www.cyberark.com Open in urlscan Pro
104.16.15.87 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Submission: On January 31 via api (January 31st 2024, 2:09:56 am UTC) from TR — Scanned from DE

Summary HTTP 319 Redirects Links 47 Behaviour Indicators

Summary

This website contacted 72 IPs in 7 countries across 58 domains to perform 319 HTTP transactions. The main IP is 104.16.15.87, located in and belongs to CLOUDFLARENET, US. The main domain is www.cyberark.com. The Cisco Umbrella rank of the primary domain is 321785.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on January 28th 2024. Valid for: a year.

This is the only time www.cyberark.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 31	104.16.15.87 104.16.15.87	13335 (CLOUDFLAR...) (CLOUDFLARENET)
28	99.86.4.13 99.86.4.13	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:80e::2008	15169 (GOOGLE) (GOOGLE)
9	2600:9000:215... 2600:9000:2156:9a00:12:53a8:95c0:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
8	2a02:26f0:480... 2a02:26f0:480:980::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2600:9000:249... 2600:9000:2490:400:18:15b9:5a80:93a1	16509 (AMAZON-02) (AMAZON-02)
8	2a04:4e42:400... 2a04:4e42:400::644	54113 (FASTLY) (FASTLY)
2	34.111.234.236 34.111.234.236	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	184.31.85.59 184.31.85.59	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
3	52.209.137.59 52.209.137.59	16509 (AMAZON-02) (AMAZON-02)
12	2.17.100.184 2.17.100.184	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	104.122.39.154 104.122.39.154	16625 (AKAMAI-AS) (AKAMAI-AS)
10	13.225.78.35 13.225.78.35	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:600... 2a04:4e42:600::396	54113 (FASTLY) (FASTLY)
7	2600:1f18:e8a... 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a	14618 (AMAZON-AES) (AMAZON-AES)
6	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1 1	52.212.233.39 52.212.233.39	16509 (AMAZON-02) (AMAZON-02)
1	66.235.152.225 66.235.152.225	15224 (OMNITURE) (OMNITURE)
2	151.101.1.140 151.101.1.140	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:400c:c0b::9a	15169 (GOOGLE) (GOOGLE)
2 5	2a00:1450:400... 2a00:1450:4001:81c::2004	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
1	54.161.243.53 54.161.243.53	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:9000:211... 2600:9000:211e:5a00:1e:c86:4140:93a1	16509 (AMAZON-02) (AMAZON-02)
5	192.28.146.116 192.28.146.116	15224 (OMNITURE) (OMNITURE)
13	52.222.236.129 52.222.236.129	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	143.204.98.35 143.204.98.35	16509 (AMAZON-02) (AMAZON-02)
1 3	185.89.210.82 185.89.210.82	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a02:26f0:480... 2a02:26f0:480:23::1726:629c	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 4	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1 2	216.58.206.34 216.58.206.34	15169 (GOOGLE) (GOOGLE)
2	2600:9000:236... 2600:9000:236e:5600:3:471f:5240:93a1	16509 (AMAZON-02) (AMAZON-02)
1	18.245.86.6 18.245.86.6	16509 (AMAZON-02) (AMAZON-02)
69	18.245.86.87 18.245.86.87	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:480... 2a02:26f0:480:f::213:7edd	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f08... 2a03:2880:f083:9:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
4	2600:9000:206... 2600:9000:206f:e600:2:8f43:5780:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	142.250.181.230 142.250.181.230	15169 (GOOGLE) (GOOGLE)
4	3.77.28.166 3.77.28.166	16509 (AMAZON-02) (AMAZON-02)
2	35.204.89.238 35.204.89.238	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	52.210.45.0 52.210.45.0	16509 (AMAZON-02) (AMAZON-02)
4 5	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2600:9000:211... 2600:9000:211e:fe00:1e:c86:4140:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f17... 2a03:2880:f177:185:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
19 25	35.204.158.49 35.204.158.49	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:9000:211... 2600:9000:211e:b400:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
2 3	46.228.174.117 46.228.174.117	56396 (AMOBEE) (AMOBEE)
1	13.248.245.213 13.248.245.213	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f18:612... 2600:1f18:612b:4280:c452:8a8b:24f9:dc81	14618 (AMAZON-AES) (AMAZON-AES)
1 2	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	52.58.65.170 52.58.65.170	16509 (AMAZON-02) (AMAZON-02)
1 1	3.122.71.237 3.122.71.237	16509 (AMAZON-02) (AMAZON-02)
1	52.222.214.69 52.222.214.69	16509 (AMAZON-02) (AMAZON-02)
2 2	2600:1901:0:8... 2600:1901:0:8eee::	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	3.71.149.231 3.71.149.231	16509 (AMAZON-02) (AMAZON-02)
1 2	54.78.254.47 54.78.254.47	16509 (AMAZON-02) (AMAZON-02)
1	52.54.120.189 52.54.120.189	14618 (AMAZON-AES) (AMAZON-AES)
1	92.123.17.8 92.123.17.8	16625 (AKAMAI-AS) (AKAMAI-AS)
1	99.80.224.8 99.80.224.8	16509 (AMAZON-02) (AMAZON-02)
1	99.80.4.3 99.80.4.3	16509 (AMAZON-02) (AMAZON-02)
1	35.244.174.68 35.244.174.68	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
1	63.140.62.27 63.140.62.27	15224 (OMNITURE) (OMNITURE)
1 2	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
1	13.225.83.200 13.225.83.200	16509 (AMAZON-02) (AMAZON-02)
10	50.16.7.188 50.16.7.188	14618 (AMAZON-AES) (AMAZON-AES)
1	2a04:4e42:8d:... 2a04:4e42:8d::720	54113 (FASTLY) (FASTLY)
319	72

