d7768fb1213eced669894455aac7c1bfb17452b25ef69859ab7617cb85856f

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:15 GMT
content-encoding: gzip
vary: Accept-Encoding
status: 200
content-length: 3701
last-modified: Fri, 26 Jun 2020 14:04:50 GMT
server: AkamaiNetStorage
etag: "250e5fd831f93b742b230a49f56ee029:1593180290.533778"
access-control-max-age: 108000
access-control-allow-methods: GET,OPTIONS,POST
content-type: application/x-javascript
access-control-allow-origin
cache-control: max-age=86400, private;max-age=86400
accept-ranges: bytes
access-control-allow-headers: *
expires: Thu, 13 Aug 2020 17:31:15 GMT

GET
H2 200 settings.js Show response
c.evidon.com/sitenotice/1237/reuters/ 19 KB
3 KB 95ms
34ms Script
application/x-javascript 2.20.168.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.evidon.com/sitenotice/1237/reuters/settings.js
Requested by: Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.20.168.134 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-168-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7962dce1427363ac8964c27e8a221d2b6f320fa55f7e32df3508b288d99ff915

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:15 GMT
content-encoding: gzip
vary: Accept-Encoding
status: 200
content-length: 2681
last-modified: Wed, 01 Jul 2020 02:14:34 GMT
server: AkamaiNetStorage
etag: "ab26685e301ed5649625ade2ef42d4cf:1593569674.617377"
access-control-max-age: 108000
access-control-allow-methods: GET,OPTIONS,POST
content-type: application/x-javascript
access-control-allow-origin
cache-control: max-age=86400, private;max-age=86400
accept-ranges: bytes
access-control-allow-headers: *
expires: Thu, 13 Aug 2020 17:31:15 GMT

GET
H/1.1 200
OK service Show response
usasync01.admantx.com/admantx/ 467 B
663 B 372ms
94ms XHR
text/plain 2406:da00:ff00::36eb:b8ea
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usasync01.admantx.com/admantx/service?request=%7B%22key%22%3A%22234330834c41105ad5ed794fa036e085b40225c44f9228bb9e2692f427917605%22%2C%20%22decorator%22%3A%22template.reuters_ss%22%2C%20%22filter%22%3A%5B%22default%22%5D%2C%20%22method%22%3A%22descriptor%22%2C%20%22mode%22%3A%22async%22%2C%20%22type%22%3A%22URL%22%2C%20%22body%22%3A%22https%253A%252F%252Fwww.reuters.com%252Farticle%252Fus-cyber-cwt-ransom%252Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W%22%7D
Requested by: Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da00:ff00::36eb:b8ea Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: bb56e9cb6a9934d4d3c871e6aa711d2168e0c74c02cc3388539fe50e57091dca

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 12 Aug 2020 17:31:16 GMT
Server: nginx/1.16.1
Connection: keep-alive
Content-Length: 467
Content-Type: text/plain; charset=UTF-8

GET
H/1.1 200
OK iasPET.1.js Show response
cdn.adsafeprotected.com/ 22 KB
7 KB 108ms
22ms Script
application/javascript 13.226.155.108
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adsafeprotected.com/iasPET.1.js
Requested by: Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.108 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-108.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 54138d578ed166d5381db70b3dd14a16830233553b6e4213402bae2fdb0564b4

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 01:14:43 GMT
Content-Encoding: gzip
Connection: keep-alive
Last-Modified: Wed, 08 Jul 2020 20:34:30 GMT
Server: AmazonS3
Age: 58654
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 0406d08716a9781a5c19ff86db2debd3.cloudfront.net (CloudFront)
Cache-Control: max-age=604800
Transfer-Encoding: chunked
X-Amz-Cf-Pop: DUS51-C1
X-Amz-Cf-Id: iF5yfQAa_iAN90NROPGQFtMUIwXJ146c3K-kOA3ZpIRjpq9U2nfFgA==

GET
H2 200 analytics.min.js Show response
cdn.segment.com/analytics.js/v1/IEWBqQ8VWHijTQxb7lEBGFGS9uIJzigZ/ 456 KB
96 KB 101ms
34ms Script
text/javascript 13.226.132.149
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.segment.com/analytics.js/v1/IEWBqQ8VWHijTQxb7lEBGFGS9uIJzigZ/analytics.min.js
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.132.149 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-132-149.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6d2fe32d253b1c23c584887a2d05bba8d56ad3b233081d190be436c70209ead2

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: YOeClGqZQucGhTexskvvImiIs1YTWvjr
content-encoding: gzip
etag: "b571ddcfce959fdfb468fd0182ffb999"
age: 231
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-length: 98102
access-control-allow-origin: *
last-modified: Fri, 31 Jul 2020 18:21:37 GMT
server: AmazonS3
date: Wed, 12 Aug 2020 17:27:26 GMT
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD
content-type: text/javascript; charset=utf-8
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront)
cache-control: public, max-age=300
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
x-amz-cf-id: EGD09pE4VFiU0zLzBArW2rgUbK4-FyIkHOjISOYXcHmd6z-APazdRA==

GET
H2 200 contextfeed.js Show response
www.dianomi.com/js/ 13 KB
4 KB 58ms
26ms Script
application/javascript 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/js/contextfeed.js?

Requested by

Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/article.bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4dfb7c925e9a341c587ecc6af346f2cf875c63da4609858353eed31324e7ac48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 748
cf-polished: origSize=16301
status: 200
x-xss-protection: 1; mode=block
last-modified: Fri, 12 Jun 2020 10:37:13 GMT
server: cloudflare
etag: W/"3fad-5a7e0a8fd0bd3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
expires: Wed, 12 Aug 2020 21:31:16 GMT
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-request-id: 048552f6db00000bed6d337200000001
cf-ray: 5c1bedd15d4e0bed-AMS
cf-bgj: minify

GET
H2 200 breakingNews Show response
www.reuters.com/assets/ 1 B
398 B 25ms
24ms Fetch
application/json 13.226.155.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reuters.com/assets/breakingNews?view=json
Requested by: Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-95.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:30:19 GMT
browser-expires: Wed, 12 Aug 2020 17:30:19 GMT
server: nginx
age: 57
status: 200
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: http://admin.reuters.com
x-amz-cf-pop: DUS51-C1
access-control-allow-headers: Access-Control-Allow-Origin,charset
content-length: 1
via: 1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
x-amz-cf-id: I5VvQil1PX4fVdTDmtYJzX63BYHJjak4nSf7FxWz0iQZUBVPgliDzg==
expires: Wed, 12 Aug 2020 17:35:19 GMT

GET
H2 200 /
s3.reutersmedia.net/resources/r/ 43 KB
43 KB 28ms
28ms Image
image/jpeg 13.226.155.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.reutersmedia.net/resources/r/?m=02&d=20200731&t=2&i=1527877045&r=LYNXNPEG6U1D5&w=1280
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.87 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-87.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 0541539bf2c978c0ddec342e71cdeeb6c741a149356dcf13a01ae4217d28e46b

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: oObRweTrk8_OxeCSFKAdYD7GOFpoZAsA
via: 1.1 92eff4f17f8a434975f912a39f575296.cloudfront.net (CloudFront)
x-amz-expiration: expiry-date="Mon, 31 Aug 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified: Fri, 31 Jul 2020 15:03:52 GMT
server: nginx
age: 25716
etag: "9820f131d19eb65a082f3c146a2cb7b4"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
date: Wed, 12 Aug 2020 10:22:40 GMT
x-amz-cf-pop: DUS51-C1
content-length: 43556
x-amz-cf-id: Yso4ATF07JM3MVqHrVxuP0A1lV83gt9TN4O7DhD2R7eIJvIWgJU4dg==

GET
H2 200 / Show response
mab.chartbeat.com/mab_strategy/headline_testing/get_strategy/ 195 B
482 B 40ms
11ms XHR
application/json 2a04:4e42:1b::714
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://mab.chartbeat.com/mab_strategy/headline_testing/get_strategy/?host=reuters.com&domain=reuters.com&path=%2Farticle%2Fus-cyber-cwt-ransom-idUSKCN24W25W
Requested by: Host: static.chartbeat.com
URL: https://static.chartbeat.com/js/chartbeat_mab.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:1b::714 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: cfd0da29a6d34ea44fb0035a3a1b409a4a66c091fb0f143ea2f73a643c3f8cef

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: gzip
age: 2278
x-cache: HIT
status: 200
x-cache-hits: 1
content-length: 161
x-served-by: cache-hhn4082-HHN
access-control-allow-origin: *
x-timer: S1597253476.134135,VS0,VE1
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
content-type: application/json
via: 1.1 varnish (Varnish/6.0), 1.1 varnish
cache-control: no-store, no-cache, must-revalidate, max-age=0, s-maxage=0
accept-ranges: bytes
expires: Mon, 10 Aug 2020 16:53:17 GMT

GET
H2 200 reuters.js Show response
tru.am/scripts/custom/ 1 KB
1 KB 37ms
20ms Script
application/javascript 2606:4700:20::ac43:4af5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tru.am/scripts/custom/reuters.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W9SLGS
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4af5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f23d93c9b8e3ca26f6fcc6be6a8d087e43a3f5795daa3c61017071642f66f3c

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: br
cf-cache-status: HIT
age: 2213827
x-guploader-uploadid: AAANsUlK-rhqWIaSronpM69LDK3tSKdIlWTr545LHnYUXX1YBJwnHqKhyvJA1BK1p6ChhuoYauFsuyxDZP87axzJFw
x-goog-storage-class: REGIONAL
status: 200
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 048552f71d00000601940e3200000001
last-modified: Fri, 19 Apr 2019 06:14:57 GMT
server: cloudflare
etag: W/"40b7d4de06dae04ec0d6537ef2f54db8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=e3JHUg==, md5=QLfU3gba4E7A1lN+8vVNuA==
x-goog-generation: 1555654497328861
content-type: application/javascript
cache-control: public, max-age=2678400
x-goog-stored-content-length: 1056
cf-ray: 5c1bedd1ca800601-FRA
expires: Sat, 18 Jul 2020 03:34:09 GMT

GET
H2 200 load Show response
experience.tinypass.com/xbuilder/experience/ 4 KB
1 KB 38ms
22ms Script
application/javascript 2606:4700::6811:b8b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://experience.tinypass.com/xbuilder/experience/load?aid=TIDovF4cqC
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:b8b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd1dc64fac45e75fffefbd76f176c6ea118ab79b88b3efddc5642d4e7c76d4fe

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: br
cf-cache-status: HIT
age: 136
p3p: CP="NON DSP COR OUR IND"
status: 200
x-forwarded-https: on
cf-request-id: 048552f71e000005d0a7284200000001
x-request-id: Cckoyeqzwbj
wn: prod-exp-10-0-83-250
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: accept-encoding
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=1800
cf-ray: 5c1bedd1cbba05d0-FRA
expires: Wed, 12 Aug 2020 18:01:16 GMT

GET
H2 200 www-widgetapi.js Show response
s.ytimg.com/yts/jsbin/www-widgetapi-vfl1JmQoX/ 90 KB
33 KB 20ms
5ms Script
text/javascript 2a00:1450:4001:818::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s.ytimg.com/yts/jsbin/www-widgetapi-vfl1JmQoX/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce6828b72f5cb1fdabed21ccca94c6250685131bfc448a9daf163f2b311a531d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 10 Aug 2020 19:50:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 164444
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33254
x-xss-protection: 0
last-modified: Mon, 10 Aug 2020 18:37:05 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=691200
accept-ranges: bytes
timing-allow-origin: https://www.youtube.com
expires: Tue, 18 Aug 2020 19:50:32 GMT

GET
H2 200 context.pl Show response
www.dianomi.com/cgi-bin/ 2 KB
529 B 60ms
60ms XHR
application/json 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/cgi-bin/context.pl?id=4&h=www.reuters.com

Requested by

Host: www.dianomi.com
URL: https://www.dianomi.com/js/contextfeed.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

38f82a586c4984fdc89697da37dac16d17ed9c1d619510ed32991778b3e21b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/json; charset=ISO-8859-1
access-control-allow-origin: https://www.reuters.com
x-xss-protection: 1; mode=block
cache-control: public, max-age=1200
access-control-allow-credentials: true
cf-ray: 5c1bedd2785f0bed-AMS
cf-request-id: 048552f78d00000bed6d342200000001
expires: Wed, 12 Aug 2020 17:32:16 GMT

GET
H2 200 js Show response
www.google-analytics.com/gtm/ 74 KB
29 KB 30ms
29ms Script
application/javascript 2a00:1450:4001:814::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-KBK7743&cid=1909816365.1597253476

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e58b5f1ec0b366d5af022fc6580f518062cd5de023870bb4881cc7936cb4da06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29818
x-xss-protection: 0
last-modified: Wed, 12 Aug 2020 16:09:45 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 12 Aug 2020 17:31:16 GMT

GET
H2 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
995 B 6ms
6ms Script
text/javascript 2a00:1450:4001:814::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:01:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 1800
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Wed, 12 Aug 2020 18:01:16 GMT

GET
H2 200 en.js Show response
c.evidon.com/sitenotice/1237/translations/ 65 KB
6 KB 14ms
13ms Script
application/x-javascript 2.20.168.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.evidon.com/sitenotice/1237/translations/en.js
Requested by: Host: c.evidon.com
URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.20.168.134 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-168-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 0301abe27c75fe3b60eff31ce1d31238c9b84d4f36c037bacf0a8656b6a6fb45

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: gzip
vary: Accept-Encoding
status: 200
content-length: 5633
last-modified: Wed, 01 Jul 2020 01:41:52 GMT
server: AkamaiNetStorage
etag: "e21cd11f7f077dfa60a4974f4e56a950:1593567712.14839"
access-control-max-age: 108000
access-control-allow-methods: GET,OPTIONS,POST
content-type: application/x-javascript
access-control-allow-origin
cache-control: max-age=86400, private;max-age=86400
accept-ranges: bytes
access-control-allow-headers: *
expires: Thu, 13 Aug 2020 17:31:16 GMT

GET
H2 200 dianomi-context.css
www.dianomi.com/partner/dianomi/css/ 169 B
272 B 27ms
26ms Stylesheet
text/css 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/partner/dianomi/css/dianomi-context.css?v=1.1

Requested by

Host: www.dianomi.com
URL: https://www.dianomi.com/js/contextfeed.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

99781410070a5dd4d753fdb8a46f4272082b5be64541dcfcb1b2d3c4aea09c6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 3769
cf-polished: origSize=199
status: 200
x-xss-protection: 1; mode=block
last-modified: Mon, 21 Jan 2019 12:43:41 GMT
server: cloudflare
etag: W/"c7-57ff735e16ce7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
expires: Wed, 12 Aug 2020 21:31:16 GMT
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-request-id: 048552f81600000bed6d34c200000001
cf-ray: 5c1bedd35a870bed-AMS
cf-bgj: minify

GET
H2 200 smartads.epl
www.dianomi.com/ Frame 4505 0
0 96ms
96ms Document
text/html 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/smartads.epl?id=4728&num_ads=5&shuffle=0&cf=545.4.Reuters%20Feed&url=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Requested by

Host: www.dianomi.com
URL: https://www.dianomi.com/js/contextfeed.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.dianomi.com
:scheme: https
:path: /smartads.epl?id=4728&num_ads=5&shuffle=0&cf=545.4.Reuters%20Feed&url=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Response headers

status: 200
date: Wed, 12 Aug 2020 17:31:16 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d1e11d5e4ca00f3e96749b5db1e9f78401597253476; expires=Fri, 11-Sep-20 17:31:16 GMT; path=/; domain=.dianomi.com; HttpOnly; SameSite=Lax
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-origin: *
access-control-allow-credentials: true
expires: now
pragma: no-cache
cache-control: no-cache,no-store,private
link: </img/a/pss/2649/23.css>;rel=preload;as=style
cf-cache-status: DYNAMIC
cf-request-id: 048552f82100000bed6d34e200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5c1bedd36ab50bed-AMS
content-encoding: br
cf-h2-pushed: </img/a/pss/2649/23.css>

GET
H2 200 videofeed-combined.js Show response
www.dianomi.com/js/ 22 KB
5 KB 38ms
37ms Script
application/javascript 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/js/videofeed-combined.js?id=123

Requested by

Host: www.dianomi.com
URL: https://www.dianomi.com/js/contextfeed.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ed44c518b79ec0c24d13803371365e67d6ca02829631e0dad366850fd466044

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2344
cf-polished: origSize=32520
status: 200
x-xss-protection: 1; mode=block
last-modified: Wed, 12 Aug 2020 12:48:38 GMT
server: cloudflare
etag: W/"7f08-5acad9b4df871"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
expires: Wed, 12 Aug 2020 21:31:16 GMT
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-request-id: 048552f82100000bed6d34d200000001
cf-ray: 5c1bedd36ab40bed-AMS
cf-bgj: minify

GET
H2 200 recirculation.epl
www.dianomi.com/ Frame 5FBC 0
0 80ms
80ms Document
text/html 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/recirculation.epl?id=98&cf=545.4.Reuters%20Feed

Requested by

Host: www.dianomi.com
URL: https://www.dianomi.com/js/contextfeed.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.dianomi.com
:scheme: https
:path: /recirculation.epl?id=98&cf=545.4.Reuters%20Feed
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Response headers

status: 200
date: Wed, 12 Aug 2020 17:31:16 GMT
content-type: text/html; charset=utf-8
set-cookie: __cfduid=d1e11d5e4ca00f3e96749b5db1e9f78401597253476; expires=Fri, 11-Sep-20 17:31:16 GMT; path=/; domain=.dianomi.com; HttpOnly; SameSite=Lax
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-origin: *
access-control-allow-credentials: true
cf-cache-status: DYNAMIC
cf-request-id: 048552f82200000bed6d34f200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5c1bedd36abb0bed-AMS
content-encoding: br

GET
H2 200 recirculation.epl
www.dianomi.com/ Frame 16D2 0
0 83ms
83ms Document
text/html 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/recirculation.epl?id=99&start=6&cf=545.4.Reuters%20Feed

Requested by

Host: www.dianomi.com
URL: https://www.dianomi.com/js/contextfeed.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.dianomi.com
:scheme: https
:path: /recirculation.epl?id=99&start=6&cf=545.4.Reuters%20Feed
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Response headers

status: 200
date: Wed, 12 Aug 2020 17:31:16 GMT
content-type: text/html; charset=utf-8
set-cookie: __cfduid=d1e11d5e4ca00f3e96749b5db1e9f78401597253476; expires=Fri, 11-Sep-20 17:31:16 GMT; path=/; domain=.dianomi.com; HttpOnly; SameSite=Lax
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
access-control-allow-origin: *
access-control-allow-credentials: true
cf-cache-status: DYNAMIC
cf-request-id: 048552f82700000bed6d351200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5c1bedd37ad30bed-AMS
content-encoding: br