31 104.16.15.87 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.cyberark.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 99.86.4.13 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-13.fra6.r.cloudfront.net

content.cdntwrk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80e::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2600:9000:2156:9a00:12:53a8:95c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cihost.uberflip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:26f0:480:980::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2490:400:18:15b9:5a80:93a1 (United States)

ASN16509 (AMAZON-02, US)

ob.segreencolumn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a04:4e42:400::644 (United States)

ASN54113 (FASTLY, US)

fast.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.234.236 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 236.234.111.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.31.85.59 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-31-85-59.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.209.137.59 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-209-137-59.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cyberark.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2.17.100.184 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-100-184.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.122.39.154 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-122-39-154.deploy.static.akamaitechnologies.com

sjrtp6-cdn.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rtp-static.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 13.225.78.35 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-35.fra2.r.cloudfront.net

consent.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

obs.segreencolumn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.212.233.39 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-233-39.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.235.152.225 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-66-235-152-225.data.adobedc.net

cyberark.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.1.140 (United States)

ASN54113 (FASTLY, US)

conversions-config.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0b::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:81c::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

316-czp-275.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.161.243.53 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-161-243-53.compute-1.amazonaws.com

in.ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211e:5a00:1e:c86:4140:93a1 (United States)

ASN16509 (AMAZON-02, US)

embed-ssl.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 192.28.146.116 (United States)

ASN15224 (OMNITURE, US)

sjrtp6.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 52.222.236.129 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-129.fra56.r.cloudfront.net

consent-pref.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.35 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-35.fra50.r.cloudfront.net

consent-st.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.89.210.82 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:23::1726:629c (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.206.34 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: mil07s07-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:236e:5600:3:471f:5240:93a1 (United States)

ASN16509 (AMAZON-02, US)

pipedream.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.86.6 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-6.fra60.r.cloudfront.net

distillery.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

69 18.245.86.87 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-86-87.fra60.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:f::213:7edd (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:9:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:206f:e600:2:8f43:5780:93a1 (United States)

ASN16509 (AMAZON-02, US)

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.230 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f6.1e100.net

9920016.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.77.28.166 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-77-28-166.eu-central-1.compute.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.204.89.238 (Groningen, Netherlands)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 238.89.204.35.bc.googleusercontent.com

tag.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.210.45.0 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-45-0.eu-west-1.compute.amazonaws.com

cnv.event.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:1ec:21::14 (United States) 4 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:211e:fe00:1e:c86:4140:93a1 (United States)

ASN16509 (AMAZON-02, US)

embed-cloudfront.wistia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f177:185:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 35.204.158.49 (Groningen, Netherlands) 19 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 49.158.204.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211e:b400:1b:5138:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 46.228.174.117 (United Kingdom) 2 redirects

ASN56396 (AMOBEE, GB)

sync.1rx.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.targeting.unrulymedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.248.245.213 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4280:c452:8a8b:24f9:dc81 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

simplifi.partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.111.113.62 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.58.65.170 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-65-170.eu-central-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.122.71.237 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-122-71-237.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.214.69 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-69.fra56.r.cloudfront.net

sync.intentiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:1901:0:8eee:: (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)

fei.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.71.149.231 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.78.254.47 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-78-254-47.eu-west-1.compute.amazonaws.com

loadm.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.54.120.189 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-120-189.compute-1.amazonaws.com

sync.bfmio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 92.123.17.8 (Düsseldorf, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a92-123-17-8.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.80.224.8 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-99-80-224-8.eu-west-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.80.4.3 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-99-80-4-3.eu-west-1.compute.amazonaws.com

ce.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.226 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.62.27 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-63-140-62-27.data.adobedc.net

cyberark.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.197.193.217 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.83.200 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-83-200.fra2.r.cloudfront.net

d1eoo1tco6rr5e.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 50.16.7.188 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-7-188.compute-1.amazonaws.com

bootstrap.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
metrics.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
event.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
targeting.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:8d::720 (United States)

ASN54113 (FASTLY, US)

driftt.imgix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
69	driftt.com js.driftt.com — Cisco Umbrella Rank: 5691	784 KB
31	cyberark.com 1 redirects www.cyberark.com — Cisco Umbrella Rank: 321785	485 KB
28	cdntwrk.com content.cdntwrk.com — Cisco Umbrella Rank: 66228	2 MB
27	simpli.fi 19 redirects tag.simpli.fi — Cisco Umbrella Rank: 4450 i.simpli.fi — Cisco Umbrella Rank: 3825 um.simpli.fi — Cisco Umbrella Rank: 856	12 KB
24	trustarc.com consent.trustarc.com — Cisco Umbrella Rank: 3330 consent-pref.trustarc.com — Cisco Umbrella Rank: 14899 consent-st.trustarc.com — Cisco Umbrella Rank: 36750	570 KB
15	wistia.com fast.wistia.com — Cisco Umbrella Rank: 4275 embed-ssl.wistia.com — Cisco Umbrella Rank: 8202 pipedream.wistia.com — Cisco Umbrella Rank: 6517 distillery.wistia.com — Cisco Umbrella Rank: 6443 embed-cloudfront.wistia.com	555 KB
13	6sc.co j.6sc.co — Cisco Umbrella Rank: 5532 c.6sc.co — Cisco Umbrella Rank: 8403 ipv6.6sc.co — Cisco Umbrella Rank: 5709 b.6sc.co — Cisco Umbrella Rank: 3792	23 KB
10	drift.com bootstrap.api.drift.com — Cisco Umbrella Rank: 6594 metrics.api.drift.com — Cisco Umbrella Rank: 6499 event.api.drift.com — Cisco Umbrella Rank: 7186 targeting.api.drift.com — Cisco Umbrella Rank: 6822	11 KB
10	doubleclick.net 5 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 79 googleads.g.doubleclick.net — Cisco Umbrella Rank: 38 9920016.fls.doubleclick.net — Cisco Umbrella Rank: 745916 cm.g.doubleclick.net — Cisco Umbrella Rank: 260	6 KB
9	marketo.com sjrtp6-cdn.marketo.com — Cisco Umbrella Rank: 104702 rtp-static.marketo.com — Cisco Umbrella Rank: 18076 sjrtp6.marketo.com — Cisco Umbrella Rank: 93981	91 KB
9	uberflip.com cihost.uberflip.com — Cisco Umbrella Rank: 101301	323 KB
8	segreencolumn.com ob.segreencolumn.com — Cisco Umbrella Rank: 31394 obs.segreencolumn.com — Cisco Umbrella Rank: 25988	39 KB
8	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 460	105 KB
7	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 2 region1.analytics.google.com — Cisco Umbrella Rank: 2616 adservice.google.com — Cisco Umbrella Rank: 98	1 KB
6	linkedin.com 4 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 349 www.linkedin.com — Cisco Umbrella Rank: 632 px4.ads.linkedin.com — Cisco Umbrella Rank: 6550	5 KB
6	google.de www.google.de — Cisco Umbrella Rank: 6518	771 B
6	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	21 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	407 KB
4	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 3101	9 KB
4	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 3810	12 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 28	185 KB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 225	137 KB
3	adnxs.com 1 redirects secure.adnxs.com — Cisco Umbrella Rank: 490 ib.adnxs.com — Cisco Umbrella Rank: 253	3 KB
3	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 239 cyberark.demdex.net — Cisco Umbrella Rank: 395867	5 KB
3	ml314.com ml314.com — Cisco Umbrella Rank: 1870 in.ml314.com — Cisco Umbrella Rank: 10729	12 KB
2	adsrvr.org 1 redirects insight.adsrvr.org — Cisco Umbrella Rank: 637	234 B
2	exelator.com 1 redirects loadm.exelator.com — Cisco Umbrella Rank: 1780	2 KB
2	yahoo.com 1 redirects cms.analytics.yahoo.com — Cisco Umbrella Rank: 1388 ups.analytics.yahoo.com — Cisco Umbrella Rank: 358	382 B
2	pro-market.net 2 redirects fei.pro-market.net — Cisco Umbrella Rank: 2267	844 B
2	agkn.com 2 redirects aa.agkn.com — Cisco Umbrella Rank: 544 d.agkn.com — Cisco Umbrella Rank: 776	1 KB
2	tapad.com 1 redirects pixel.tapad.com — Cisco Umbrella Rank: 501	1 KB
2	1rx.io 2 redirects sync.1rx.io — Cisco Umbrella Rank: 547	712 B
2	bidr.io 1 redirects cnv.event.prod.bidr.io — Cisco Umbrella Rank: 9111	1 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 174	70 KB
2	googleadservices.com 1 redirects www.googleadservices.com — Cisco Umbrella Rank: 145	2 KB
2	reddit.com conversions-config.reddit.com — Cisco Umbrella Rank: 673835 alb.reddit.com — Cisco Umbrella Rank: 1450	1 KB
2	omtrdc.net cyberark.tt.omtrdc.net — Cisco Umbrella Rank: 755677 cyberark.sc.omtrdc.net — Cisco Umbrella Rank: 318405	1 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3596	6 KB
1	imgix.net driftt.imgix.net — Cisco Umbrella Rank: 15838	3 KB
1	cloudfront.net d1eoo1tco6rr5e.cloudfront.net	667 B
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 524	264 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 381	239 B
1	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 451	98 B
1	lijit.com ce.lijit.com — Cisco Umbrella Rank: 859	205 B
1	crwdcntrl.net bcp.crwdcntrl.net — Cisco Umbrella Rank: 898	265 B
1	bluekai.com stags.bluekai.com — Cisco Umbrella Rank: 940	446 B
1	bfmio.com sync.bfmio.com — Cisco Umbrella Rank: 1716	421 B
1	intentiq.com sync.intentiq.com — Cisco Umbrella Rank: 880
1	tremorhub.com simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 6546	175 B
1	3lift.com eb2.3lift.com — Cisco Umbrella Rank: 412	140 B
1	unrulymedia.com sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1373	378 B
1	smaato.net s.ad.smaato.net — Cisco Umbrella Rank: 662	237 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	185 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 783	16 KB
1	mktoresp.com 316-czp-275.mktoresp.com — Cisco Umbrella Rank: 712654	318 B
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1278	517 B
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1335	9 KB
1	gstatic.com fonts.gstatic.com	48 KB
319	58