GET
H2 200 lazyload.iife.min.js Show response
cdnjs.cloudflare.com/ajax/libs/vanilla-lazyload/10.20.1/ 5 KB
2 KB 27ms
11ms Script
application/javascript 2606:4700::6811:4f6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/vanilla-lazyload/10.20.1/lazyload.iife.min.js

Requested by

Host: www.dianomi.com
URL: https://www.dianomi.com/js/contextfeed.js?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4f6b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c514d4fb8244af230a89d2203522c6a67a55a3f161cfd4fca9f53301c0588ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 11215407
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 048552f8330000c26d5908d200000001
served-in-seconds: 0.003
timing-allow-origin: *
last-modified: Sun, 17 Feb 2019 22:45:51 GMT
server: cloudflare
etag: W/"5c69e41f-14cf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 5c1bedd38bc9c26d-FRA
expires: Mon, 02 Aug 2021 17:31:16 GMT

GET
H2 200 dianomi-max-200x38.png
www.dianomi.com/img/ 1 KB
1 KB 29ms
27ms Image
image/webp 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dianomi.com/img/dianomi-max-200x38.png

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

70503c92bcbb8105d95ec4de2012f23098c3383586e95323e4b3384b56af4beb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 179402
cf-polished: origFmt=png, origSize=3940
status: 200
content-disposition: inline; filename="dianomi-max-200x38.webp"
content-length: 1164
x-xss-protection: 1; mode=block
last-modified: Wed, 29 Jul 2020 16:53:11 GMT
server: cloudflare
etag: "f64-5ab97641e5c82"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
expires: Sat, 12 Sep 2020 03:31:16 GMT
cache-control: public, max-age=2628000
access-control-allow-credentials: true
cf-request-id: 048552f82b00000bed6d352200000001
accept-ranges: bytes
cf-ray: 5c1bedd37ae00bed-AMS
cf-bgj: imgq:85,h2pri

GET
H2 200 pixeltrack.pl
www.dianomi.com/cgi-bin/ 77 B
224 B 55ms
54ms Image
image/gif 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.dianomi.com/cgi-bin/pixeltrack.pl?cf=545.4.Reuters%20Feed

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d4fa79afcf5a5cc5a0f12dedaf825f11530e6397d723fe7044cd37ba3c248e57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
status: 200
content-length: 77
cf-request-id: 048552f82b00000bed6d353200000001
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: image/gif; charset=ISO-8859-1
access-control-allow-origin: *
x-xss-protection: 1; mode=block
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 5c1bedd37ae30bed-AMS
expires: Tue, 11 Aug 2020 17:31:16 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 134 KB
34 KB 18ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/IEWBqQ8VWHijTQxb7lEBGFGS9uIJzigZ/analytics.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

893df2b9ceb653f94333139d561d363bf4c365e651a0a3ade839d96200942e37

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 34269
x-xss-protection: 0
pragma: public
x-fb-debug: TpyZuYlzCDj0GVx8a9l1oZIn1So1qKAwtzBnIY+n4bO4Cb7ixcXo/6zOwH6B3FMNBAhN8p7EgW7mligNglF18w==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Wed, 12 Aug 2020 17:31:16 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 ta-pagesocial-sdk.js Show response
tru.am/scripts/ 35 KB
12 KB 19ms
18ms Script
application/javascript 2606:4700:20::ac43:4af5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Requested by: Host: tru.am
URL: https://tru.am/scripts/custom/reuters.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4af5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: br
cf-cache-status: HIT
age: 2213841
x-guploader-uploadid: AAANsUlz9Yip85RfgS4jGavu6PDS8YEyP7WdDck7YcMKysD_x9qSJ9Qiyi4E5v-ygmEAlwDD_aGRLlN8Bnsmjdj3lw
x-goog-storage-class: REGIONAL
status: 200
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 048552f8300000060194105200000001
last-modified: Fri, 19 Apr 2019 06:14:55 GMT
server: cloudflare
etag: W/"942d5ae1e512ccdf18813550428dd002"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=O7AZFg==, md5=lC1a4eUSzN8YgTVQQo3QAg==
x-goog-generation: 1555654495662585
content-type: application/javascript
cache-control: public, max-age=2678400
x-goog-stored-content-length: 35540
cf-ray: 5c1bedd388770601-FRA
expires: Sat, 18 Jul 2020 03:33:55 GMT

GET
H2 200 ads.js Show response
www.reuters.com/ 112 B
522 B 24ms
23ms Script
text/javascript 13.226.155.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reuters.com/ads.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W9SLGS
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-95.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 7464555aae6d8d87b77f7170fba1698ff64f7454ded58627ca1819246e9a9969

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:30:20 GMT
content-encoding: gzip
server: nginx
age: 268
status: 200
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: http://admin.reuters.com
x-amz-cf-pop: DUS51-C1
access-control-allow-headers: Access-Control-Allow-Origin,charset
content-length: 116
via: 1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
x-amz-cf-id: dNH_EW3WEwa20MfGO1Buz5gYl5xxGedTJTbWV4sPlOxE-HAKlHfyug==
expires: Wed, 12 Aug 2020 17:26:47 GMT

GET
H2 200 tinypass.min.js Show response
cdn.tinypass.com/api/ 385 KB
122 KB 25ms
23ms Script
application/javascript 2606:4700::6811:b8b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.tinypass.com/api/tinypass.min.js
Requested by: Host: experience.tinypass.com
URL: https://experience.tinypass.com/xbuilder/experience/load?aid=TIDovF4cqC
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:b8b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ad590c30e8e0ef2b2539b0f1a7e4e4da38a6a7b2a8b3f88048338c22da590253

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: br
cf-cache-status: HIT
age: 8
p3p: CP="NON DSP COR OUR IND"
status: 200
x-forwarded-https: on
cf-request-id: 048552f832000005d0a729f200000001
wn: prod-dash-10-0-83-213
last-modified: Tue, 11 Aug 2020 16:55:24 GMT
server: cloudflare
etag: W/"394506-1597164924000"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
server-time: 0.000
cache-control: public, max-age=300
cf-ray: 5c1bedd3893c05d0-FRA
expires: Wed, 12 Aug 2020 17:36:16 GMT

GET
DATA 200
OK truncated
/ 49 KB
49 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 45610b21279531a97f9566b0f0f8a1d287a45ae4bc6bc545971af5cd7e393cc6

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin: https://www.reuters.com

Response headers

Content-Type: application/font-woff

GET
H2 200 evidon-barrier.js Show response
c.evidon.com/sitenotice/ 14 KB
4 KB 14ms
13ms Script
application/x-javascript 2.20.168.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.evidon.com/sitenotice/evidon-barrier.js
Requested by: Host: c.evidon.com
URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.20.168.134 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-168-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 33a31901a144a24e7f7153b2ec965007bb58abea0129ec9e7691d468f959569b

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: gzip
vary: Accept-Encoding
status: 200
content-length: 4195
last-modified: Wed, 05 Aug 2020 19:47:32 GMT
server: AkamaiNetStorage
etag: "7f2ec5e4f730c536377c12dea517d463:1596656852.545031"
access-control-max-age: 108000
access-control-allow-methods: GET,OPTIONS,POST
content-type: application/x-javascript
access-control-allow-origin
cache-control: max-age=86400, private;max-age=86400
accept-ranges: bytes
access-control-allow-headers: *
expires: Thu, 13 Aug 2020 17:31:16 GMT

GET
H2 200 iabevidonmapping.js Show response
iabmap.evidon.com/ 8 KB
3 KB 78ms
15ms Script
application/javascript 2600:9000:2182:9800:10:27b4:f500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://iabmap.evidon.com/iabevidonmapping.js
Requested by: Host: c.evidon.com
URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2182:9800:10:27b4:f500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 21a22ffbb31ae72c9efc1970ad750dc83454831721ca163bc6cda04dae21a7d7

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 10:53:59 GMT
content-encoding: gzip
last-modified: Thu, 16 Jul 2020 19:37:07 GMT
server: AmazonS3
age: 23838
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: Ei6XdUsVb371sw4h3ijpctdY8Q0RBx6rSZ1shD-GPPzY0GB7jzt_XA==
via: 1.1 2395e6175733260a159a0b484ed8febd.cloudfront.net (CloudFront)

GET
H2 200 evidon-cmp.js Show response
c.evidon.com/sitenotice/ 22 KB
7 KB 17ms
13ms Script
application/x-javascript 2.20.168.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.evidon.com/sitenotice/evidon-cmp.js
Requested by: Host: c.evidon.com
URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.20.168.134 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-168-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 15b35c3833a358a2d4da3777fc699f98434d8ad633f05f18b0189ff9425d6ec6

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: gzip
vary: Accept-Encoding
status: 200
content-length: 6629
last-modified: Wed, 05 Aug 2020 19:47:32 GMT
server: AkamaiNetStorage
etag: "e61a04bf376822e01eb2bff13a2813cd:1596656852.758443"
access-control-max-age: 108000
access-control-allow-methods: GET,OPTIONS,POST
content-type: application/x-javascript
access-control-allow-origin
cache-control: max-age=86400, private;max-age=86400
accept-ranges: bytes
access-control-allow-headers: *
expires: Thu, 13 Aug 2020 17:31:16 GMT

GET
H2 204 2
l.betrad.com/site/v3/1237/5669/8/1/3/ 0
120 B 328ms
106ms Image
text/plain 3.222.135.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l.betrad.com/site/v3/1237/5669/8/1/3/2?consent=0
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.135.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-135-156.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: gzip
x-powered-by: Express
etag: W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary: Accept-Encoding

GET
H2 204 61500
l.betrad.com/site/v3/1237/5669/8/1/3/2/ 0
120 B 223ms
115ms Image
text/plain 3.222.135.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l.betrad.com/site/v3/1237/5669/8/1/3/2/61500?consent=0
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.135.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-135-156.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: gzip
x-powered-by: Express
etag: W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary: Accept-Encoding

GET
H2 200 smartads_video_json.pl Show response
www.dianomi.com/cgi-bin/ 3 B
307 B 69ms
69ms XHR
application/json 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/cgi-bin/smartads_video_json.pl?id=4729&cf=545.4.Reuters%20Feed

Requested by

Host: www.dianomi.com
URL: https://www.dianomi.com/js/videofeed-combined.js?id=123

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.reuters.com
x-xss-protection: 1; mode=block
cache-control: private, no-cache, no-store, must-revalidate, max-age=0, pre-check=0, post-check=0
access-control-allow-credentials: true
cf-ray: 5c1bedd53f620bed-AMS
cf-request-id: 048552f94500000bed6d383200000001

GET
DATA 200
OK truncated
/ 38 B
38 B Other
image/webp

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 52dc24c0429ea6ccc5b579a6da8bb79bf41e471fe5108a62009f3c2e195551c0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/webp

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 63ms
20ms Script
application/x-javascript 104.108.64.33
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.108.64.33 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-64-33.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 17:31:16 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 884
Expires: Thu, 13 Aug 2020 17:31:16 GMT

GET
H2 200 gwiq.js Show response
gwiqcdn.globalwebindex.net/gwiq/ 6 KB
6 KB 44ms
13ms Script
application/javascript 35.201.93.216
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://gwiqcdn.globalwebindex.net/gwiq/gwiq.js
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.93.216 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 216.93.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 6aa7c3edbc1ee1fe66d4db0fea18aa2d0bbe0dfae05d228c9ffeeaeacb6f1c53

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:25:48 GMT
age: 328
x-guploader-uploadid: AAANsUnDqEmjFyrXN-w4UG1wtTK7nWFDIk6rdfP-36e-QnmWYPDEkvswngkryeGOsx3Vx4qNzwooYsWVLNzjAZj3Fog
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
alt-svc: clear
content-length: 5766
last-modified: Wed, 15 Apr 2020 08:49:27 GMT
server: UploadServer
etag: "aba61abde9777087262fb27526ba1ef6"
x-goog-hash: crc32c=yYfjgA==, md5=q6Yavel3cIcmL7J1Jroe9g==
x-goog-generation: 1586940567400828
cache-control: public, max-age=3600
x-goog-stored-content-length: 5766
accept-ranges: bytes
content-type: application/javascript
expires: Wed, 12 Aug 2020 18:25:48 GMT

GET
H2 200 312961195854690 Show response
connect.facebook.net/signals/config/ 525 KB
132 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/312961195854690?v=2.9.23&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

24f519f7817feefd7089793570fae9a93825d0f9ec17900e3ac446088d59b0bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 135383
x-xss-protection: 0
pragma: public
x-fb-debug: PY+e046bECPJ7LGIz6XgSBbffDTNzD/CD/5Q578BPGkg3580O6MWMCsTXgNM65OjCAzgzIv+LLxS4MvQUr1Rog==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Wed, 12 Aug 2020 17:31:16 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 article-recirc Show response
sope.prod.reuters.tv/program/rcom/v1/ 13 KB
13 KB 103ms
103ms Fetch
application/json 2600:1f18:624f:b000:1a0c:44be:c431:52fe
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://sope.prod.reuters.tv/program/rcom/v1/article-recirc?edition=us&pageid=USKCN24W25W&modules=rightrail,ribbon,bottom
Requested by: Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:624f:b000:1a0c:44be:c431:52fe Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: a0d3888abf73b5e53c7204fa4243b586d4c21bdad65b4f64fce8e45d731b5e36

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
seq: 5e0e520d-5538-4149-8ae1-f23275027d77

Response headers

date: Wed, 12 Aug 2020 17:31:17 GMT
x-origin: i-0fc78495aa2e07445.sope.prod.us.reuters.tv
server: nginx/1.14.0 (Ubuntu)
x-amzn-trace-id: Root=1-5f342765-2675148d2ed31dc2f154b46c
status: 200
content-type: application/json
access-control-allow-origin: *
access-control-allow-headers: connection, range, accept-encoding, user-agent, referer, seq
content-length: 13335

GET
H2 200 bidexchange.js Show response
contextual.media.net/ 440 KB
124 KB 103ms
103ms Script
text/javascript 23.210.250.97
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/bidexchange.js?cid=8CUF1VN4G&dn=www.reuters.com&version=4.1&https=1

Requested by

Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.250.97 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-250-97.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0d515df3e388295626386b0bf5648159150cd59fdb24bc67613ed5eb45bbf255

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Wed, 12 Aug 2020 17:31:16 GMT
vary: Accept-Encoding
x-mnet-h: E
content-type: text/javascript; charset=utf-8
status: 200
cache-control: max-age=1800
expires: Wed, 12 Aug 2020 18:01:16 GMT

POST
H2 200 beacon
beacon.tru.am/ 0
0 167ms
142ms Fetch 2606:4700:20::ac43:4af5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.tru.am/beacon
Requested by: Host: tru.am
URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4af5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:16 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
status: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
access-control-allow-origin: https://www.reuters.com
cache-control: no-cache, private, max-age=0
cf-ray: 5c1bedd5b9b7c2bd-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 048552f9930000c2bd33af0200000001
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 204 61500
l.betrad.com/site/v3/1237/5669/8/5/3/2/ 0
120 B 108ms
107ms Image
text/plain 3.222.135.156
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l.betrad.com/site/v3/1237/5669/8/5/3/2/61500?consent=0
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.222.135.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-135-156.compute-1.amazonaws.com
Software: / Express
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: gzip
x-powered-by: Express
etag: W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary: Accept-Encoding

GET
H2 200 vendorlist.json Show response
www.reuters.com/json/api/ 89 KB
89 KB 29ms
28ms XHR
application/json 13.226.155.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reuters.com/json/api/vendorlist.json
Requested by: Host: c.evidon.com
URL: https://c.evidon.com/sitenotice/evidon-cmp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-95.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 61c564503fd8c3d2e54685465eaac1999b423c7a7c85fc40f6ac16fc95b44110

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:30:20 GMT
browser-expires: Wed, 12 Aug 2020 17:30:20 GMT
server: nginx
age: 56
status: 200
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: *
x-amz-cf-pop: DUS51-C1
access-control-allow-headers: Access-Control-Allow-Origin,charset
x-amz-cf-id: vRuqMSmsHUIU1Mu4NX7kkJVlcIjFhUQU5idffTqB2_HOg894fvRHNQ==
via: 1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
expires: Wed, 12 Aug 2020 17:31:20 GMT

POST
H2 200 execute Show response
experience.tinypass.com/xbuilder/experience/ 2 KB
2 KB 174ms
173ms XHR
application/json 2606:4700::6811:b8b1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://experience.tinypass.com/xbuilder/experience/execute?aid=TIDovF4cqC
Requested by: Host: cdn.tinypass.com
URL: https://cdn.tinypass.com/api/tinypass.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:b8b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b7f1d50686983d3d751139bc9df0993a4ee1bb13ec568193ec24ace5e8a304a

Request headers

Accept: */*
Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: br
cf-cache-status: DYNAMIC
p3p: CP="NON DSP COR OUR IND"
status: 200
x-forwarded-https: on
cf-request-id: 048552f9c4000005d0a72c5200000001
x-request-id: C4ooyeqDOE6
pragma: no-cache
wn: prod-exp-10-0-84-86
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.reuters.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 5c1bedd609fa05d0-FRA
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 vendorlist.json Show response
www.reuters.com/json/api/ 89 KB
89 KB 25ms
24ms XHR
application/json 13.226.155.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reuters.com/json/api/vendorlist.json
Requested by: Host: c.evidon.com
URL: https://c.evidon.com/sitenotice/evidon-cmp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.95 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-95.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 61c564503fd8c3d2e54685465eaac1999b423c7a7c85fc40f6ac16fc95b44110

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:30:20 GMT
browser-expires: Wed, 12 Aug 2020 17:30:20 GMT
server: nginx
age: 56
status: 200
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: *
x-amz-cf-pop: DUS51-C1
access-control-allow-headers: Access-Control-Allow-Origin,charset
x-amz-cf-id: lmM-5SSEbTUpbtT6CdDPz-AcoAJWbAaTaONHEe5gPkKRM_A4Sr_46w==
via: 1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
expires: Wed, 12 Aug 2020 17:31:20 GMT

GET
H2 200 intersection-observer.js Show response
www.dianomi.com/js/ 13 KB
4 KB 32ms
31ms Script
application/javascript 104.18.22.230
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.dianomi.com/js/intersection-observer.js

Requested by

Host: www.dianomi.com
URL: https://www.dianomi.com/js/videofeed-combined.js?id=123

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8567ea9f657a5f2ea1633ec26b13de309f60f0921a278db2a9be91d2e48984e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5856
cf-polished: origSize=29813
status: 200
x-xss-protection: 1; mode=block
last-modified: Thu, 21 May 2020 13:02:02 GMT
server: cloudflare
etag: W/"7475-5a6281e5fc48b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
expires: Wed, 12 Aug 2020 21:31:16 GMT
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-request-id: 048552f9da00000bed6d38f200000001
cf-ray: 5c1bedd6299d0bed-AMS
cf-bgj: minify

GET
H2 200 vendorlist.json Show response
vendorlist.consensu.org/ 99 KB
18 KB 39ms
11ms XHR
application/json 2600:9000:2182:9000:1:af78:4c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vendorlist.consensu.org/vendorlist.json
Requested by: Host: c.evidon.com
URL: https://c.evidon.com/sitenotice/evidon-cmp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2182:9000:1:af78:4c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca16dd3adebfcc177d21d8fe9fa1f3f1659479394e1c142b27d96cba5bf85058

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 06 Aug 2020 16:11:52 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
age: 523165
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Thu, 06 Aug 2020 16:00:36 GMT
server: AmazonS3
access-control-max-age: 604800
access-control-allow-methods: GET
x-amz-version-id: iUD8pa64KfvldrKJx93Vo4wA6Cnzn4uC
via: 1.1 5cd60f530cdafe284762767565aa2747.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: DUS51-C1
content-type: application/json; charset=utf-8
x-amz-cf-id: PTxlNLYrzqf5FsSfd5cZ-np5dV6jOb9Xf4hpixnZ4IcIPEnT5mZSQg==

GET
H/1.1

204
No Content

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=6035630&ns__t=1597253476860&ns_c=UTF-8&cv=3.5&c8=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20crimina...
https://sb.scorecardresearch.com/b2?c1=2&c2=6035630&ns__t=1597253476860&ns_c=UTF-8&cv=3.5&c8=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20crimin...

0
528 B

20ms
20ms

Image
text/plain

104.108.64.33
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=6035630&ns__t=1597253476860&ns_c=UTF-8&cv=3.5&c8=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals%20-%20Reuters&c7=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&c9=&cs_ak_ss=1
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.108.64.33 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-64-33.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 12 Aug 2020 17:31:17 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/b2?c1=2&c2=6035630&ns__t=1597253476860&ns_c=UTF-8&cv=3.5&c8=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals%20-%20Reuters&c7=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&c9=&cs_ak_ss=1
Pragma: no-cache
Date: Wed, 12 Aug 2020 17:31:16 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 tc.js Show response
contextual.media.net/ 11 KB
7 KB 38ms
37ms Script
text/javascript 23.210.250.97
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/tc.js?&tpkey=TB4M82W&size=300x250&v=19&nat=1&https=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/bidexchange.js?cid=8CUF1VN4G&dn=www.reuters.com&version=4.1&https=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.250.97 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-250-97.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

3c0d27b79bfe51d6abbc99eb79bd7731804fa80823d85bce422ee364185c6126

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Wed, 12 Aug 2020 17:31:16 GMT
vary: Accept-Encoding
x-mnet-h: E
content-type: text/javascript; charset=utf-8
status: 200
cache-control: max-age=172800
content-length: 6573
expires: Fri, 14 Aug 2020 17:31:16 GMT

GET
H2 200 tc.js Show response
contextual.media.net/ 13 KB
8 KB 39ms
38ms Script
text/javascript 23.210.250.97
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/tc.js?&tpkey=T645KQG&size=728x90&v=19&nat=1&https=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/bidexchange.js?cid=8CUF1VN4G&dn=www.reuters.com&version=4.1&https=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.250.97 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-250-97.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

d27b59be0fa35fd199035fb3d095a553cf11e6c7b44d583b2942650fc3da5977

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
server: Apache
date: Wed, 12 Aug 2020 17:31:16 GMT
vary: Accept-Encoding
x-mnet-h: E
content-type: text/javascript; charset=utf-8
status: 200
cache-control: max-age=172800
content-length: 7712
expires: Fri, 14 Aug 2020 17:31:16 GMT

GET
H2 200 px.gif
contextual.media.net/ 43 B
206 B 20ms
20ms Image
image/gif 23.210.250.97
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/px.gif?&ch=1&vn=1

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.250.97 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-250-97.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:16 GMT
last-modified: Wed, 19 Jul 2017 10:11:12 GMT
server: Apache
strict-transport-security: max-age=604800
content-type: image/gif
status: 200
cache-control: max-age=1002042
accept-ranges: bytes
content-length: 43
expires: Mon, 24 Aug 2020 07:51:58 GMT

GET
H/1.1 200
OK px.gif
s.mnet-ad.net/ 43 B
355 B 382ms
128ms Image
image/gif 66.81.204.228
CONFLUENCE-NETWOR...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.mnet-ad.net/px.gif?&ch=2&vn=1
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 66.81.204.228 , Virgin Islands (British), ASN40034 (CONFLUENCE-NETWORK-INC, VG),
Reverse DNS
Software: Apache /
Resource Hash: 8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 12 Aug 2020 17:31:17 GMT
Last-Modified: Wed, 19 Jul 2017 10:11:12 GMT
Server: Apache
Content-Type: image/gif
Cache-Control: max-age=1209600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=45
Content-Length: 43
Expires: Wed, 26 Aug 2020 17:31:17 GMT

GET
H2 200 rtbsspub
cdneu-xch.media.net/AdExchange/ 50 KB
50 KB 74ms
32ms EventSource
text/event-stream 23.62.140.165
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdneu-xch.media.net/AdExchange/rtbsspub?&gdpr=1&gdprconsent=0&usp_enf=1&usp_status=0&us_privacy=1---&cid=8CUF1VN4G&region=eu&ptrid=8PRL4E7N3&requestString=391166652*4%7C300x600%7C8CUD609M7%7C362622121%7C%7C%7C1%40391166652*23%7C300x250~300x600%7C8CUF1VN4G%7C12762257~12762257%7C%7C%7C1%40391166652*29%7C300x250~300x600%7C11384%7C31484_123996_15~31484_123996_10%7C%7C%7C1%40391166652*51%7C300x250~300x600%7C973973%7C11084976~11084976%7C0.07%7C%7C1%40391166652*59%7C300x250~300x600%7C8CUF1VN4G%7C_112891~_112891%7C0.07%7C%7C1%40391166652*74%7C300x250~300x600%7C1113800%7C12209207~12209207%7C%7C%7C1%40391166652*84%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C391166652%7C%7C%7C3%40391166652*97%7C300x250~300x600%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C0.63%7C%7C1%40391166652*108%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C391166652_8CUF1VN4G%7C%7C%7C3%40391166652*117%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C391166652_8CUF1VN4G%7C%7C%7C3%40391166652*145%7C300x600~300x250%7C100600%7C147215~147215%7C%7C%7C1%40391166652*172%7C300x250~300x600%7C8CUF1VN4G%7C15331955~15331955%7C0.06%7C%7C1%40391166652*175%7C300x600~300x250%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C0.01%7C%7C1%40391166652*178%7C300x600~300x250%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C%7C%7C1%40391166652*201%7C300x600~300x250%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C%7C%7C1%40391166652*203%7C300x250~300x600%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C%7C%7C1%40391166652*214%7C300x600~300x250%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C%7C%7C1%40391166652*222%7C300x250~300x600%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C%7C%7C1%40391166652*3007%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C391166652_8CUF1VN4G%7C%7C%7C3%40391166652*3010%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C391166652_8CUF1VN4G%7C%7C%7C3%40391166652*3015%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C391166652~391166652%7C%7C%7C3%40451439109*9%7C300x250%7C8CUD609M7%7C155187763%7C%7C%7C1%40451439109*23%7C300x250%7C8CUF1VN4G%7C12762293%7C%7C%7C1%40451439109*29%7C300x250%7C11384%7C31484_123998_15%7C%7C%7C1%40451439109*51%7C300x250%7C973973%7C11084979%7C0.07%7C%7C1%40451439109*59%7C300x250%7C8CUF1VN4G%7C_112891%7C0.07%7C%7C1%40451439109*84%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C451439109%7C%7C%7C3%40451439109*97%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C0.63%7C%7C1%40451439109*108%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C3%40451439109*117%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C3%40451439109*145%7C300x250%7C100600%7C147218%7C%7C%7C1%40451439109*172%7C300x250%7C8CUF1VN4G%7C15331958%7C0.06%7C%7C1%40451439109*175%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C0.01%7C%7C1%40451439109*178%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C1%40451439109*203%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C1%40451439109*214%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C1%40451439109*222%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C1%40451439109*3007%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C3%40451439109*3010%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C3%40451439109*3014%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C3%40518121357*4%7C728x90%7C8CUD609M7%7C996968123%7C%7C%7C1%40518121357*23%7C728x90%7C8CUF1VN4G%7C12762293%7C%7C%7C1%40518121357*29%7C728x90%7C11384%7C31484_123998_2%7C%7C%7C1%40518121357*51%7C728x90%7C973973%7C11084978%7C0.69%7C%7C1%40518121357*59%7C728x90%7C8CUF1VN4G%7C_112891%7C0.07%7C%7C1%40518121357*84%7C1x1_T645KQG_1%7C8CUF1VN4G%7C518121357%7C%7C%7C3%40518121357*97%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C0.63%7C%7C1%40518121357*108%7C1x1_T645KQG_1%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C3%40518121357*117%7C1x1_T645KQG_1%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C3%40518121357*145%7C728x90%7C100600%7C147217%7C%7C%7C1%40518121357*172%7C728x90%7C8CUF1VN4G%7C15331957%7C0.06%7C%7C1%40518121357*175%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C0.01%7C%7C1%40518121357*178%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C1%40518121357*203%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C1%40518121357*214%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C1%40518121357*222%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C1%40518121357*3007%7C1x1_T645KQG_1%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C3%40518121357*3010%7C1x1_T645KQG_1%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C3%40518121357*3014%7C1x1_T645KQG_1%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C3%40612341223*23%7C728x90%7C8CUF1VN4G%7C12762257%7C%7C%7C1%40612341223*29%7C728x90~970x250%7C11384%7C31484_123996_2~31484_123996_57%7C%7C%7C1%40612341223*51%7C728x90%7C973973%7C11084975%7C0.69%7C%7C1%40612341223*59%7C728x90~970x250%7C8CUF1VN4G%7C_112891~_112891%7C0.07%7C%7C1%40612341223*74%7C728x90~970x250%7C1113800%7C12209209~12209209%7C%7C%7C1%40612341223*84%7C1x1_T645KQG_1%7C8CUF1VN4G%7C612341223%7C%7C%7C3&crid=391166652%2C451439109%2C518121357%2C612341223&sd=1&requrl=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&bl=1&rt=5&dn=https://www.reuters.com&https=1&act=headerBid&prvReqId=357258269673949051597253476945&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.7823789513415023&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1600%2C%22vh%22%3A1200%2C%22ph%22%3A7286%7D&itype=HB&cc=NL&ct=AMSTERDAM&sid=8973&scc=1&tmt=200&section=us.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&prid=8PRVCXX19&isRefresh=0&switch=1
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.62.140.165 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-140-165.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 71877bfc934e838ceb6e2541f2a2f114beb843b4019bffd9cbafd722cba405b3

Request headers

Accept: text/event-stream
Cache-Control: no-cache
Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:17 GMT
status: 200
content-type: text/event-stream;charset=UTF-8
access-control-allow-origin: https://www.reuters.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
timing-allow-origin: *, *
expires: Wed, 12 Aug 2020 17:31:17 GMT

GET
H2 200 rtbsspub
cdneu-xch.media.net/AdExchange/ 18 KB
18 KB 65ms
30ms EventSource
text/event-stream 23.62.140.165
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdneu-xch.media.net/AdExchange/rtbsspub?&gdpr=1&gdprconsent=0&usp_enf=1&usp_status=0&us_privacy=1---&cid=8CUF1VN4G&region=eu&ptrid=8PRL4E7N3&requestString=612341223*9%7C728x90~970x250%7C8CUD609M7%7C813012502~450341239%7C%7C%7C1%40612341223*97%7C728x90~970x250%7C8CUF1VN4G%7C612341223_8CUF1VN4G~612341223_8CUF1VN4G%7C0.63%7C%7C1%40612341223*108%7C1x1_T645KQG_1%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C%7C%7C3%40612341223*117%7C1x1_T645KQG_1%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C%7C%7C3%40612341223*145%7C728x90~970x250%7C100600%7C147214~147214%7C%7C%7C1%40612341223*172%7C728x90~970x250%7C8CUF1VN4G%7C15303527~15303527%7C0.06%7C%7C1%40612341223*175%7C728x90%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C0.01%7C%7C1%40612341223*178%7C728x90%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C%7C%7C1%40612341223*203%7C728x90~970x250%7C8CUF1VN4G%7C612341223_8CUF1VN4G~612341223_8CUF1VN4G%7C%7C%7C1%40612341223*214%7C970x250~728x90%7C8CUF1VN4G%7C612341223_8CUF1VN4G~612341223_8CUF1VN4G%7C%7C%7C1%40612341223*222%7C728x90%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C%7C%7C1%40612341223*3007%7C1x1_T645KQG_1%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C%7C%7C3%40612341223*3010%7C1x1_T645KQG_1%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C%7C%7C3%40612341223*3015%7C1x1_T645KQG_1%7C8CUF1VN4G%7C612341223~612341223%7C%7C%7C3%40894667540*9%7C300x250%7C8CUD609M7%7C611759711%7C%7C%7C1%40894667540*59%7C300x250%7C8CUF1VN4G%7C_112891%7C0.07%7C%7C1%40894667540*97%7C300x250%7C8CUF1VN4G%7C894667540_8CUF1VN4G%7C0.63%7C%7C1%40894667540*175%7C300x250%7C8CUF1VN4G%7C894667540_8CUF1VN4G%7C0.01%7C%7C1%40894667540*178%7C300x250%7C8CUF1VN4G%7C894667540_8CUF1VN4G%7C%7C%7C1%40894667540*201%7C300x250%7C8CUF1VN4G%7C894667540_8CUF1VN4G%7C%7C%7C1%40894667540*203%7C300x250%7C8CUF1VN4G%7C894667540_8CUF1VN4G%7C%7C%7C1%40894667540*214%7C300x250%7C8CUF1VN4G%7C894667540_8CUF1VN4G%7C%7C%7C1%40894667540*222%7C300x250%7C8CUF1VN4G%7C894667540_8CUF1VN4G%7C%7C%7C1&crid=612341223%2C894667540&sd=1&requrl=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&bl=1&rt=5&dn=https://www.reuters.com&https=1&act=headerBid&prvReqId=316766262730078261597253476968&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.5810064718770778&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1600%2C%22vh%22%3A1200%2C%22ph%22%3A7286%7D&itype=HB&cc=NL&ct=AMSTERDAM&sid=8973&scc=1&tmt=200&section=us.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&prid=8PRVCXX19&isRefresh=0
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.62.140.165 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-140-165.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 8cbd1097e867ef0f8cadea9c9df71dbce6ee4dbd817a5e72d6e467365cb10a60

Request headers

Accept: text/event-stream
Cache-Control: no-cache
Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:17 GMT
status: 200
content-type: text/event-stream;charset=UTF-8
access-control-allow-origin: https://www.reuters.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
timing-allow-origin: *, *
expires: Wed, 12 Aug 2020 17:31:17 GMT

GET
H2 200 getcookie Show response
evidon.mgr.consensu.org/iab/ 169 B
381 B 338ms
120ms Script
text/javascript 52.73.249.152
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://evidon.mgr.consensu.org/iab/getcookie
Requested by: Host: c.evidon.com
URL: https://c.evidon.com/sitenotice/evidon-cmp.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.249.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-249-152.compute-1.amazonaws.com
Software: /
Resource Hash: 9b133863146a5f391e8cee0842cafc7498ae89b6f79edbecfc842055342c1fe2

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:17 GMT
x-amzn-requestid: f64b78ba-4dea-4032-bca8-d681e748735c
status: 200
content-type: text/javascript
access-control-allow-origin: *
x-amzn-trace-id: Root=1-5f342765-5543fb79539a3d190449915e;Sampled=0
x-amz-apigw-id: RKsX1HEaoAMFs3Q=
content-length: 169

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 56 KB
19 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/bidexchange.js?cid=8CUF1VN4G&dn=www.reuters.com&version=4.1&https=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

600000022cb36ca9bbf4e52a1132f413e4c92d72905c080429b1cf8e8f30caa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "599 / 256 of 1000 / last-modified: 1597242400"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 19034
x-xss-protection: 0
expires: Wed, 12 Aug 2020 17:31:17 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
829 B 30ms
16ms Script
application/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.reuters.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 12 Aug 2020 17:31:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
829 B 31ms
17ms Script
application/javascript 2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.reuters.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 12 Aug 2020 17:31:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2020080601.js Show response
securepubads.g.doubleclick.net/gpt/ 262 KB
92 KB 29ms
28ms Script
text/javascript 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f130.1e100.net

Software

sffe /

Resource Hash

dadad940eacc6f93ddfc5fc68a4c5defd950c54c7e731d2826b8ba953da9c321

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Aug 2020 08:40:02 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 93969
x-xss-protection: 0
expires: Wed, 12 Aug 2020 17:31:17 GMT

POST
H2 200 p Show response
api.segment.io/v1/ 21 B
141 B 528ms
183ms XHR
application/json 54.201.25.196
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.segment.io/v1/p
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/IEWBqQ8VWHijTQxb7lEBGFGS9uIJzigZ/analytics.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.201.25.196 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-201-25-196.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 200
date: Wed, 12 Aug 2020 17:31:17 GMT
access-control-allow-origin: https://www.reuters.com
content-length: 21
vary: Origin
content-type: application/json