	Domain	Requested by
69	js.driftt.com	www.cyberark.com js.driftt.com
31	www.cyberark.com	1 redirects www.cyberark.com content.cdntwrk.com
28	content.cdntwrk.com	www.cyberark.com content.cdntwrk.com
25	um.simpli.fi	19 redirects
13	consent-pref.trustarc.com	consent.trustarc.com consent-pref.trustarc.com www.cyberark.com
10	consent.trustarc.com	www.cyberark.com consent.trustarc.com
9	b.6sc.co	www.cyberark.com
9	cihost.uberflip.com	www.cyberark.com cihost.uberflip.com
8	fast.wistia.com	www.cyberark.com cihost.uberflip.com fast.wistia.com
8	assets.adobedtm.com	www.cyberark.com assets.adobedtm.com
7	obs.segreencolumn.com	ob.segreencolumn.com www.cyberark.com
6	www.google.de	www.cyberark.com
6	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
5	sjrtp6.marketo.com	sjrtp6-cdn.marketo.com rtp-static.marketo.com
5	www.google.com	2 redirects www.cyberark.com
5	www.googletagmanager.com	www.cyberark.com www.googletagmanager.com www.google-analytics.com ob.segreencolumn.com
4	targeting.api.drift.com	js.driftt.com
4	px.ads.linkedin.com	3 redirects snap.licdn.com
4	tags.srv.stackadapt.com	www.cyberark.com tags.srv.stackadapt.com
4	nexus.ensighten.com	www.googletagmanager.com nexus.ensighten.com
4	googleads.g.doubleclick.net	2 redirects www.googletagmanager.com
4	fonts.googleapis.com	www.cyberark.com cihost.uberflip.com
4	cdnjs.cloudflare.com	www.cyberark.com cdnjs.cloudflare.com
3	embed-cloudfront.wistia.com	fast.wistia.com
3	rtp-static.marketo.com	sjrtp6-cdn.marketo.com
2	event.api.drift.com	js.driftt.com
2	metrics.api.drift.com	js.driftt.com
2	bootstrap.api.drift.com	js.driftt.com
2	insight.adsrvr.org	1 redirects d1eoo1tco6rr5e.cloudfront.net
2	cm.g.doubleclick.net	2 redirects
2	ib.adnxs.com	1 redirects
2	loadm.exelator.com	1 redirects
2	fei.pro-market.net	2 redirects
2	pixel.tapad.com	1 redirects
2	sync.1rx.io	2 redirects
2	cnv.event.prod.bidr.io	1 redirects
2	9920016.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	connect.facebook.net	www.cyberark.com connect.facebook.net
2	pipedream.wistia.com	fast.wistia.com
2	www.googleadservices.com	1 redirects www.googletagmanager.com
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	j.6sc.co	www.googletagmanager.com j.6sc.co
2	dpm.demdex.net	assets.adobedtm.com www.cyberark.com
2	munchkin.marketo.net	www.cyberark.com munchkin.marketo.net
2	ml314.com	www.cyberark.com ml314.com
1	driftt.imgix.net
1	d1eoo1tco6rr5e.cloudfront.net	nexus.ensighten.com
1	cyberark.sc.omtrdc.net	assets.adobedtm.com
1	us-u.openx.net
1	pixel.rubiconproject.com
1	idsync.rlcdn.com
1	ce.lijit.com
1	bcp.crwdcntrl.net
1	stags.bluekai.com
1	sync.bfmio.com
1	ups.analytics.yahoo.com
1	cms.analytics.yahoo.com	1 redirects
1	sync.intentiq.com
1	d.agkn.com	1 redirects
1	aa.agkn.com	1 redirects
1	simplifi.partners.tremorhub.com
1	eb2.3lift.com
1	sync.targeting.unrulymedia.com
1	s.ad.smaato.net
1	www.facebook.com
1	adservice.google.com	9920016.fls.doubleclick.net
1	i.simpli.fi	tag.simpli.fi
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	tag.simpli.fi	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	distillery.wistia.com	fast.wistia.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	consent-st.trustarc.com	consent-pref.trustarc.com
1	region1.analytics.google.com	www.googletagmanager.com
1	embed-ssl.wistia.com	www.cyberark.com
1	in.ml314.com	ml314.com
1	316-czp-275.mktoresp.com	munchkin.marketo.net
1	alb.reddit.com	www.cyberark.com
1	conversions-config.reddit.com	www.redditstatic.com
1	cyberark.tt.omtrdc.net	assets.adobedtm.com
1	cm.everesttech.net	1 redirects
1	cyberark.demdex.net	assets.adobedtm.com
1	www.redditstatic.com	www.cyberark.com
1	sjrtp6-cdn.marketo.com	www.cyberark.com
1	fonts.gstatic.com	fonts.googleapis.com
1	ob.segreencolumn.com	www.cyberark.com
319	89