GET
H2 200 /
www.facebook.com/tr/ 44 B
265 B 18ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=312961195854690&ev=PageView&dl=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&rl=&if=false&ts=1597253477188&sw=1600&sh=1200&v=2.9.23&r=stable&a=seg&ec=0&o=30&fbp=fb.1.1597253477186.1594276672&it=1597253476695&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:17 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Wed, 12 Aug 2020 17:31:17 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
192 B 7ms
6ms Image
image/gif 2a00:1450:4001:814::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j83&aip=1&a=805289877&t=pageview&_s=1&dl=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&dp=%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&ul=en-us&de=UTF-8&dt=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAiEAjR~&jid=39896364&gjid=207877150&cid=1909816365.1597253476&tid=UA-24152976-22&_gid=346266412.1597253476&cd2=Cyberrisk&cd11=us-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals&cd4=Article%20-%20News&cd32=Fri%20Jul%2031%202020%2002%3A00%3A00%20GMT%2B0200%20(Central%20European%20Summer%20Time)&cd8=0&cd10=Slideshow&cd9=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&cd19=Page%20Load&cd7=Desktop&cd6=U.S.&cd5=Article&cd17=Jack%20Stubbs&cd3=Tentpoles%20-%20Cyberrisk&cd1=Tentpoles&cd13=529&cd18=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals&cd38=false&cd40=RCOMUS_Cyberrisk&cd41=us.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&cd42=USKCN24W25W&cd43=KCN24W25W&cd44=4&cd45=Fri%20Jul%2031%202020%2002%3A00%3A00%20GMT%2B0200%20(Central%20European%20Summer%20Time)&z=652903460

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Aug 2020 08:14:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 465403
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j83&tid=UA-24152976-22&cid=1909816365.1597253476&jid=39896364&gjid=207877150&_gid=346266412.1597253476&_u=aGDAiEAjR~&z=403939372
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=1909816365.1597253476&jid=39896364&_v=j83&z=403939372
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=1909816365.1597253476&jid=39896364&_v=j83&z=403939372&slf_rd=1&random=1460258331

42 B
492 B

30ms
17ms

Image
image/gif

2a00:1450:4001:81a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=1909816365.1597253476&jid=39896364&_v=j83&z=403939372&slf_rd=1&random=1460258331

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:17 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=1909816365.1597253476&jid=39896364&_v=j83&z=403939372&slf_rd=1&random=1460258331
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 0b9ae0631dc9cb1d12dd2eb240ef07bb.png
static.reuters.com/resources_v2/react/cookie-reset-b74/ 22 KB
9 KB 34ms
32ms Image
image/png 13.226.155.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/0b9ae0631dc9cb1d12dd2eb240ef07bb.png
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.12 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-12.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 9f9104dee58871cdb561e4f139fcf095a2fc1fcb0a7778a964975e6b12059c6a

Request headers

Referer: https://static.reuters.com/resources_v2/react/cookie-reset-b74/article.bundle.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 00:12:58 GMT
content-encoding: gzip
age: 62322
x-cache: Hit from cloudfront
status: 200
content-length: 9050
last-modified: Thu, 06 Aug 2020 21:01:22 GMT
server: nginx
vary: Accept-Encoding
content-type: image/png
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
x-amz-cf-id: 3L10ZRP7-GWNoJStD_vhMaFiRHMFcWfFqqxPUxiDefC5730JaxRTLQ==
expires: Thu, 13 Aug 2020 00:12:35 GMT

GET
H2 200 /
static.reuters.com/resources/r/ 2 KB
2 KB 25ms
24ms Image
image/jpeg 13.226.155.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.reuters.com/resources/r/?m=02&d=20200812&t=2&i=1529359263&r=LYNXNPEG7B0P3&w=120
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.12 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-12.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 6f4ae319a9f80c61a3c9734248d8be481ae430185443f3b2747bc1b4f617cc8f

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 15:05:57 GMT
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront)
x-amz-expiration: expiry-date="Sat, 12 Sep 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified: Wed, 12 Aug 2020 15:02:31 GMT
server: nginx
age: 8720
etag: "7bff502a77ef4d417ccc5b02c79a36d3"
x-cache: Hit from cloudfront
x-amz-version-id: lkdqCjB__KeDP68zpK28oYDV4S2K9Qvg
status: 200
x-amz-cf-pop: DUS51-C1
content-type: image/jpeg
content-length: 1831
x-amz-cf-id: 4ilibd_bMqy7_ObS19sGTCdOXY340HHumL9aqcEpUMRlXs_2R5gx1Q==

GET
H2 200 /
static.reuters.com/resources/r/ 3 KB
4 KB 36ms
35ms Image
image/jpeg 13.226.155.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.reuters.com/resources/r/?m=02&d=20200812&t=2&i=1529329016&r=LYNXNPEG7B0PA&w=120
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.12 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-12.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: deebd915997d1fc20b8c17b0ac9e57a20b84cb44a54858b18d0ad0ee6ea51f5a

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 10:30:10 GMT
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront)
x-amz-expiration: expiry-date="Sat, 12 Sep 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified: Wed, 12 Aug 2020 10:20:11 GMT
server: nginx
age: 25267
etag: "758ffec099d7a1e63dcb76ef5a815fdd"
x-cache: Hit from cloudfront
x-amz-version-id: 3gjoPXEtuzQ0hPztG09uRglvhBw6By_1
status: 200
x-amz-cf-pop: DUS51-C1
content-type: image/jpeg
content-length: 3453
x-amz-cf-id: Po4fCy39e9lFeq13Hs4WFFc0NKh1mWAbbGk5Lmgntbk9pKdIDegXKQ==

GET
H2 200 /
static.reuters.com/resources/r/ 2 KB
3 KB 34ms
33ms Image
image/jpeg 13.226.155.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.reuters.com/resources/r/?m=02&d=20200811&t=2&i=1529196472&r=LYNXNPEG7A0N6&w=120
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.12 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-12.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 62c155232156eb11fcfd2db27dc8304f7c2fd810da25bfa7740ef28b0b156f88

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: msd_zdO3pS8XGXFU0GWNDWAbszZeVy_g
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront)
x-amz-expiration: expiry-date="Fri, 11 Sep 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified: Tue, 11 Aug 2020 12:27:57 GMT
server: nginx
age: 17767
etag: "34bdde8058497a81615be5df096f5a05"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
date: Wed, 12 Aug 2020 12:35:11 GMT
x-amz-cf-pop: DUS51-C1
content-length: 2177
x-amz-cf-id: adwkz-BZP1rWdLpBD-FJ1udq8rOaeitfiBq6ttCO5uI5D9J6pXmFQg==

GET
H2 200 /
static.reuters.com/resources/r/ 2 KB
3 KB 35ms
34ms Image
image/jpeg 13.226.155.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.reuters.com/resources/r/?m=02&d=20200812&t=2&i=1529284349&r=LYNXNPEG7B02O&w=120
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.12 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-12.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 25adad9ca79b728ee179d70f9f9251b37634f92ddc1421d1e4204b1fbad4e303

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 04:05:22 GMT
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront)
x-amz-expiration: expiry-date="Sat, 12 Sep 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified: Wed, 12 Aug 2020 02:00:18 GMT
server: nginx
age: 48355
etag: "f4dcc1a43f8e8e69191d9b322c09df72"
x-cache: Hit from cloudfront
x-amz-version-id: nZUmN3Gxuxf9IGq3cUUGVDwbxfhN0JdW
status: 200
x-amz-cf-pop: DUS51-C1
content-type: image/jpeg
content-length: 2257
x-amz-cf-id: ntWA_kNMPhsaiRZ-0GJNHbz_SDX7n4brxG87rYYdsTxEXbTxTfyN5Q==

GET
H2 200 /
static.reuters.com/resources/r/ 3 KB
4 KB 35ms
34ms Image
image/jpeg 13.226.155.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.reuters.com/resources/r/?m=02&d=20200812&t=2&i=1529329379&r=LYNXNPEG7B0QI&w=120
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.12 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-12.dus51.r.cloudfront.net
Software: nginx /
Resource Hash: 8eb04f497f623ad4df1e207d4b1abaca12374d493dd3145a60ebc2bde02c8c62

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 10:35:16 GMT
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront)
x-amz-expiration: expiry-date="Sat, 12 Sep 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified: Wed, 12 Aug 2020 10:22:46 GMT
server: nginx
age: 24961
etag: "7f47f8cf8ea328f49ef6a220e53bd663"
x-cache: Hit from cloudfront
x-amz-version-id: BApAvhF_VkUW7Z1retx11AhNGsHSdWMH
status: 200
x-amz-cf-pop: DUS51-C1
content-type: image/jpeg
content-length: 3476
x-amz-cf-id: -NM_9CWKPaw2FeDMCIw1tCEtcTkN-8HH29RljPQBK1mVZht0hecFrg==

GET
H2 200 pub Show response
pixel.adsafeprotected.com/services/ 325 B
558 B 110ms
37ms XHR
application/json 52.18.153.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/services/pub?anId=10764&slot=%7Bid:dpslot_mpu_14694387_USKCN24W25W,ss:%5B300.250,300.600,1.1%5D,p:/4735792/us.reuters/tentpoles/cyberrisk/article,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=cdf3f403-5172-baaa-7e7e-de4f76e8a5e8&url=https%253A%252F%252Fwww.reuters.com%252Farticle%252Fus-cyber-cwt-ransom%252Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Requested by: Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.153.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-153-122.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b403c1fba06a7a1a66d7106a0aab1c8a7618c0d62dcf3475d10bd4bd9666ea06

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:17 GMT
x-server-name: app05.ie.303net.net
status: 200
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.reuters.com
access-control-expose-headers: X-Server-Name
access-control-allow-credentials: true
timing-allow-origin: *
server: nginx

GET
H2 200 pub Show response
pixel.adsafeprotected.com/services/ 331 B
564 B 109ms
36ms XHR
application/json 52.18.153.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/services/pub?anId=10764&slot=%7Bid:canvas_leaderboard_2906111818142287_USKCN24W25W,ss:%5B728.90,970.250,970.90,1100.100,1100.90,1100.250,1.1%5D,p:/4735792/us.reuters/tentpoles/cyberrisk/article,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=cdf3f403-5172-baaa-7e7e-de4f76e8a5e8&url=https%253A%252F%252Fwww.reuters.com%252Farticle%252Fus-cyber-cwt-ransom%252Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Requested by: Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.153.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-153-122.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1a2d26aecdfb8347c3be47a4dc55576c78dd9f422a40cd17f86b0b640c043d79

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:17 GMT
x-server-name: app30.ie.303net.net
status: 200
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.reuters.com
access-control-expose-headers: X-Server-Name
access-control-allow-credentials: true
timing-allow-origin: *
server: nginx

GET
H2 200 pub Show response
pixel.adsafeprotected.com/services/ 56 B
289 B 98ms
34ms XHR
application/json 52.18.153.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/services/pub?anId=10764&slot=%7Bid:dpslot_connatix_13552233_USKCN24W25W,s:1100,420.1100,400.fluid,p:/4735792/us.reuters/tentpoles/cyberrisk/article,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=cdf3f403-5172-baaa-7e7e-de4f76e8a5e8&url=https%253A%252F%252Fwww.reuters.com%252Farticle%252Fus-cyber-cwt-ransom%252Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Requested by: Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.153.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-153-122.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: bf3669795bba5ee81c6defbeb24c48986d4693233ce0964138e897363527c3af

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:17 GMT
x-server-name: app29.ie.303net.net
status: 200
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.reuters.com
access-control-expose-headers: X-Server-Name
access-control-allow-credentials: true
timing-allow-origin: *
server: nginx

GET
H2 200 pub Show response
pixel.adsafeprotected.com/services/ 290 B
523 B 107ms
43ms XHR
application/json 52.18.153.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/services/pub?anId=10764&slot=%7Bid:dpslot_bizdev_article_rr2_13881914_USKCN24W25W,ss:%5B300.280,300.250%5D,p:/4735792/us.reuters/tentpoles/cyberrisk/article,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=cdf3f403-5172-baaa-7e7e-de4f76e8a5e8&url=https%253A%252F%252Fwww.reuters.com%252Farticle%252Fus-cyber-cwt-ransom%252Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Requested by: Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.153.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-153-122.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f98c6888132dbe656a610be0519b16b6cc2aa4c9356e6788f55f91b2737c8de8

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:17 GMT
x-server-name: app06.ie.303net.net
status: 200
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.reuters.com
access-control-expose-headers: X-Server-Name
access-control-allow-credentials: true
timing-allow-origin: *
server: nginx

GET
H2 200 chartbeat_video.js Show response
static.chartbeat.com/js/ 69 KB
23 KB 13ms
13ms Script
application/x-javascript 2600:9000:2182:ea00:18:1fcd:34e:d2a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.chartbeat.com/js/chartbeat_video.js
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2182:ea00:18:1fcd:34e:d2a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: ba607af2c8d414ab6d4bac90c526d90a939cb0adf507b6ba063265347479159d

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 15:33:34 GMT
content-encoding: gzip
last-modified: Fri, 24 Apr 2020 00:58:19 GMT
server: nginx
age: 7062
etag: W/"5ea239ab-11347"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=7200
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: Y39So7T6Bnq57M8s3rqnUL6r_CuCUI1PbfZc_9AILTlRDU7_-MVoog==
via: 1.1 f6bd96409cae11d77ed75457d756ef80.cloudfront.net (CloudFront)
expires: Wed, 12 Aug 2020 17:33:34 GMT

GET
H2 200 checksync.php
contextual.media.net/ Frame 65C9 0
0 29ms
27ms Document
text/html 23.210.250.97
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8CUF1VN4G&prvid=3%2C23%2C28%2C29%2C33%2C38%2C41%2C51%2C54%2C56%2C59%2C69%2C72%2C74%2C76%2C77%2C80%2C82%2C84%2C97%2C106%2C108%2C109%2C113%2C117%2C118%2C122%2C126%2C138%2C139%2C141%2C145%2C147%2C159%2C172%2C173%2C174%2C175%2C178%2C182%2C184%2C188%2C193%2C201%2C203%2C208%2C214%2C222%2C225%2C226%2C3004%2C3007%2C3008%2C3010%2C3012%2C3014%2C3015%2C3017&rtime=480&https=1&gdpr=1&gdprconsent=0&usp_status=0&usp_consent=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/bidexchange.js?cid=8CUF1VN4G&dn=www.reuters.com&version=4.1&https=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.250.97 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-250-97.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

:method: GET
:authority: contextual.media.net
:scheme: https
:path: /checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8CUF1VN4G&prvid=3%2C23%2C28%2C29%2C33%2C38%2C41%2C51%2C54%2C56%2C59%2C69%2C72%2C74%2C76%2C77%2C80%2C82%2C84%2C97%2C106%2C108%2C109%2C113%2C117%2C118%2C122%2C126%2C138%2C139%2C141%2C145%2C147%2C159%2C172%2C173%2C174%2C175%2C178%2C182%2C184%2C188%2C193%2C201%2C203%2C208%2C214%2C222%2C225%2C226%2C3004%2C3007%2C3008%2C3010%2C3012%2C3014%2C3015%2C3017&rtime=480&https=1&gdpr=1&gdprconsent=0&usp_status=0&usp_consent=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: gdpr_status=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Response headers

status: 200
server: Apache
content-type: text/html; charset=UTF-8
set-cookie: gdpr_status=1; Expires=Sat, 13 Feb 2021 17:31:17 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=519073
expires: Tue, 18 Aug 2020 17:42:30 GMT
date: Wed, 12 Aug 2020 17:31:17 GMT
content-length: 4727

GET
H2 200 tag.min.js Show response
get.s-onetag.com/4ed1416f-67eb-4d50-8a45-916a5921fee8/ 42 KB
14 KB 84ms
34ms Script
text/javascript 13.226.155.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://get.s-onetag.com/4ed1416f-67eb-4d50-8a45-916a5921fee8/tag.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W9SLGS
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.2 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-2.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f37beed085d2cfdd1386a8942434d8011aa20f2e7afa20d7edfd0d49998da1e7

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Thu, 09 Jul 2020 16:33:02 GMT
server: AmazonS3
age: 28
date: Wed, 12 Aug 2020 17:30:50 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
status: 200
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: Ku1oVzVOdEX9uhhvKp0fyLHl08TiOroXMMlmMug8zgtlRL1U950Tlg==
via: 1.1 51054083366f59cdc509361d23d873eb.cloudfront.net (CloudFront)

POST
H2 200 i Show response
api.segment.io/v1/ 21 B
141 B 307ms
182ms XHR
application/json 54.201.25.196
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.segment.io/v1/i
Requested by: Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/IEWBqQ8VWHijTQxb7lEBGFGS9uIJzigZ/analytics.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.201.25.196 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-201-25-196.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: 12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 200
date: Wed, 12 Aug 2020 17:31:17 GMT
access-control-allow-origin: https://www.reuters.com
content-length: 21
vary: Origin
content-type: application/json

GET
H2 200 collect
www.google-analytics.com/ 35 B
90 B 8ms
7ms Image
image/gif 2a00:1450:4001:814::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j83&aip=1&a=805289877&t=timing&_s=2&dl=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&dp=%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&ul=en-us&de=UTF-8&dt=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=1862&pdt=18&dns=1&rrt=0&srt=50&tcp=47&dit=463&clt=463&_gst=185&_gbt=214&_cst=109&_cbt=173&_u=aHDAiEAjR~&jid=&gjid=&cid=1909816365.1597253476&tid=UA-24152976-22&_gid=346266412.1597253476&cd2=Cyberrisk&cd11=us-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals&cd4=Article%20-%20News&cd32=Fri%20Jul%2031%202020%2002%3A00%3A00%20GMT%2B0200%20(Central%20European%20Summer%20Time)&cd8=0&cd10=Slideshow&cd9=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&cd19=Page%20Load&cd7=Desktop&cd6=U.S.&cd5=Article&cd17=Jack%20Stubbs&cd3=Tentpoles%20-%20Cyberrisk&cd1=Tentpoles&cd13=529&cd18=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals&cd38=false&cd40=RCOMUS_Cyberrisk&cd41=us.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&cd42=USKCN24W25W&cd43=KCN24W25W&cd44=4&cd45=Fri%20Jul%2031%202020%2002%3A00%3A00%20GMT%2B0200%20(Central%20European%20Summer%20Time)&z=1021624890