This site contains links to these domains. Also see Links.

Domain
cyberark-customers.force.com
cyberark.com
labs.cyberark.com
careers.cyberark.com
www.conjur.org
docs.cyberark.com
www.facebook.com
twitter.com
www.linkedin.com
www.malwarebytes.com
www.bleepingcomputer.com
www.techtarget.com
chuongdong.com
doxygen.reactos.org
github.com
getmyfileback.com
lp.cyberark.com
investors.cyberark.com
www.youtube.com

Subject Issuer	Validity	Valid
cyberark.com Cloudflare Inc ECC CA-3	`2024-01-28` - `2024-12-31`	a year	crt.sh
content.cdntwrk.com Amazon RSA 2048 M02	`2023-09-24` - `2024-10-22`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.uberflip.com Amazon RSA 2048 M02	`2023-06-23` - `2024-07-20`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-11` - `2024-08-10`	a year	crt.sh
*.segreencolumn.com Amazon RSA 2048 M01	`2023-07-18` - `2024-08-16`	a year	crt.sh
fast.wistia.com GlobalSign Atlas R3 DV TLS CA 2023 Q2	`2023-07-02` - `2024-08-02`	a year	crt.sh
ml314.com GTS CA 1D4	`2023-10-03` - `2024-01-01`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
6sc.co R3	`2024-01-29` - `2024-04-28`	3 months	crt.sh
*.marketo.com DigiCert TLS RSA SHA256 2020 CA1	`2023-12-08` - `2024-12-11`	a year	crt.sh
*.trustarc.com Amazon RSA 2048 M02	`2023-04-17` - `2024-05-14`	a year	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-08` - `2024-07-06`	6 months	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2023-08-22` - `2024-09-21`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2024-01-15` - `2024-07-13`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-01-02` - `2024-03-26`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.mktoresp.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-07` - `2024-10-07`	a year	crt.sh
*.ml314.com Amazon RSA 2048 M02	`2023-10-16` - `2024-11-12`	a year	crt.sh
*.wistia.com Amazon RSA 2048 M02	`2024-01-01` - `2025-01-28`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.google.de GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
pipedream-production-cloudfront-app-cname.wistia.com Amazon RSA 2048 M03	`2023-09-11` - `2024-10-09`	a year	crt.sh
stats-tap-production-cloudfront-app-cname.wistia.com Amazon RSA 2048 M01	`2023-09-13` - `2024-10-11`	a year	crt.sh
drift.com Amazon RSA 2048 M02	`2023-08-15` - `2024-09-11`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-11-09` - `2024-02-07`	3 months	crt.sh
nexus.ensighten.com Amazon RSA 2048 M02	`2023-09-29` - `2024-10-27`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M02	`2023-09-09` - `2024-10-07`	a year	crt.sh
*.simpli.fi DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-11-07` - `2024-12-07`	a year	crt.sh
*.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.sc.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-10` - `2024-03-08`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-01-30` - `2024-07-30`	6 months	crt.sh
*.imgix.com GlobalSign Atlas R3 DV TLS CA 2023 Q4	`2023-12-07` - `2025-01-07`	a year	crt.sh