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 07 Aug 2020 08:14:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 465403
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 102 KB
18 KB 528ms
528ms XHR
text/plain 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4038856931383289&correlator=2938341043189609&output=ldjh&impl=fifs&adsid=NT&eid=21067064%2C21065517%2C21066533&vrg=2020080601&rdp=1&us_privacy=1---&npa=1&guci=1.2.0.0.2.1.0.0&sc=1&sfv=1-0-37&ecs=20200812&iu_parts=4735792%2Cus.reuters%2Ctentpoles%2Ccyberrisk%2Carticle&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=300x250%7C300x600%7C1x1%2C728x90%7C970x250%7C970x90%7C1100x100%7C1100x90%7C1100x250%7C1x1%2C320x50%7C1100x420%7C1100x400%2C300x280%7C300x250&fluid=0%2C0%2Cheight%2C0&csp=articleID%3DUSKCN24W25W%26storychannel%3DRCOMUS_Cyberrisk%253Bcyber-risk-full%253BRCOM-cyberrisk-extended%253Bcyber-security%253BbusinessNews%253Bcompanies-semi%253BeverythingNews%253BUS-The-Wire%253BUSWire_EL%253Bcompanies-swit%26story%3D0%26template%3Darticle%26p_count%3D19%26asset%3Dimage&prev_scp=type%3Dmpu%26div_id%3D14694387%26pixel_distance%3D400%26mnetDNB%3D1%26mnetPageID%3D1%26mnetCV%3D3%26mnetCC%3DNL%26mnetUGD%3D4%7Ctype%3Dleaderboard%26div_id%3D2906111818142287%26mnetDNB%3D1%26mnetPageID%3D4%26mnetCV%3D3%26mnetCC%3DNL%26mnetUGD%3D4%7Ctype%3Dconnatix%26div_id%3D13552233%26pixel_distance%3D20000%7Ctype%3Dbizdev_article_rr2%26div_id%3D13881914%26pixel_distance%3D20000%26mnetDNB%3D1%26mnetPageID%3D5%26mnetCV%3D3%26mnetCC%3DNL%26mnetUGD%3D4&cust_params=bidxc%3D1%26admant%3DAccentureAPAC_Negative%252CArtificial_Intelligence%252CBarclays%252CBarclays_2%252CBoeing_Neg%252CBofA_Neg%252CBofA_Neg_Topics%252CCME_Negative%252CCognizant_Coronavirus_3%252CDIT_Negative_kw1%252CDWA-Cisco-Coronavirus%252CExxon_Negative%252CFRB%252CGoldmanSachs%252CIBM%252CJPMorgan_Neg%252CJuliusBaer2020_FinancialPlanning-2%252CMSFT_Neg%252CMarcusUSDeposits_1%252CMobkoi_FB_Negative%252CNegative_Keywords_3.2%252CSaudiAramco_Negative%252CTradeWeb_AiEx%252CWorkdayPG_Neg%26ntvPlacement%3D1093478&cookie_enabled=1&bc=31&abxe=1&lmt=1597253477&dt=1597253477451&dlt=1597253475613&idt=1648&frm=20&biw=1600&bih=1200&oid=3&adxs=1140%2C-12245933%2C258%2C1140&adys=404%2C-12245933%2C3487%2C3044&adks=1450972129%2C4268771640%2C3552855918%2C225772345&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&dssz=70&icsg=704643840&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x-1%7C0x-1%7C754x420%7C300x-1&msz=300x-1%7C0x-1%7C754x420%7C300x-1&ga_vid=1909816365.1597253476&ga_sid=1597253477&ga_hid=805289877&fws=4%2C132%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f130.1e100.net

Software

cafe /

Resource Hash

9c5bec97b9c707f3668bac58b61a576000c0cf7ec406e797e108977c41c475c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:17 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18653
x-xss-protection: 0
google-lineitem-id: -1,-1,4806613891,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,138288736159,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reuters.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
b16cdb5aef2c277f8dbd85c3c47d37a3.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 50ms
15ms Other
text/html 2a00:1450:4001:819::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://b16cdb5aef2c277f8dbd85c3c47d37a3.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 6ms
6ms Other
text/html 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 ping
ping.chartbeat.net/ 43 B
168 B 298ms
99ms Image
image/gif 52.73.105.22
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ping.chartbeat.net/ping?h=reuters.com&p=reuters.com%2Farticle%2Fus-cyber-cwt-ransom-idUSKCN24W25W&u=CqZp0h6WFYABvjR26&d=reuters.com&g=52639&g0=Cyberrisk&g1=Jack%20Stubbs&g4=Article&n=1&f=00001&c=0&x=0&m=0&y=7286&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=1862&t=p0lLQDMdY16CAWgoPDj_P928wweg&V=120&i=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals%20-%20Reuters&tz=-120&sn=1&sv=CAGq5fBtZxQ7DUJdVCCGIGPN8qAl8&sd=1&im=06679cf0&_
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.105.22 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-105-22.compute-1.amazonaws.com
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
pragma: no-cache
date: Wed, 12 Aug 2020 17:31:17 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
expires: 0

GET
H2 200 beacon.min.js Show response
beacon.s-onetag.com/ 18 KB
6 KB 61ms
10ms Script
application/javascript 2600:9000:2182:ca00:5:9a4c:9b00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.s-onetag.com/beacon.min.js
Requested by: Host: get.s-onetag.com
URL: https://get.s-onetag.com/4ed1416f-67eb-4d50-8a45-916a5921fee8/tag.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2182:ca00:5:9a4c:9b00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d640ed39630d91dec61dcb107b977293ec29fecbb5e74467e017d872bf76b0db

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: iJO00mi5pglap2bW60H1GBGtloYAnC3A
content-encoding: gzip
last-modified: Thu, 09 Apr 2020 15:07:03 GMT
server: AmazonS3
age: 123049
date: Tue, 11 Aug 2020 07:20:29 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=172800
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: cCvCaBPyUxI2-FUln12CPlA3hoZbqRwjlPYDLb19eQ3aDSheWim-fQ==
via: 1.1 375e9ad5042f2098d2251daf2e517c52.cloudfront.net (CloudFront)

POST
H2 200 /
www.facebook.com/tr/ 0
83 B 6ms
6ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKrR5db8mQvvM4dBc

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Wed, 12 Aug 2020 17:31:17 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.reuters.com
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0

GET
H2 200 /
s3.reutersmedia.net/resources/r/ 68 B
458 B 61ms
61ms Image
image/png 13.226.155.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.reutersmedia.net/resources/r/?m=02&d=20170805&t=2&i=8848126477&w=380&fh=&fw=&ll=&pl=&sq=&rtn=LYNNXMPEGQD488&x30y10&r=LIYXPPGG10FT
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.87 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-87.dus51.r.cloudfront.net
Software: ADFCDN/5.2.3 / AdDefend GmbH
Resource Hash: adfa0c7de03bc3bea3de80b4a4514881c8b6296568f43a5acd5cd7a16fffd1c9

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:17 GMT
via: 1.1 92eff4f17f8a434975f912a39f575296.cloudfront.net (CloudFront)
server: ADFCDN/5.2.3
x-amz-cf-pop: DUS51-C1
x-powered-by: AdDefend GmbH
x-cache: Miss from cloudfront
content-type: image/png
status: 200
cache-control: max-age=0, max-stale=0, must-revalidate, no-cache, no-store, no-transform, post-check=0, pre-check=0, private
accept-ranges: bytes
content-length: 68
x-amz-cf-id: yZMi6Qf4c7zdC4ao_6L7TMJOJHJziHByd-18eMf1d9969gsfNFisLA==
expires: 0

GET
H2 200 /
s3.reutersmedia.net/resources/r/adinclude/ 68 B
459 B 48ms
47ms Image
image/png 13.226.155.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.reutersmedia.net/resources/r/adinclude/?m=02&d=20170310&t=2&i=7836132272&w=319&fh=&fw=&ll=&pl=&sq=2&r=GBVPD488.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.87 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-87.dus51.r.cloudfront.net
Software: ADFCDN/5.2.3 / AdDefend GmbH
Resource Hash: adfa0c7de03bc3bea3de80b4a4514881c8b6296568f43a5acd5cd7a16fffd1c9

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:17 GMT
via: 1.1 92eff4f17f8a434975f912a39f575296.cloudfront.net (CloudFront)
server: ADFCDN/5.2.3
x-amz-cf-pop: DUS51-C1
x-powered-by: AdDefend GmbH
x-cache: Miss from cloudfront
content-type: image/png
status: 200
cache-control: max-age=0, max-stale=0, must-revalidate, no-cache, no-store, no-transform, post-check=0, pre-check=0, private
accept-ranges: bytes
content-length: 68
x-amz-cf-id: VN4Xq8KzkMt_kHmZtwc7vwe9ov7K_HX2b6meEeIDVmEVUzVuid1Vlw==
expires: 0

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012007302351000/ Frame D902 206 KB
56 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012007302351000/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68ff86e6a3bc683739e7190e4efaff20bbafe0d89c99c42c1b17163ef5203968

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 7187
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57393
x-xss-protection: 0
server: sffe
date: Wed, 12 Aug 2020 15:31:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "6c9ea7f49fde3b6d"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Aug 2021 15:31:31 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012007302351000/v0/ Frame D902 16 KB
6 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012007302351000/v0/amp-ad-exit-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee1ed7b578e1ef6fc0b4eac9c4f9eaa16f3301fce096666526e9d08e4956bb5d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14369
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5908
x-xss-protection: 0
server: sffe
date: Wed, 12 Aug 2020 13:31:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "da3eb6a12045948e"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Aug 2021 13:31:49 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012007302351000/v0/ Frame D902 96 KB
96 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012007302351000/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41f07eced66e12809bec654b0a18677a78a7814525dcb6b99934d0b4bcecfc4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
x-content-type-options: nosniff
age: 7199
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 98441
x-xss-protection: 0
server: sffe
date: Wed, 12 Aug 2020 15:31:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c56a9dc6dcfd844b"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Aug 2021 15:31:19 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012007302351000/v0/ Frame D902 4 KB
2 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012007302351000/v0/amp-fit-text-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18c44f4e64c66d0c037bfd7ed0c8fae6f4e25f395135d2a6e06aa233f01173f4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14369
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1782
x-xss-protection: 0
server: sffe
date: Wed, 12 Aug 2020 13:31:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9975c81b3db44358"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Aug 2021 13:31:49 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012007302351000/v0/ Frame D902 48 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012007302351000/v0/amp-form-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

187ef47cfc091c4fc645d78e6e4c56951cdd6144e5b9a6adddfacc286f1b1aa6

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14373
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14954
x-xss-protection: 0
server: sffe
date: Wed, 12 Aug 2020 13:31:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "536b0698dfd565aa"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Aug 2021 13:31:45 GMT

GET
DATA 200
OK truncated
/ Frame D902 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 41efcf088758a2d852a64350bb6ba9853b115791e8585f04814d4fe7b775537a

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 7530557268346809456
tpc.googlesyndication.com/simgad/ Frame D902 16 KB
16 KB 11ms
5ms Image
image/png 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7530557268346809456?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4ql2FkBKU8BDjj4lFh73Ns1XPAG9WQ

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dcece3eee3816a5cb34b8742d6255b27a0fefbb5a3d9f0a7c09be9f2ee967839

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 23:30:35 GMT
x-content-type-options: nosniff
last-modified: Wed, 15 Apr 2020 23:54:26 GMT
server: sffe
age: 64843
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16559
x-xss-protection: 0
expires: Wed, 11 Aug 2021 23:30:35 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D902 2 KB
3 KB 10ms
4ms Image
image/png 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 12 Aug 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 22940
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Thu, 13 Aug 2020 11:08:58 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame D902 295 B
519 B 9ms
4ms Image
image/png 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 11 Aug 2020 21:26:58 GMT
x-content-type-options: nosniff
server: cafe
age: 72260
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 12 Aug 2020 21:26:58 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame D902 0
0 18ms
12ms Image
text/html 2a00:1450:4001:800::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ6g_WGVQTXAXIOR5Iu0KMQnwbG21rtD7V_xQSYE2QveO3M4CK29Uw7y97XUxmJ7Uf-R9n-
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2

200

B23768030.267046029;dc_pre=CKzutPGYlusCFdkK4AodhjsP5A;dc_trk_aid=461813821;dc_trk_cid=106332843;ord=2562882285;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=
ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/ Frame D902
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046029;dc_trk_aid=461813821;dc_trk_cid=106332843;ord=2562882285;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046029;dc_pre=CKzutPGYlusCFdkK4AodhjsP5A;dc_trk_aid=461813821;dc_trk_cid=106332843;ord=2562882285;dc_lat=;dc_rdid=;tag...

42 B
117 B

42ms
40ms

Image
image/gif

172.217.23.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046029;dc_pre=CKzutPGYlusCFdkK4AodhjsP5A;dc_trk_aid=461813821;dc_trk_cid=106332843;ord=2562882285;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f134.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:18 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046029;dc_pre=CKzutPGYlusCFdkK4AodhjsP5A;dc_trk_aid=461813821;dc_trk_cid=106332843;ord=2562882285;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame D902 0
0 35ms
29ms Image
text/html 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CgKgEZSc0X-vwH-6Q7_UPv8qdoA2w1YTTXpDpgoekC5_dx9STDhABINqetRVgkYSAgIwYoAHv9Y7bA8gBAuACAKgDAcgDCKoE3AJP0Btu0VhldEdOmHw6OIIAUX2QRRDOcWx2HGh1819rTd0TPvrIraXCziN4LZZXPdTLmshCTsyJiM0FEeKfVxbSJApPtt6i4wkpNdqHl9wV8TDB6BOVvsSL2laWzWfRVaZvS1WP_Juap6O1V2yLhcnVDBaArhTCdkNC9MKlMuBA9zDACTd4yXe9mDYrB72Ccql3g83P5iUrjikaZsbANlnOHbelCIuZE4Sq7HL64JdJyqR_Zsc52VvKnysL9-t9Dus19NbGv7UzeSBHYCTDYejYUgyGrxJonckUPbWFrib2Xe2jZW_544ON4tjijucA1D7rII6kKH8bzXgst5ywwltT3T0TSg7RmN-jdUO9NBe8c6VL4yZpeqgmvLbQkQUU8-p2xyoZ5SEQVvZqQ_7p4OihY2XJdA8UQlB3FVSyeVlRHFFYiABUeP3O6dpfkkacFjaWn6H8VgvmU37lunDABPn__tm5AuAEAZIFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYCgAeetpspqAeOzhuoB9XJG6gHk9gbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcB8gcEEJWbFdIICQiA4YBwEAEYHYAKA8gLAdgTDA&sigh=vmh_4bMdyIc&tpd=AGWhJmtZwICabb99kD012YPHmesS-R6e-3iDF4yD5a2vOcaSPA
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s21-in-f130.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012007302351000/ Frame A280 206 KB
56 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012007302351000/amp4ads-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68ff86e6a3bc683739e7190e4efaff20bbafe0d89c99c42c1b17163ef5203968

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 7187
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57393
x-xss-protection: 0
server: sffe
date: Wed, 12 Aug 2020 15:31:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "6c9ea7f49fde3b6d"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Aug 2021 15:31:31 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012007302351000/v0/ Frame A280 16 KB
6 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012007302351000/v0/amp-ad-exit-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee1ed7b578e1ef6fc0b4eac9c4f9eaa16f3301fce096666526e9d08e4956bb5d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14369
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5908
x-xss-protection: 0
server: sffe
date: Wed, 12 Aug 2020 13:31:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "da3eb6a12045948e"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Aug 2021 13:31:49 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012007302351000/v0/ Frame A280 96 KB
96 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012007302351000/v0/amp-analytics-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41f07eced66e12809bec654b0a18677a78a7814525dcb6b99934d0b4bcecfc4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
x-content-type-options: nosniff
age: 7199
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 98441
x-xss-protection: 0
server: sffe
date: Wed, 12 Aug 2020 15:31:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c56a9dc6dcfd844b"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Aug 2021 15:31:19 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012007302351000/v0/ Frame A280 4 KB
2 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012007302351000/v0/amp-fit-text-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18c44f4e64c66d0c037bfd7ed0c8fae6f4e25f395135d2a6e06aa233f01173f4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14369
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1782
x-xss-protection: 0
server: sffe
date: Wed, 12 Aug 2020 13:31:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "9975c81b3db44358"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Aug 2021 13:31:49 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012007302351000/v0/ Frame A280 48 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012007302351000/v0/amp-form-0.1.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

187ef47cfc091c4fc645d78e6e4c56951cdd6144e5b9a6adddfacc286f1b1aa6

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 14373
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14954
x-xss-protection: 0
server: sffe
date: Wed, 12 Aug 2020 13:31:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "536b0698dfd565aa"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 12 Aug 2021 13:31:45 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame A280 2 KB
2 KB 9ms
9ms Image
image/png 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 12 Aug 2020 11:08:58 GMT
x-content-type-options: nosniff
server: cafe
age: 22940
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Thu, 13 Aug 2020 11:08:58 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame A280 295 B
352 B 9ms
9ms Image
image/png 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 11 Aug 2020 21:26:58 GMT
x-content-type-options: nosniff
server: cafe
age: 72260
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 12 Aug 2020 21:26:58 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 0586 0
0 63ms
56ms Fetch
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvzfMNk9tFqga30Wszi0khNscXS6Zh_E1uWKZUhLWnCDc6kcUMppDBrjxSBj-sJmvrIkdPt0R0gXLmMZMEiUWkAP0a2ZrA4oKD4iKnUN-7AvlnMmuVFsiN-3jhcgy-YaJEqCWmbTNQ_7KClCJoyDIaGJBh0a9wiXpNfUqvAYlLjVbXr3jAPc4kyZPTq1zA4e9yBVJcykMxfwpFZYI4IWuLHUYAaowKIZH8AWTK5GeHZl-lvJwemv_HTU_QEwri8tDVgrVtwmgRSaC-8cEAjloVkod3bfNDwspaLQBl1XDo&sai=AMfl-YTx54BlouE9yXlcaB-VGejM9GjgE5rmTezY1YoL1IxiozGzB0NugzBTZ3XPDxpaoT2-hrQJ-XxQtMsElU75t1Engc4oWZNEZZvl2VfZLJyg0EmC45MozWK5YTfqHTE&sig=Cg0ArKJSzH95cg_m7vslEAE&urlfix=1&adurl=

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f130.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 12 Aug 2020 17:31:18 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2

200

connatix.player.dc.js Show response
cds.connatix.com/p/44384/ Frame 5557
Redirect Chain

https://cd.connatix.com/connatix.player.js
https://cds.connatix.com/p/44384/connatix.player.dc.js

790 KB
197 KB

71ms
21ms

Script
application/javascript

151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/44384/connatix.player.dc.js
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d952926b65e6a3cb04a6354e2db602782ab1c7798696a68a2be636db172fe28