This page contains 10 frames:

Primary Page: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Frame ID: C12E2CF7D90A66BD17B4C61DA7417372
Requests: 217 HTTP requests in this frame

Frame: https://cyberark.demdex.net/dest5.html?d_nsid=0
Frame ID: 097456AD24AB455F002BF46B26B7DB48
Requests: 1 HTTP requests in this frame

Frame: https://consent.trustarc.com/get?name=crossdomain.html&domain=cyberark.com
Frame ID: A3539C03B873F72BEA9DD3250A5AE2A4
Requests: 1 HTTP requests in this frame

Frame: https://www.cyberark.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea25f566/main.js
Frame ID: 50F79B86A0D02E72B1C83896E2F12353
Requests: 2 HTTP requests in this frame

Frame: https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW
Frame ID: 8A077CC0A3EF05583398A8B21F46AADF
Requests: 18 HTTP requests in this frame

Frame: https://consent-pref.trustarc.com/defaultpreferencemanager/DFE2FFD93897F8EBCB55E7DCE8C0F692.cache.html
Frame ID: B0E755C52C7FEEC6F0B6F1A000EE8FD4
Requests: 1 HTTP requests in this frame

Frame: https://9920016.fls.doubleclick.net/activityi;dc_pre=CPyg6_3FhoQDFdlTkQUd2NwLlg;src=9920016;type=websi0;cat=websi0;ord=2605111504476;auiddc=1992125960.1706666988;pscdl=noapi;gtm=45fe41t0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
Frame ID: 1E7D68DD4AFCBD7E7A60D56E79636917
Requests: 2 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
Frame ID: 6B8823FE65CFE668D0D840A7A58E3F50
Requests: 39 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
Frame ID: EEE96CD253A25F90F96E30A41E18C978
Requests: 35 HTTP requests in this frame

Frame: https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe
Frame ID: 50F4EBF2A58856AECFB4AB03763F4FE6
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Ransomware’s PLAYing a Broken Game

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

TrustArc (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

consent\.trustarc\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

319
Requests

91 %
HTTPS

39 %
IPv6

58
Domains

89
Subdomains

72
IPs

7
Countries

5898 kB
Transfer

13692 kB
Size

81
Cookies

47 Outgoing links

These are links going to different origins than the main page.

URL: https://cyberark-customers.force.com/mplace/s/
Title: Marketplace

Search URL Search Domain Scan URL

URL: https://cyberark.com/partners/
Title: Partners

Search URL Search Domain Scan URL

URL: https://cyberark.com/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://labs.cyberark.com/
Title: CyberArk Labs

Search URL Search Domain Scan URL

URL: https://careers.cyberark.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.conjur.org/
Title: Conjur Secrets Manager Open Source

Search URL Search Domain Scan URL

URL: https://cyberark-customers.force.com/s/
Title: Technical Community

Search URL Search Domain Scan URL

URL: https://docs.cyberark.com/
Title: Product Documentation

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&url=https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game&title=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&summary=Abstract%20The%20Play%20ransomware%20group%20is%20one%20of%20the%20most%20successful%20ransomware%20syndicates%20today.%20All%20it%20takes%20is%20a%20quick%20peek%20with%20a%20disassembler%20to%20know%20why%20this%20group%20has%20become%20infamous.%20This%20is...
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&via=CyberArk
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&title=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&summary=Abstract%20The%20Play%20ransomware%20group%20is%20one%20of%20the%20most%20successful%20ransomware%20syndicates%20today.%20All%20it%20takes%20is%20a%20quick%20peek%20with%20a%20disassembler%20to%20know%20why%20this%20group%20has%20become%20infamous.%20This%20is...
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.malwarebytes.com/blog/news/2022/12/play-ransomware-attacks-government-agencies-and-their-providers
Title: attack on the city of Antwerp

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/play-ransomware-claims-attack-on-german-hotel-chain-h-hotels/
Title: attack on the German hotel chain H-Hotels

Search URL Search Domain Scan URL

URL: https://www.techtarget.com/searchsecurity/news/252528594/Play-ransomware-actors-bypass-ProxyNotShell-mitigations
Title: they were employing a new variation of the ProxyNotShell exploits

Search URL Search Domain Scan URL

URL: https://chuongdong.com/reverse%20engineering/2022/09/03/PLAYRansomware/
Title: excellent article

Search URL Search Domain Scan URL

URL: https://doxygen.reactos.org/d5/d92/struct__EXCEPTION__REGISTRATION__RECORD.html
Title: exception registration records

Search URL Search Domain Scan URL

URL: https://github.com/cyberark/White-Phoenix
Title: source code from GitHub

Search URL Search Domain Scan URL

URL: https://getmyfileback.com/
Title: getmyfileback.com

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.cyberark.com%2Fresources
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Check%20out%20what%27s%20happening%20at%20CyberArk%21&url=https%3A%2F%2Fwww.cyberark.com%2Fresources&via=CyberArk
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.cyberark.com%2Fresources&title=English%20%E2%80%93%20CyberArk%20Software%20Inc%27s&summary=Check%20out%20what%27s%20happening%20at%20CyberArk%21
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://lp.cyberark.com/Stay-in-touch.html
Title: Tell Me How

Search URL Search Domain Scan URL

URL: https://cyberark.com/services-support/contact-support/
Title: Contact Support

Search URL Search Domain Scan URL

URL: https://cyberark.com/services-support/professional-services/training-certification/
Title: Training & Certification

Search URL Search Domain Scan URL

URL: https://cyberark.com/customer-support/
Title: Customer Support

Search URL Search Domain Scan URL

URL: https://cyberark.com/products/privileged-account-security-solution/endpoint-privilege-manager/endpoint-privilege-manager-software-service/
Title: EPM SaaS Register / Login

Search URL Search Domain Scan URL

URL: https://cyberark.com/product-security/
Title: Product Security

Search URL Search Domain Scan URL

URL: https://cyberark.com/resources
Title: Resource Center

Search URL Search Domain Scan URL

URL: https://cyberark.com/blueprint/
Title: CyberArk Blueprint

Search URL Search Domain Scan URL

URL: https://cyberark.com/discover-privileged-accounts-exist-cyberark-dna/
Title: Scan Your Network

Search URL Search Domain Scan URL

URL: https://cyberark-customers.force.com/partner/s/login/
Title: Partner Community

Search URL Search Domain Scan URL

URL: https://cyberark.com/partner-finder/
Title: Partner Finder

Search URL Search Domain Scan URL

URL: https://cyberark.com/partners/alliance-partners/
Title: Alliance Partner

Search URL Search Domain Scan URL

URL: https://investors.cyberark.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://cyberark.com/company/management-team/
Title: Management Team

Search URL Search Domain Scan URL

URL: https://cyberark.com/company/board-of-directors/
Title: Board of Directors

Search URL Search Domain Scan URL

URL: https://cyberark.com/newsroom/
Title: Newsroom

Search URL Search Domain Scan URL

URL: https://cyberark.com/company/#office-locations
Title: Office Locations

Search URL Search Domain Scan URL

URL: https://twitter.com/CyberArk

Search URL Search Domain Scan URL

URL: https://www.facebook.com/CyberArk

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/cyber-ark-software

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/cyberarksoftware

Search URL Search Domain Scan URL

URL: https://cyberark.com/terms-conditions/
Title: Terms and Conditions

Search URL Search Domain Scan URL

URL: https://cyberark.com/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 91

https://cm.everesttech.net/cm/dd?d_uuid=29536971682366275851737429685191035098 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zbmr7AAAAN0jwANe

Request Chain 100

https://www.cyberark.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://www.cyberark.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea25f566/main.js