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:18 GMT
content-encoding: gzip
age: 10689
x-cache: MISS, HIT
status: 200
content-length: 201317
x-served-by: cache-dca17740-DCA, cache-fra19179-FRA
access-control-allow-origin: *
last-modified: Wed, 12 Aug 2020 13:59:08 GMT
x-timer: S1597253478.210578,VS0,VE0
etag: "6204132948fdf2a94027e08d50728908"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 0, 416

Redirect headers

date: Wed, 12 Aug 2020 17:31:18 GMT
via: 1.1 varnish
server: Varnish
age: 0
x-served-by: cache-hhn4067-HHN
status: 302
x-cache: HIT
location: https://cds.connatix.com/p/44384/connatix.player.dc.js
cache-control: no-cache, no-store, must-revalidate, max-age=0
accept-ranges: bytes
x-timer: S1597253478.123858,VS0,VE0
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0586 73 KB
28 KB 47ms
42ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c516c523ffceafbf9482017d73bbcea30b998c15ca9de148fc00514561daaf67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1597059737948561"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28328
x-xss-protection: 0
expires: Wed, 12 Aug 2020 17:31:18 GMT

GET
H2 200 moatad.js Show response
z.moatads.com/reutersdfpcw319687550988/ Frame 0586 307 KB
103 KB 64ms
20ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/reutersdfpcw319687550988/moatad.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 11558e1d027dc06afd27bf2613c169508a497d802019b0d97c417097977f00e8

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:18 GMT
content-encoding: gzip
last-modified: Wed, 29 Jul 2020 14:58:25 GMT
server: AmazonS3
x-amz-request-id: BG9K8M4R4Y0TAP5G
etag: "06798e04d86839b070d5ea052c4d21a3"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=15169
accept-ranges: bytes
content-length: 105048
x-amz-id-2: zst4dKaas28W96jowbKuRm6OPVp5nJt47hLgz+S8KX/vVonDWjgcLIwhU7G1P5Oan4udWHV8Qfw=

GET
H2 200 9938980806239715977
tpc.googlesyndication.com/simgad/ Frame A280 29 KB
29 KB 11ms
6ms Image
image/png 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9938980806239715977?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmuX_FzdfmTTGXGTxXkeYitP1RsuA

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90b3597e6f85a0ae3a0c80b4e8a9754f111799b513f24153e8d4905428d986e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 23:53:03 GMT
x-content-type-options: nosniff
last-modified: Tue, 25 Sep 2018 18:18:48 GMT
server: sffe
age: 63495
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29357
x-xss-protection: 0
expires: Wed, 11 Aug 2021 23:53:03 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame A280 0
0 17ms
13ms Image
text/html 2a00:1450:4001:800::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ88b2WLz9gdfr1UgYBaulL2f_p4kaMNyFXlyrCZnk0Z0CLPDj138fDvqi7zoNOE4NH4g1d
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2

200

B23768030.267046119;dc_pre=CIr2tfGYlusCFdXJuwgdz6ML8g;dc_trk_aid=461813884;dc_trk_cid=106332843;ord=520064935;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=
ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/ Frame A280
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046119;dc_trk_aid=461813884;dc_trk_cid=106332843;ord=520064935;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046119;dc_pre=CIr2tfGYlusCFdXJuwgdz6ML8g;dc_trk_aid=461813884;dc_trk_cid=106332843;ord=520064935;dc_lat=;dc_rdid=;tag_...

42 B
106 B

41ms
40ms

Image
image/gif

172.217.23.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046119;dc_pre=CIr2tfGYlusCFdXJuwgdz6ML8g;dc_trk_aid=461813884;dc_trk_cid=106332843;ord=520064935;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Requested by

Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s18-in-f134.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:18 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
content-type: text/html; charset=UTF-8
location: https://ad.doubleclick.net/ddm/trackimp/N790339.3167285ADWORDSGDN/B23768030.267046119;dc_pre=CIr2tfGYlusCFdXJuwgdz6ML8g;dc_trk_aid=461813884;dc_trk_cid=106332843;ord=520064935;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adview
securepubads.g.doubleclick.net/pagead/ Frame A280 0
0 34ms
30ms Image
text/html 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Czu9cZSc0X-zwH-6Q7_UPv8qdoA3miJbMXqidg4ekC5aCzYWIFhABINqetRVgkYSAgIwYoAHv9Y7bA8gBAuACAKgDAcgDCKoE2wJP0HIIVMW_lqetK39G764Tl5XOWoHDNO6iNqQMzqpiAORjd9YDCGzls28_ZUFgjKcfU2BBZrj8WOLTJlzD84wjTr-5c6BjgsXODNWju2Cz2MFqy-slW-xwFFIyvHjVIgu5i9Jz7fazsJwCMzDUaYJ9ZzheoSCbcCfRFX3TQJGgm3i1-mAPQa3nryvwQkNdT2vAi0FRfnRpblJgPC7PFB8SffpzV4ylnCwJtptlLoVcgkBrXTibXqelk6ryW2Ijs_i7Hwx9W0LfbTNt6Iw8QDugIQrIDN06BbwSd5FAtQyDUGL6MTRCqHf8BULilY5SPm2nKor5rZ_ozyDsg5ywvcgm1MwZAc1UriyFKr3so5-rtQpRa-Pv9f9mZRgClwMoAZibaVhZnlrlukDGjxK4U1QOzOmbiZiG22n355-cY5AqVd9Et1UpYc62QxfaR4UX7npXTP1JWIpvdoHNBMAEk8m34eAB4AQBkgUECAQYAZIFBAgFGASgBgKAB562mymoB47OG6gH1ckbqAeT2BuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQ-tFP0ggJCIDhgHAQARgdgAoDyAsB2BMM&sigh=Vu2j5axTd1k&tpd=AGWhJmsZg6TgBLS6q1qprSPZz6C4_61sGhFroqdfAdyjvScDJA
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s21-in-f130.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame A280 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1253f6c1d343b2fd89eefacc4e67d08d0ae9340678d0e5423df63ea97b624d37

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4806613891 Show response
dfp-gateway.s-onetag.com/1/4735792/ 114 B
574 B 78ms
27ms XHR
application/json 13.226.155.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dfp-gateway.s-onetag.com/1/4735792/4806613891
Requested by: Host: get.s-onetag.com
URL: https://get.s-onetag.com/4ed1416f-67eb-4d50-8a45-916a5921fee8/tag.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.2 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-2.dus51.r.cloudfront.net
Software: /
Resource Hash: 698a0d14189cdfa590d112b056e978324c551080f63a9e0b340b6f1b204af296

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 21:29:16 GMT
via: 1.1 94faae20b0f122c4555025f52a2fd745.cloudfront.net (CloudFront), 1.1 a67be963c7536322e9a591e428e62d28.cloudfront.net (CloudFront)
age: 72122
x-amzn-requestid: 02dd074b-2651-4fab-8a47-4fa23157ae1e
status: 200
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=86400, public
x-amzn-trace-id: Root=1-5f330dac-c571860c2ee6660424b5f9ec;Sampled=0
x-amz-cf-pop: FRA6-C1, DUS51-C1
x-amz-apigw-id: RH8TAGA2CYcFxVg=
content-length: 114
x-amz-cf-id: iZyWuH63LxgbJoNiDPNUdSUjJzlaEhs7nHWYw8Vng3IXLw5qRCjLow==

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 71 KB
26 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

394415bedb33f0d07d610f1ac10439e12098d7a747aca0510cddabca81a9092d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1597059737948561"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27037
x-xss-protection: 0
expires: Wed, 12 Aug 2020 17:31:18 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
6 KB 19ms
19ms XHR
application/json 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020080601&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2db864bbf87c2db7c76dcfc3284324bcd1e91dc8d2408785e3f0cefc5c2984ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 12 Aug 2020 17:31:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6464
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
5 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080601.js?21067064

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1591403518460474"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5540
x-xss-protection: 0
expires: Wed, 12 Aug 2020 17:31:18 GMT

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame D902
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

52ms
39ms

Image
text/html

2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Wed, 12 Aug 2020 17:31:18 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 0586 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0701f3d2b39af708c94348a444db7dec1f2cf56c84d64a32949095bc7882cc54

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 jload Show response
pixel.adsafeprotected.com/ Frame 4D4A 46 KB
13 KB 111ms
48ms Script
application/javascript 52.18.153.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/jload?anId=10764&campId=1100x420&pubId=20159232&chanId=247866432&placementId=4806613891&pubCreative=138288736159&pubOrder=453477432&cb=1762126263&custom=connatix&custom2=20000&custom3=0&adsafe_par&impId=
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.153.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-153-122.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 443d25a3f4a31ce582faeb456f92c537122a6bd2a8cc8aa28b1f5a1021d3a85f

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:18 GMT
content-encoding: gzip
x-server-name: app15.ie.303net.net
status: 200
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame A280
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

41ms
38ms

Image
text/html

2a00:1450:4001:815::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Wed, 12 Aug 2020 17:31:18 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H2 200 n.js Show response
geo.moatads.com/ 112 B
286 B 73ms
24ms Script
text/html 35.178.2.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=9lH%3C%25.iCG&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=REUTERSDFPCW3&hp=1&wf=1&vb=4&cm=9&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1597253478263&de=70370805508&m=0&ar=2bf682d4aa-clean&iw=4490aac&q=2&cb=0&ym=0&cu=1597253478263&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=20159232%3A453477432%3A4806613891%3A138288736159&zMoatTP=connatix&zMoatStory=0&zMoatAU=%2F4735792%2Fus.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&zMoatPixelDistance=20000&zMoatRawSlicer1=3735912&zMoatRawSlicer2=247866432&zMoatReutersSlicer1=3735912&zMoatReutersSlicer2=247866432&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&id=1&ii=4&bo=3735912&bd=247866432&zMoatOrigSlicer1=3735912&zMoatOrigSlicer2=247866432&dfp=0%2C1&la=247866432&gw=reutersdfpcw319687550988&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A262%3A356%3A1867%3A463&fs=183324&na=1431239192&cs=0&callback=DOMlessLLDcallback_63946150
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/reutersdfpcw319687550988/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.178.2.28 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: TornadoServer/4.5.3 /
Resource Hash: ae2b7e87301f31c3a27704ab37bf7f80711b20c5b0e56e14c299fa67e76b34b3

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:18 GMT
server: TornadoServer/4.5.3
etag: "4a5ba8f5e29816a06efc8d7363c3dbf648bf2e9f"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 112

GET
H2 200 n.js Show response
geo.moatads.com/ 112 B
286 B 72ms
25ms Script
text/html 35.178.2.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=9lH%3C%25.iCG&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=REUTERSDFPCW3&hp=1&wf=1&vb=4&cm=9&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1597253478263&de=70370805508&m=0&ar=2bf682d4aa-clean&iw=4490aac&q=3&cb=0&ym=0&cu=1597253478263&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=20159232%3A453477432%3A4806613891%3A138288736159&zMoatTP=connatix&zMoatStory=0&zMoatAU=%2F4735792%2Fus.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&zMoatPixelDistance=20000&zMoatRawSlicer1=3735912&zMoatRawSlicer2=247866432&zMoatReutersSlicer1=3735912&zMoatReutersSlicer2=247866432&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&id=1&ii=4&bo=3735912&bd=247866432&zMoatOrigSlicer1=3735912&zMoatOrigSlicer2=247866432&dfp=0%2C1&la=247866432&gw=reutersdfpcw319687550988&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A262%3A356%3A1867%3A463&fs=183324&na=478901881&cs=0&callback=MoatDataJsonpRequest_63946150
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/reutersdfpcw319687550988/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.178.2.28 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: TornadoServer/4.5.3 /
Resource Hash: fe286a0d42dee5a69eabb786aae8a4524718c7fa275a6449ca372c4e6eda30df

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:18 GMT
server: TornadoServer/4.5.3
etag: "b82e6ab101cfb83d398f186f53733497621a20b2"
content-type: text/html; charset=UTF-8
status: 200
cache-control: max-age=900
timing-allow-origin: *
content-length: 112

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 0586 0
54 B 56ms
56ms Image
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssr3nHBEZY1uBzGiIlrhbTVJylcE69k0RYhPsgTEDQ8MN9iwuVytNWY1Kuql76q82U0xrAj3fmcb2PJEDIr0Q3hrCno2U4WNkxhGEgFNONarmdYFo2OEqWPRv8Va_w3to8BiSntB6XEEl-f5wEYhH0rBpuDRMlkVEtk9A_JkraSR3VnH-qF6hKgGF05ymrQM-J5l6dYf__IXg7sMBGjA604DMWICVFZ2RzuEQXTm8fjEBUL0GD5ICLwN5fLX6pzo_YjufiKlv19sG5hqy55loVnqjam7z9Eu4uwoOtgKErPhw&sai=AMfl-YTOkMhqeRHUopX5tAF5NpO-vObfBcPg8Ur99LwRJcc14L8pBKm-ogJvdzUEerjhOWE7rFjatLKJuLV9CCXPoQa_u7mczYZQ-K2m5VGe-t2iQQNy2Q2pOdkWn2wpOUw&sig=Cg0ArKJSzPGo7tFV0Th6EAE&urlfix=1&adurl=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s21-in-f130.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 12 Aug 2020 17:31:18 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame 566E 0
0 8ms
7ms Document
text/html 2a00:1450:4001:825::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/210/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 4590
date: Wed, 12 Aug 2020 16:37:48 GMT
expires: Thu, 12 Aug 2021 16:37:48 GMT
last-modified: Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3210
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 main.gr.19.8.111.js Show response
static.adsafeprotected.com/ Frame 4D4A 172 KB
55 KB 36ms
13ms Script
application/javascript 2600:9000:2182:4e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.gr.19.8.111.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=10764&campId=1100x420&pubId=20159232&chanId=247866432&placementId=4806613891&pubCreative=138288736159&pubOrder=453477432&cb=1762126263&custom=connatix&custom2=20000&custom3=0&adsafe_par&impId=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2182:4e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 34cdb6307b099bbbbe4bd77a40fc926d20d665f864aa629a060a8348eeb1df58

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 15:21:00 GMT
content-encoding: gzip
age: 94218
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
last-modified: Tue, 11 Aug 2020 15:04:59 GMT
server: AmazonS3
etag: W/"fc8b8074cb052ac77c1348a5b1d26a7a"
vary: Accept-Encoding
x-amz-version-id: mbfh50bvtCpFumq34uSouA0rbdqMfBTn
via: 1.1 3e9b9356decf1aa720af0bc92acc0586.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
x-amz-cf-id: r2qdXwWmbgQQT6l2eoeJsBbOObMtyMCl5_1j3HI8ANatnd2p3Tn14w==

GET
H2 200 connatix.player.css
cds.connatix.com/p/44384/ 49 KB
8 KB 23ms
20ms Stylesheet
text/css 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/44384/connatix.player.css
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/44384/connatix.player.dc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ce2ba098bd8570d95c60d33cc035ee6764193c8ff7e0d7a531d0e1e98e9ad592

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:18 GMT
content-encoding: gzip
age: 10689
x-cache: HIT, HIT
status: 200
content-length: 8095
x-served-by: cache-dca17732-DCA, cache-fra19179-FRA
access-control-allow-origin: *
last-modified: Wed, 12 Aug 2020 13:59:09 GMT
x-timer: S1597253478.492140,VS0,VE0
etag: "880884ab75ace2385f14bd369f4ab798"
vary: Accept-Encoding
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 3, 476

POST
H/1.1 200
OK pls Show response
capi.connatix.com/core/ Frame 5557 3 KB
2 KB 436ms
119ms XHR
multipart/form-data 3.136.223.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/pls?v=44384
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/44384/connatix.player.dc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.136.223.216 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: bbb02681146a2e5bb88f8b76c336ea722e4ddad3318acd20a8fb408e69926dd9

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 12 Aug 2020 17:31:18 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.reuters.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1375

GET
H2 200 sca.17.4.114.js Show response
static.adsafeprotected.com/ Frame 6557 81 KB
22 KB 9ms
9ms Script
application/javascript 2600:9000:2182:4e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.4.114.js
Requested by: Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2182:4e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ad9ae0374e0334d2511e951a2381a164fa87ce86594fc027d25a8624774c3c96

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 30 Jun 2020 05:16:22 GMT
content-encoding: gzip
age: 3759297
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
last-modified: Mon, 13 Jan 2020 23:54:54 GMT
server: AmazonS3
vary: Accept-Encoding
x-amz-version-id: gSPddsS9N0PGtUp2YQy7vCAfLQOR874Z
via: 1.1 3e9b9356decf1aa720af0bc92acc0586.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: DUS51-C1
content-type: application/javascript
x-amz-cf-id: qGpz6sZxfp2W9TMMQW84nTQM9cfyMEAxCuyP7buG1aNu1G4sUx4stQ==

GET
H2 200 mon
pixel.adsafeprotected.com/ 43 B
215 B 37ms
36ms Image
image/gif 52.18.153.122
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.adsafeprotected.com/mon?anId=10764&campId=1100x420&pubId=20159232&chanId=247866432&placementId=4806613891&pubCreative=138288736159&pubOrder=453477432&cb=1762126263&custom=connatix&custom2=20000&custom3=0&adsafe_par&impId=&adsafe_url=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&adsafe_type=abdfq&adsafe_jsinfo=,id:340d439f-ecea-c615-a65d-4dd7e0734e2c,c:lchvBc,sl:outOfView,em:true,fr:true,mn:app15ie,pt:1-5-15,wc:0.0.1600.1200,ac:258.3769.1100.420,am:i,cc:258.3769.1100.420,piv:0,obst:0,th:0,reas:l,br:u,abv:na,an:n,oam:0,scm:publ1.grpm1,fm:s7tmOO4+11|12|13|14|15|16|17|18|19|1a|1b|1c*.10764|1c1|1c2|1d|1e1,idMap:1c*,pl:,rmeas:1,rend:1,renddet:DIV.qs.sn,es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,tt:jload,thd:1,et:111,oid:a1639c14-dcc1-11ea-9dfc-0a320acf4edc,v:19.8.111,sp:1,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.18.153.122 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-18-153-122.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:18 GMT
x-server-name: app11.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
status: 200
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
308 B 43ms
13ms Image
image/gif 104.244.39.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10764&asId=340d439f-ecea-c615-a65d-4dd7e0734e2c&tv={c:lchvBe,pingTime:-8,time:112,type:l,es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:0,o:112,n:0,pp:0,pm:0},slEvents:[{sl:o,t:109,wc:0.0.1600.1200,ac:258.3769.1100.420,am:i,cc:258.3769.1100.420,piv:0,obst:0,th:0,reas:l,bkn:{piv:[23~0],as:[23~1100.420]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:s7tmOO4+11|12|13|14|15|16|17|18|19|1a|1b|1c*.10764|1c1|1c2|1d|1e1,idMap:1c*,rmeas:1,rend:1,renddet:DIV.qs.sn}&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: amidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 12 Aug 2020 17:31:18 GMT
X-Server-Name: dt46ami.ami.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
308 B 45ms
18ms Image
image/gif 104.244.39.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10764&asId=340d439f-ecea-c615-a65d-4dd7e0734e2c&tv={c:lchvBE,pingTime:-2,time:138,type:a,im:{sf:0,pom:1,prf:{beA:253,beZ:254,mfA:337,cmA:338,inA:338,inZ:346,prA:347,prZ:354,si:363,poA:365,poZ:378,cmZ:378,mfZ:378,loA:383,loZ:388,ltA:390,ltZ:390}},sca:{dfp:{df:4,sz:1100.420,dom:div}},env:{cca:true,ccd:{version:1,uspString:1---},gca:true,gca2:false},clog:[{piv:0,vs:o,r:l,w:1100,h:420,t:110}],es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:0,o:138,n:0,pp:0,pm:0},slEvents:[{sl:o,t:109,wc:0.0.1600.1200,ac:258.3769.1100.420,am:i,cc:258.3769.1100.420,piv:0,obst:0,th:0,reas:l,bkn:{piv:[49~0],as:[49~1100.420]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:s7tmOO4+11|12|13|14|15|16|17|18|19|1a|1b|1c*.10764|1c1|1c2|1d|1e1,idMap:1c*,rmeas:1,rend:1,renddet:DIV.qs.sn,slid:[google_ads_iframe_/4735792/us.reuters/tentpoles/cyberrisk/article_2,google_ads_iframe_/4735792/us.reuters/tentpoles/cyberrisk/article_2__container__,dpslot_connatix_13552233_USKCN24W25W,USKCN24W25W],sinceFw:25,readyFired:true}&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: amidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 12 Aug 2020 17:31:18 GMT
X-Server-Name: dt66ami.ami.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
308 B 15ms
14ms Image
image/gif 104.244.39.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10764&asId=340d439f-ecea-c615-a65d-4dd7e0734e2c&tv={c:lchvCi,time:178,type:e,env:{ar:self.0},es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:0,o:178,n:0,pp:0,pm:0},slEvents:[{sl:o,t:109,wc:0.0.1600.1200,ac:258.3769.1100.420,am:i,cc:258.3769.1100.420,piv:0,obst:0,th:0,reas:l,bkn:{piv:[89~0],as:[89~1100.420]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:59,fm:s7tmOO4+11|12|13|14|15|16|17|18|19|1a|1b|1c*.10764|1c1|1c2|1d|1e1,idMap:1c*,rmeas:1,rend:1,renddet:DIV.qs.sn}&br=u
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: amidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 12 Aug 2020 17:31:18 GMT
X-Server-Name: dt46ami.ami.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
55 B 42ms
42ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gpt_2020080601&jk=4038856931383289&bg=!29il2MBY-KnjqFfL3qECAAAAbFIAAAAPmQHF9fe8PH3RpHScMX0ASH0AaWKYf3KT1JvIPMEijfpvDw0prcpHt2Xwb_LU9SHe-kkklVVsPLf-wnp347fpliVXjXvYDm6xNOs9DClWSTZ73OoSoFoC6W1ubSkqybhf5fE0bAWgOZGfwEHtY0QjJ-cWAxVL6AdlGGurMrmPH2gZlRtXWDRoS1iZglHq2MDoN2FHC4kd5fl670dUnMEOpkNgzrA-Qy1-hEahfItMs0w6QsCQEiHMGuY1qea8D9GEsY2j3k7uChrlZ8TfwnVejK0D74ilOD8ImmwLUeMgwaYC---cimJaautJ9Xn_7ittwUb6rK36SVi5GHfHX8AdsqDyhu1raVnjH0s8qHz1rkIjiydxwRMaCI7KHVHcxXtzK-0pKvOiYDxbbRLDtZFFJ9coLGQWf0ndFG7CNGz6HG24STvB5QTJRo2hksFsjvzFyz9C12YVnF8yFk4gNXtdhNpQiJcGWueX50yWew_3y9B0hVbXnsiQSzbixHubU621zVdpBdGbqQ3F2mXlJX6MAa3ZpIXSJuqMqsnN7LSHyza0qF05ep8w81FuVQKF_nGig5iD4c2rPrzI9BYAjy_d5dsGdUrMF9PM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
308 B 14ms
14ms Image
image/gif 104.244.39.20
ADSAFE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=10764&asId=340d439f-ecea-c615-a65d-4dd7e0734e2c&tv={c:lchvGw,pingTime:-10,time:440,type:s,mvn:ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--,fsc:17.4.114v220002022000220000022002222000022220202020222220222220002222022002222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022202220020222222000220000222202222202222000002002002222222222220022202200222002220222202,sd:MTcuNC4xMTR2MTIwMHx8MTYwMHx8MXx8MXx8MjR8fDEyMDB8fDB8fDB8fDF8fGxhbmRzY2FwZS1wcmltYXJ5fHwyNHx8NC8zfHw0LzN8fDB8fDE2MDA-,no:MTcuNC4xMTR2TW96aWxsYXx8TmV0c2NhcGV8fG58fDE2fHxufHwwfHxufHxMaW51eCB4ODZfNjR8fEdlY2tvfHwyMDAzMDEwN3x8LTEyMHx8TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,asp:1597253478878||e99b18b2addb72de5545ae3f9fc34ed2||71ff54ebddb1e090fbf173d96e2342c8||d3802428165979a3d91cb82ee53bd619||87366d4613acdd432b63406915399f80||f9f9b6c131ccf0da01ef2a021396aa64||583e3a3d703bc0f6cec9281d7332ab12||8d3fd2d960f10e18e0196afd03aa3ce7||1576000828}
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS: amidt.adsafeprotected.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 12 Aug 2020 17:31:18 GMT
X-Server-Name: dt46ami.ami.303net.pvt
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Server: nginx

GET
H2 200 connatix.player.css
cds.connatix.com/p/44384/ Frame 0586 49 KB
8 KB 22ms
21ms Stylesheet
text/css 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/44384/connatix.player.css
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/44384/connatix.player.dc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ce2ba098bd8570d95c60d33cc035ee6764193c8ff7e0d7a531d0e1e98e9ad592

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:18 GMT
content-encoding: gzip
age: 10689
x-cache: HIT, HIT
status: 200
content-length: 8095
x-served-by: cache-dca17732-DCA, cache-fra19179-FRA
access-control-allow-origin: *
last-modified: Wed, 12 Aug 2020 13:59:09 GMT
x-timer: S1597253479.976690,VS0,VE0
etag: "880884ab75ace2385f14bd369f4ab798"
vary: Accept-Encoding
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 3, 477

POST
H/1.1 200
OK sr Show response
capi.connatix.com/tr/ Frame 5557 0
324 B 474ms
119ms XHR
multipart/form-data 3.136.223.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sr?v=44384
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/44384/connatix.player.dc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.136.223.216 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 12 Aug 2020 17:31:19 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.reuters.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 2_media.bin Show response
vid.connatix.com/527c8473-6656-49ea-aa01-5c870b9999f4/ Frame 5557 626 B
737 B 63ms
20ms XHR
application/octet-stream 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/527c8473-6656-49ea-aa01-5c870b9999f4/2_media.bin
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/44384/connatix.player.dc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 5b548c55cb99a60bc5d2ed82331220dd5363894f1d0f6a98900b486ce9e85d3b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:19 GMT
content-encoding: gzip
age: 19734
x-cache: HIT, HIT
status: 200
content-length: 473
x-served-by: cache-bwi5150-BWI, cache-fra19148-FRA
last-modified: Wed, 12 Aug 2020 10:14:12 GMT
x-timer: S1597253479.119409,VS0,VE0
etag: "27a89cdf78269413f6c8725934546be9"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 5

GET
DATA 200
OK truncated
/ Frame 0586 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 0586 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

POST
H/1.1 200
OK ps Show response
capi.connatix.com/tr/ Frame 5557 0
324 B 428ms
108ms XHR
multipart/form-data 3.136.223.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ps?v=44384
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/44384/connatix.player.dc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.136.223.216 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 12 Aug 2020 17:31:19 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.reuters.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK ao Show response
capi.connatix.com/tr/ Frame 5557 0
324 B 444ms
119ms XHR
multipart/form-data 3.136.223.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ao?v=44384
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/44384/connatix.player.dc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.136.223.216 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 12 Aug 2020 17:31:19 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.reuters.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 1_th.jpg
img.connatix.com/527c8473-6656-49ea-aa01-5c870b9999f4/ Frame 0586 15 KB
15 KB 28ms
21ms Image
image/webp 151.101.14.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/527c8473-6656-49ea-aa01-5c870b9999f4/1_th.jpg?crop=755:425,smart&width=755&height=425&format=jpeg&quality=60&fit=crop
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: eaad44637697425c5c17e2f974faf574cd5d522e2410405fa462331e4b79a313

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 17:31:19 GMT
via: 1.1 varnish, 1.1 varnish
age: 19768
x-cache: HIT, HIT
fastly-io-info: ifsz=90313 idim=2562x1440 ifmt=jpeg ofsz=15142 odim=755x425 ofmt=webp
status: 200
fastly-stats: io=1
content-encoding: gzip
content-length: 15165
x-served-by: cache-dca17724-DCA, cache-fra19179-FRA
x-timer: S1597253479.166172,VS0,VE1
etag: "+y83qt+C6ti64aLGZ2xKT8hLAQe6wDBjyPXlPJvNgXI"
vary: Accept
x-amz-request-id: 4137AC3EA453C855
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 2, 1

GET
H2 200 pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 43 B
253 B 26ms
24ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=95&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=reuters.com&L1id=20159232&L2id=453477432&L3id=4806613891&L4id=138288736159&S1id=3735912&S2id=247866432&ord=1597253478263&r=70370805508&t=meas&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:19 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 12 Aug 2020 17:31:19 GMT

GET
H2 200 pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 43 B
253 B 26ms
24ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=95&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=reuters.com&L1id=20159232&L2id=453477432&L3id=4806613891&L4id=138288736159&S1id=3735912&S2id=247866432&ord=1597253478263&r=70370805508&t=nht&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:19 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 12 Aug 2020 17:31:19 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame D902 42 B
107 B 41ms
41ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvko5cqkuepJbJuxTa0QgPkffXR7Besz_3HkPLXit5hKLsufTwpAIxuQ1LfmesDbgLpPBCfs4gPDxkddTDvt8KdRbz5cV4qftxATRQBwMzcOC5q7n8G2DTpYh6ueQ&sai=AMfl-YTqZGDQF3VvDz155xN4ev_iTbHf8x9KYCvTAqtY42SX0ZqbsNUzSmCUtdcLQLGheA4Pb18EgCaHSL0NCgLzPUsMt54ixb_Xyh37RcMd6jU0QFecR8IOpUhjVPCMrZA&sig=Cg0ArKJSzF7ngqpyD0sAEAE&cid=CAASPeRo4841mXaDsQThCbCiMpuUs3_cOwiG-LxMFq2cXSw4gj9kfKrG62KcFmwVW2vuixSoAKcnE8rXdk5UTBw&id=ampim&o=1140,686&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=314&tls=1314&g=100&h=100&tt=1314&r=v&avms=ampa&adk=1450972129

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame A280 42 B
107 B 40ms
40ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss93ccAVjGp0AVEC2ioM9wbBC7Ur_MQexPipXL1Iv4Oay4LTZefim-ikk7yq7q0ytkoAJS9l-4yL9ICnIwHRqyGnqjqRllI5PAHEXwpGPHZHaJ4RAiGfGL5lUUhSw&sai=AMfl-YRQxsmva2mSbJHR29lLSzgCRjBopyY_vtjQPzXriFIMABNt9AZnD2SgrLL-HfMpI2HkskkEOcBZwwvxIOOJHF7u7my9_QRUrGxd1UZlLjyOoxRqWR4OmeWnWVp-3Ag&sig=Cg0ArKJSzECOAyC8LHqXEAE&cid=CAASPeRokxNlDoomhy-dtzM1EgAw8rcikt6oDfDaQtUjBQLlwukAli-dN2vpmjcpE5ieUjt8I9gdQATY9kdDLg8&id=ampim&o=315,92&d=970,250&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,0,1001,1001&tos=0,0,0,1001,0&tfs=267&tls=1268&g=100&h=100&tt=1268&r=v&avms=ampa&adk=4268771640

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reuters.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 43 B
253 B 19ms
19ms Image
image/gif 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=201&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=reuters.com&L1id=20159232&L2id=453477432&L3id=4806613891&L4id=138288736159&S1id=3735912&S2id=247866432&ord=1597253478263&r=70370805508&t=hdn&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 12 Aug 2020 17:31:19 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: Apache
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Wed, 12 Aug 2020 17:31:19 GMT

POST
H/1.1 200
OK st Show response
capi.connatix.com/tr/ Frame 5557 0
324 B 124ms
123ms XHR
multipart/form-data 3.136.223.216
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/st?v=44384
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/44384/connatix.player.dc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.136.223.216 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Wed, 12 Aug 2020 17:31:26 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://www.reuters.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 / Show response
onetag-geo.s-onetag.com/ 24 B
437 B 72ms
23ms XHR
application/json 13.226.155.49
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://onetag-geo.s-onetag.com/
Requested by: Host: beacon.s-onetag.com
URL: https://beacon.s-onetag.com/beacon.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.49 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-49.dus51.r.cloudfront.net
Software: /
Resource Hash: acf0d68ace16960596de6a16a94def58b49d82dc01e5f1a91c9affbdd206259f

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 21:59:56 GMT
via: 1.1 d3039ad83798b26ecb9f9f1e666afe27.cloudfront.net (CloudFront), 1.1 2395e6175733260a159a0b484ed8febd.cloudfront.net (CloudFront)
age: 70291
x-amzn-requestid: 976aaa33-ab5f-4805-89e0-98d5aa20f4c5
status: 200
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: FRA6-C1, DUS51-C1
x-amz-apigw-id: RIAyfECTiYcFULw=
content-length: 24
x-amz-cf-id: 5BqHhr3SSxFF2AvPAKYk-FSjFpbQMGP-ogPrCbAUha6guh14HUl-8w==

GET
H2 200 EU Show response
onetag-geo-grouping.s-onetag.com/regionalbloc/ 1 KB
831 B 78ms
31ms XHR
application/json 13.226.155.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://onetag-geo-grouping.s-onetag.com/regionalbloc/EU
Requested by: Host: beacon.s-onetag.com
URL: https://beacon.s-onetag.com/beacon.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.42 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-42.dus51.r.cloudfront.net
Software: restify /
Resource Hash: 6088012dda2274a27fa40ed153d9e3a6c96a22af1b177f8a2916368eb3e88bb0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 22:03:50 GMT
content-encoding: gzip
server: restify
age: 70057
status: 200
vary: Accept-Encoding,origin
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: https://www.reuters.com
access-control-expose-headers: api-version, content-length, content-md5, content-type, date, request-id, response-time
cache-control: max-age=86400
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: UCwogX5jC1XCqWhM3GkRR0KYKiLK4WM8ImLIxX18WTCkQWBpj0ny7Q==
via: 1.1 88bc7a9e54e3765a2fd64d3e80cc8217.cloudfront.net (CloudFront)

GET
H2 200 EU Show response
onetag-geo-grouping.s-onetag.com/regionalbloc/ 1 KB
830 B 78ms
31ms XHR
application/json 13.226.155.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://onetag-geo-grouping.s-onetag.com/regionalbloc/EU
Requested by: Host: beacon.s-onetag.com
URL: https://beacon.s-onetag.com/beacon.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.42 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-42.dus51.r.cloudfront.net
Software: restify /
Resource Hash: 6088012dda2274a27fa40ed153d9e3a6c96a22af1b177f8a2916368eb3e88bb0

Request headers

Referer: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 22:03:50 GMT
content-encoding: gzip
server: restify
age: 70057
status: 200
vary: Accept-Encoding,origin
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: https://www.reuters.com
access-control-expose-headers: api-version, content-length, content-md5, content-type, date, request-id, response-time
cache-control: max-age=86400
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: W5M4W9b1fVJRSsY54As3cqCjwtKM8xIXRK-mKQiZgS7SzK8z9XT2Wg==
via: 1.1 88bc7a9e54e3765a2fd64d3e80cc8217.cloudfront.net (CloudFront)

Verdicts & Comments Add Verdict or Comment

193 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.reuters.com/	1970-01-19 21:09:41	Name: _cb Value: CqZp0h6WFYABvjR26
.reuters.com/	1970-01-19 11:40:53	Name: _gat Value: 1
.reuters.com/	1970-01-19 13:50:29	Name: _fbp Value: fb.1.1597253477186.1594276672
.reuters.com/	1970-01-20 05:12:05	Name: xbc Value: %7Bjzx%7DaDgHBcHto3SYFqkc2Wn5DAKZUnPR0slugavoMmFiGkDNq308yMxi-925TxHVYBHKQcmpUc6u5Js4Rxes92m4vDkd-8Aoj3bt9xJ6HnTtWlq3ukhZaEQ3wgo34yCsLGmdO6N1WgooRoOz6fL-h1EiMw
www.reuters.com/	1970-01-19 11:40:55	Name: _cb_svref Value: null
.reuters.com/	1970-01-19 11:42:19	Name: __pvi Value: %7B%22id%22%3A%22v-2020-08-12-19-31-16-772-1S898dP2tp6qAHGb-6aaa2b71454066fe37c59fd6bf532167%22%2C%22domain%22%3A%22.reuters.com%22%2C%22time%22%3A1597253477002%7D
.reuters.com/	1970-01-19 11:42:19	Name: _gid Value: GA1.2.346266412.1597253476
.reuters.com/	1970-01-19 12:24:05	Name: __pat Value: -14400000
www.reuters.com/	1970-01-19 21:09:41	Name: _chartbeat2 Value: .1597253477570.1597253477570.1.CAGq5fBtZxQ7DUJdVCCGIGPN8qAl8.1
www.reuters.com/	1969-12-31 23:59:59	Name: mnet_session_depth Value: 1%7C1597253476906
.reuters.com/	1970-01-20 05:12:05	Name: __tbc Value: %7Bjzx%7Dyo9xUxAKwg32SeQvuAZGbVnQ2IOPMb9-Vk75l5Tp2HV8hGzrlf_KCTpj3eD5_E_7N7vtCa3UOpBcH9sTTeeK-c-vON8K50qv9hrBcCbKZapq5-uVHIbgjhxqQLLhazNbHzyVzbU0qDL8Htc3rl51Vg
.reuters.com/	1970-01-19 20:26:29	Name: ajs_user_id Value: %225e0e520d-5538-4149-8ae1-f23275027d77%22
www.reuters.com/	1970-01-19 20:26:29	Name: usprivacy Value: 1---
.reuters.com/	1970-01-19 20:26:29	Name: ajs_anonymous_id Value: %225e0e520d-5538-4149-8ae1-f23275027d77%22
.reuters.com/	1970-01-20 05:12:05	Name: _ga Value: GA1.2.1909816365.1597253476
www.reuters.com/	1970-01-19 21:09:41	Name: _cb_ls Value: 1

20 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 14) Message: Init Bootstrap with config [object Object]
console-api	log	URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 7) Message: BODY ITEMS [object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 14) Message: ###### ias setup complete
console-api	log	(Line 1) Message: Blocking Ads: No
console-api	log	(Line 1) Message: comscore new global fired
console-api	log	URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 7) Message: us !@!@
console-api	log	URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 14) Message: [object Object]
console-api	log	URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 7) Message: bootstrap getResults: [object Object]
console-api	log	URL: https://www.dianomi.com/js/videofeed-combined.js?id=123(Line 17) Message: videoAd id 4729 el [object HTMLDivElement] data [object Object]
console-api	log	URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 14) Message: Setup media.net with GDPR consent declined
console-api	log	URL: https://www.dianomi.com/js/videofeed-combined.js?id=123(Line 17) Message: IO Script Loaded
console-api	log	URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 14) Message: GPT SET ADMANTX: AccentureAPAC_Negative,Artificial_Intelligence,Barclays,Barclays_2,Boeing_Neg,BofA_Neg,BofA_Neg_Topics,CME_Negative,Cognizant_Coronavirus_3,DIT_Negative_kw1,DWA-Cisco-Coronavirus,Exxon_Negative,FRB,GoldmanSachs,IBM,JPMorgan_Neg,JuliusBaer2020_FinancialPlanning-2,MSFT_Neg,MarcusUSDeposits_1,Mobkoi_FB_Negative,Negative_Keywords_3.2,SaudiAramco_Negative,TradeWeb_AiEx,WorkdayPG_Neg
console-api	log	URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 14) Message: GPT SET FOR NON-PERSONALIZED ADS
console-api	log	URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 14) Message: GPT SET FOR RESTRICTED DATA PROCESSING
console-api	log	URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 14) Message: GPT ENABLE SERVICES
console-api	log	(Line 2) Message: segment identify user with traits: [object Object]
console-api	log	URL: https://www.dianomi.com/js/videofeed-combined.js?id=123(Line 17) Message: Don't know what it is
console-api	info	URL: https://cdn.ampproject.org/rtv/012007302351000/amp4ads-v0.js(Line 422) Message: Powered by AMP ⚡ HTML – Version 2007302351000 https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
console-api	info	URL: https://cdn.ampproject.org/rtv/012007302351000/amp4ads-v0.js(Line 422) Message: Powered by AMP ⚡ HTML – Version 2007302351000 https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
console-api	debug	URL: https://static.adsafeprotected.com/sca.17.4.114.js(Line 32) Message: a: 0.002197265625ms

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
adservice.google.com
adservice.google.de
api.segment.io
b16cdb5aef2c277f8dbd85c3c47d37a3.safeframe.googlesyndication.com
beacon.s-onetag.com
beacon.tru.am
c.evidon.com
capi.connatix.com
cd.connatix.com
cdn.adsafeprotected.com
cdn.ampproject.org
cdn.segment.com
cdn.tinypass.com
cdneu-xch.media.net
cdnjs.cloudflare.com
cds.connatix.com
code.jquery.com
connect.facebook.net
contextual.media.net
dfp-gateway.s-onetag.com
dt.adsafeprotected.com
evidon.mgr.consensu.org
experience.tinypass.com
geo.moatads.com
get.s-onetag.com
googleads.g.doubleclick.net
gwiqcdn.globalwebindex.net
iabmap.evidon.com
img.connatix.com
l.betrad.com
mab.chartbeat.com
onetag-geo-grouping.s-onetag.com
onetag-geo.s-onetag.com
pagead2.googlesyndication.com
ping.chartbeat.net
pixel.adsafeprotected.com
queso-cdn.prod.reuters.tv
reutersdfpcw319687550988.s.moatpixel.com
s.mnet-ad.net
s.ytimg.com
s3.reutersmedia.net
s4.reutersmedia.net
sb.scorecardresearch.com
securepubads.g.doubleclick.net
sope.prod.reuters.tv
static.adsafeprotected.com
static.chartbeat.com
static.reuters.com
stats.g.doubleclick.net
tpc.googlesyndication.com
tru.am
usasync01.admantx.com
vendorlist.consensu.org
vid.connatix.com
www.dianomi.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.reuters.com
www.youtube.com
z.moatads.com
104.108.64.33
104.18.22.230
104.244.39.20
13.226.132.149
13.226.155.108
13.226.155.12
13.226.155.2
13.226.155.40
13.226.155.42
13.226.155.49
13.226.155.87
13.226.155.95
151.101.114.137
151.101.14.137
172.217.23.134
2.20.168.134
2001:4de0:ac19::1:b:2b
216.58.212.130
23.210.250.213
23.210.250.97
23.62.140.165
2406:da00:ff00::36eb:b8ea
2600:1f18:624f:b000:1a0c:44be:c431:52fe
2600:9000:2182:4e00:8:48e:53c0:93a1
2600:9000:2182:9000:1:af78:4c0:93a1
2600:9000:2182:9800:10:27b4:f500:93a1
2600:9000:2182:ac00:1e:ef1b:aa40:93a1
2600:9000:2182:ca00:5:9a4c:9b00:93a1
2600:9000:2182:ea00:18:1fcd:34e:d2a1
2606:4700:20::ac43:4af5
2606:4700::6811:4f6b
2606:4700::6811:b8b1
2a00:1450:4001:800::2004
2a00:1450:4001:808::200e
2a00:1450:4001:809::2002
2a00:1450:4001:814::200e
2a00:1450:4001:815::2002
2a00:1450:4001:818::200e
2a00:1450:4001:819::2001
2a00:1450:4001:81a::2003
2a00:1450:4001:821::2008
2a00:1450:4001:825::2001
2a00:1450:400c:c00::9b
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a04:4e42:1b::714
3.136.223.216
3.222.135.156
35.178.2.28
35.201.93.216
52.18.153.122
52.73.105.22
52.73.249.152
54.201.25.196
66.81.204.228
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
0301abe27c75fe3b60eff31ce1d31238c9b84d4f36c037bacf0a8656b6a6fb45
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0541539bf2c978c0ddec342e71cdeeb6c741a149356dcf13a01ae4217d28e46b
05570487bb3f6249f82ffaaf817889dc909225f80ae76d6f0e6c864465b8304f
0701f3d2b39af708c94348a444db7dec1f2cf56c84d64a32949095bc7882cc54
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
09c52e5ea3fdb1ac6d74bf9c68a5411ae21355fb33afd30b8b37c434c3338e2a
0d515df3e388295626386b0bf5648159150cd59fdb24bc67613ed5eb45bbf255
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11558e1d027dc06afd27bf2613c169508a497d802019b0d97c417097977f00e8
1253f6c1d343b2fd89eefacc4e67d08d0ae9340678d0e5423df63ea97b624d37
12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254
15b35c3833a358a2d4da3777fc699f98434d8ad633f05f18b0189ff9425d6ec6
187ef47cfc091c4fc645d78e6e4c56951cdd6144e5b9a6adddfacc286f1b1aa6
18c44f4e64c66d0c037bfd7ed0c8fae6f4e25f395135d2a6e06aa233f01173f4
1a2d26aecdfb8347c3be47a4dc55576c78dd9f422a40cd17f86b0b640c043d79
21a22ffbb31ae72c9efc1970ad750dc83454831721ca163bc6cda04dae21a7d7
24f519f7817feefd7089793570fae9a93825d0f9ec17900e3ac446088d59b0bb
25adad9ca79b728ee179d70f9f9251b37634f92ddc1421d1e4204b1fbad4e303
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff
2db864bbf87c2db7c76dcfc3284324bcd1e91dc8d2408785e3f0cefc5c2984ce
3234a9f00027b349b802fae240f760a270d6f4e7f39ecee827e77c3e282f7846
33a31901a144a24e7f7153b2ec965007bb58abea0129ec9e7691d468f959569b
34cdb6307b099bbbbe4bd77a40fc926d20d665f864aa629a060a8348eeb1df58
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
38f82a586c4984fdc89697da37dac16d17ed9c1d619510ed32991778b3e21b26
394415bedb33f0d07d610f1ac10439e12098d7a747aca0510cddabca81a9092d
39699ef2ff7f4cfc54b00ba69dbc53473370396c94a44cb770e2e6fb09310168
3c0d27b79bfe51d6abbc99eb79bd7731804fa80823d85bce422ee364185c6126
3c514d4fb8244af230a89d2203522c6a67a55a3f161cfd4fca9f53301c0588ff
41efcf088758a2d852a64350bb6ba9853b115791e8585f04814d4fe7b775537a
443d25a3f4a31ce582faeb456f92c537122a6bd2a8cc8aa28b1f5a1021d3a85f
45610b21279531a97f9566b0f0f8a1d287a45ae4bc6bc545971af5cd7e393cc6
4d952926b65e6a3cb04a6354e2db602782ab1c7798696a68a2be636db172fe28
4dfb7c925e9a341c587ecc6af346f2cf875c63da4609858353eed31324e7ac48
4ed44c518b79ec0c24d13803371365e67d6ca02829631e0dad366850fd466044
5275e53dca9e7f8cb2741c3e11050df06b6d9167b088dbd8e0ce59052aa97556
52dc24c0429ea6ccc5b579a6da8bb79bf41e471fe5108a62009f3c2e195551c0
54138d578ed166d5381db70b3dd14a16830233553b6e4213402bae2fdb0564b4
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5b548c55cb99a60bc5d2ed82331220dd5363894f1d0f6a98900b486ce9e85d3b
5b7f1d50686983d3d751139bc9df0993a4ee1bb13ec568193ec24ace5e8a304a
600000022cb36ca9bbf4e52a1132f413e4c92d72905c080429b1cf8e8f30caa7
6088012dda2274a27fa40ed153d9e3a6c96a22af1b177f8a2916368eb3e88bb0
61c564503fd8c3d2e54685465eaac1999b423c7a7c85fc40f6ac16fc95b44110
62c155232156eb11fcfd2db27dc8304f7c2fd810da25bfa7740ef28b0b156f88
631b052c0fac425fdea5a7a644d5e3554283675424c4c95003960e8fa96f6060
6346ee09058d555984eb04aac881775c926b5d9d4f73ca91493f7cb708ed90df
68ff86e6a3bc683739e7190e4efaff20bbafe0d89c99c42c1b17163ef5203968
698a0d14189cdfa590d112b056e978324c551080f63a9e0b340b6f1b204af296
6aa7c3edbc1ee1fe66d4db0fea18aa2d0bbe0dfae05d228c9ffeeaeacb6f1c53
6d2fabee27b52615cbaf082c6978c5011db4561b641e93c7211656938bb37eb2
6d2fe32d253b1c23c584887a2d05bba8d56ad3b233081d190be436c70209ead2
6e198633e8651d2d219b18b644b77c8fac327d010d3d792be5d741f5bed10ff7
6f23d93c9b8e3ca26f6fcc6be6a8d087e43a3f5795daa3c61017071642f66f3c
6f4ae319a9f80c61a3c9734248d8be481ae430185443f3b2747bc1b4f617cc8f
70503c92bcbb8105d95ec4de2012f23098c3383586e95323e4b3384b56af4beb
70cbe9dc327ec05a4738577250c3a149b4f760bb6417b2a2fd29f6e7068e779e
71877bfc934e838ceb6e2541f2a2f114beb843b4019bffd9cbafd722cba405b3
731ebb6e8eb86eb45b6e7269a9374d1ac90533bfca3a81774dfe51f84fee2f92
7464555aae6d8d87b77f7170fba1698ff64f7454ded58627ca1819246e9a9969
78d7768fb1213eced669894455aac7c1bfb17452b25ef69859ab7617cb85856f
7962dce1427363ac8964c27e8a221d2b6f320fa55f7e32df3508b288d99ff915
7a093c39bdbf0571cc22c594df90ec9f5b114be57bd9f565a192fa07545562f2
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
893df2b9ceb653f94333139d561d363bf4c365e651a0a3ade839d96200942e37
8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde
8cbd1097e867ef0f8cadea9c9df71dbce6ee4dbd817a5e72d6e467365cb10a60
8eb04f497f623ad4df1e207d4b1abaca12374d493dd3145a60ebc2bde02c8c62
90b3597e6f85a0ae3a0c80b4e8a9754f111799b513f24153e8d4905428d986e4
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
99781410070a5dd4d753fdb8a46f4272082b5be64541dcfcb1b2d3c4aea09c6c
9b133863146a5f391e8cee0842cafc7498ae89b6f79edbecfc842055342c1fe2
9c5bec97b9c707f3668bac58b61a576000c0cf7ec406e797e108977c41c475c3
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9f9104dee58871cdb561e4f139fcf095a2fc1fcb0a7778a964975e6b12059c6a
a0d3888abf73b5e53c7204fa4243b586d4c21bdad65b4f64fce8e45d731b5e36
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
acf0d68ace16960596de6a16a94def58b49d82dc01e5f1a91c9affbdd206259f
ad590c30e8e0ef2b2539b0f1a7e4e4da38a6a7b2a8b3f88048338c22da590253
ad9ae0374e0334d2511e951a2381a164fa87ce86594fc027d25a8624774c3c96
adfa0c7de03bc3bea3de80b4a4514881c8b6296568f43a5acd5cd7a16fffd1c9
ae2b7e87301f31c3a27704ab37bf7f80711b20c5b0e56e14c299fa67e76b34b3
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b403c1fba06a7a1a66d7106a0aab1c8a7618c0d62dcf3475d10bd4bd9666ea06
b530d2f33467c65e254999ed904332bc40a5aa25c750229790295f6742938b6f
b5771462426214dd38f38352be4e5018e2d479df771d17d87723969efab65a49
ba607af2c8d414ab6d4bac90c526d90a939cb0adf507b6ba063265347479159d
bb56e9cb6a9934d4d3c871e6aa711d2168e0c74c02cc3388539fe50e57091dca
bbb02681146a2e5bb88f8b76c336ea722e4ddad3318acd20a8fb408e69926dd9
bd1dc64fac45e75fffefbd76f176c6ea118ab79b88b3efddc5642d4e7c76d4fe
bf3669795bba5ee81c6defbeb24c48986d4693233ce0964138e897363527c3af
c1acfa727754dab58bedc79995a642e235c6fde6449824c4fba4318fc060c91c
c516c523ffceafbf9482017d73bbcea30b998c15ca9de148fc00514561daaf67
c8567ea9f657a5f2ea1633ec26b13de309f60f0921a278db2a9be91d2e48984e
ca16dd3adebfcc177d21d8fe9fa1f3f1659479394e1c142b27d96cba5bf85058
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ce2ba098bd8570d95c60d33cc035ee6764193c8ff7e0d7a531d0e1e98e9ad592
ce6828b72f5cb1fdabed21ccca94c6250685131bfc448a9daf163f2b311a531d
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfd0da29a6d34ea44fb0035a3a1b409a4a66c091fb0f143ea2f73a643c3f8cef
d27b59be0fa35fd199035fb3d095a553cf11e6c7b44d583b2942650fc3da5977
d4fa79afcf5a5cc5a0f12dedaf825f11530e6397d723fe7044cd37ba3c248e57
d640ed39630d91dec61dcb107b977293ec29fecbb5e74467e017d872bf76b0db
d7d62426c6b87d35cef5c2c873355aa44edffcf4a7f927f1c51b10694ea4f6ed
dadad940eacc6f93ddfc5fc68a4c5defd950c54c7e731d2826b8ba953da9c321
dcece3eee3816a5cb34b8742d6255b27a0fefbb5a3d9f0a7c09be9f2ee967839
deebd915997d1fc20b8c17b0ac9e57a20b84cb44a54858b18d0ad0ee6ea51f5a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e41f07eced66e12809bec654b0a18677a78a7814525dcb6b99934d0b4bcecfc4
e58b5f1ec0b366d5af022fc6580f518062cd5de023870bb4881cc7936cb4da06
eaad44637697425c5c17e2f974faf574cd5d522e2410405fa462331e4b79a313
ee0768f9d2def8b13df284410776f5d755109e77b5c0ca17d8895f65b343a0cd
ee1ed7b578e1ef6fc0b4eac9c4f9eaa16f3301fce096666526e9d08e4956bb5d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f01d25f7a76e0682a7a43230c32bef653eaf28b8a6f7a683ebb88bf8c6aa4f50
f37beed085d2cfdd1386a8942434d8011aa20f2e7afa20d7edfd0d49998da1e7
f98c6888132dbe656a610be0519b16b6cc2aa4c9356e6788f55f91b2737c8de8
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955
fe286a0d42dee5a69eabb786aae8a4524718c7fa275a6449ca372c4e6eda30df

www.reuters.com Open in urlscan Pro 13.226.155.95 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

164 Requests

100 %HTTPS

47 %IPv6

37 Domains

65 Subdomains

54 IPs

8 Countries

3146 kBTransfer

8783 kBSize

16 Cookies

25 Outgoing links

Redirected requests

164 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.reuters.com Open in urlscan Pro
13.226.155.95 Public Scan

Screenshot
Live screenshot

Full Image

164
Requests

100 %
HTTPS

47 %
IPv6

37
Domains

65
Subdomains

54
IPs

8
Countries

3146 kB
Transfer

8783 kB
Size

16
Cookies

164 HTTP transactions
10 data transactions