Request Chain 146

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/?random=1758822605&cv=11&fst=1706666989447&bg=ffffff&guid=ON&async=1&gtm=45be41t0v898648185&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&label=H8zfCNSYxvwYEJHvgv8D&hn=www.googleadservices.com&frm=0&tiba=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&gtm_ee=1&pscdl=noapi&auid=1992125960.1706666988&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&ocp_id=7au5ZfSAH6uYxdwPo56z0Ag&sscte=1&crd=&pscrd=Ek5DaEFJZ05uaXJRWVEtN0RJMnMtUGpza0JFaVlBSXRfb0VTZVZsYWlTTTByNWo4OXpCYmI3emNhLUtxS3NhdjYyd1JwZWp3Z3RyUGtVa0EaWkNoRUlnTm5pclFZUTlxdkFyWWFyLTR5LUFSSXVBQ3VBdmQ4QVdKa0lWR0lMZ0x6dGxFYWpPWkRBb3pUSVVaZXNaNVVnQ0lrWUlaR1ZOQnBaMzB5UGFVNXJydyITCLSro_3FhoQDFStMkQUdI88Mig HTTP 302
https://www.google.com/pagead/1p-conversion/1071691665/?random=1758822605&cv=11&fst=1706666989447&bg=ffffff&guid=ON&async=1&gtm=45be41t0v898648185&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&label=H8zfCNSYxvwYEJHvgv8D&hn=www.googleadservices.com&frm=0&tiba=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&gtm_ee=1&pscdl=noapi&auid=1992125960.1706666988&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ05uaXJRWVEtN0RJMnMtUGpza0JFaVlBSXRfb0VTZVZsYWlTTTByNWo4OXpCYmI3emNhLUtxS3NhdjYyd1JwZWp3Z3RyUGtVa0EaWkNoRUlnTm5pclFZUTlxdkFyWWFyLTR5LUFSSXVBQ3VBdmQ4QVdKa0lWR0lMZ0x6dGxFYWpPWkRBb3pUSVVaZXNaNVVnQ0lrWUlaR1ZOQnBaMzB5UGFVNXJydyITCLSro_3FhoQDFStMkQUdI88Mig&is_vtc=1&ocp_id=7au5ZfSAH6uYxdwPo56z0Ag&cid=CAQSKQAvHhf_VoAW-vgLJ2wQ2QnY_YFukfSKY10zLkTgdyTeLTeYXbBY-36T&random=3662310862 HTTP 302
https://www.google.de/pagead/1p-conversion/1071691665/?random=1758822605&cv=11&fst=1706666989447&bg=ffffff&guid=ON&async=1&gtm=45be41t0v898648185&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&label=H8zfCNSYxvwYEJHvgv8D&hn=www.googleadservices.com&frm=0&tiba=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&gtm_ee=1&pscdl=noapi&auid=1992125960.1706666988&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ05uaXJRWVEtN0RJMnMtUGpza0JFaVlBSXRfb0VTZVZsYWlTTTByNWo4OXpCYmI3emNhLUtxS3NhdjYyd1JwZWp3Z3RyUGtVa0EaWkNoRUlnTm5pclFZUTlxdkFyWWFyLTR5LUFSSXVBQ3VBdmQ4QVdKa0lWR0lMZ0x6dGxFYWpPWkRBb3pUSVVaZXNaNVVnQ0lrWUlaR1ZOQnBaMzB5UGFVNXJydyITCLSro_3FhoQDFStMkQUdI88Mig&is_vtc=1&ocp_id=7au5ZfSAH6uYxdwPo56z0Ag&cid=CAQSKQAvHhf_VoAW-vgLJ2wQ2QnY_YFukfSKY10zLkTgdyTeLTeYXbBY-36T&random=3662310862&ipr=y

Request Chain 174

https://9920016.fls.doubleclick.net/activityi;src=9920016;type=websi0;cat=websi0;ord=2605111504476;auiddc=1992125960.1706666988;pscdl=noapi;gtm=45fe41t0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game HTTP 302
https://9920016.fls.doubleclick.net/activityi;dc_pre=CPyg6_3FhoQDFdlTkQUd2NwLlg;src=9920016;type=websi0;cat=websi0;ord=2605111504476;auiddc=1992125960.1706666988;pscdl=noapi;gtm=45fe41t0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game

Request Chain 177

https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=[ORDER]&ord=[CACHEBUSTER] HTTP 303
https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=%5BORDER%5D&ord=%5BCACHEBUSTER%5D&_bee_ppp=1

Request Chain 186

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1706666990750&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1706666990750&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D17906%26time%3D1706666990750%26url%3Dhttps%253A%252F%252Fwww.cyberark.com%252Fresources%252Fthreat-research-blog%252Fransomwares-playing-a-broken-game%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1706666990750&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&cookiesTest=true&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1706666990750&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&cookiesTest=true&liSync=true&e_ipv6=AQJwvoCa7zRpKQAAAY1dR5-E049Y84Gjx9a_jx8KqRol4TXHp0KL8Uv-8ygqoG-v

Request Chain 196

https://um.simpli.fi/smaato HTTP 302
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=DB4DF4F3ABA5459F8F03CDAFD3B376F8

Request Chain 197

https://um.simpli.fi/nexxen HTTP 302
https://sync.1rx.io/usersync/simplifi/DB4DF4F3ABA5459F8F03CDAFD3B376F8 HTTP 302
https://sync.1rx.io/usersync/simplifi/DB4DF4F3ABA5459F8F03CDAFD3B376F8?zcc=1&cb=1706666990983 HTTP 302
https://sync.targeting.unrulymedia.com/csync/RX-0d113d1f-1e82-4f5c-876f-f80dd81e529d-003

Request Chain 198

https://um.simpli.fi/triplelift HTTP 302
https://eb2.3lift.com/xuid?mid=7969&xuid=DB4DF4F3ABA5459F8F03CDAFD3B376F8&dongle=yf3

Request Chain 199

https://um.simpli.fi/telaria_p HTTP 302
https://simplifi.partners.tremorhub.com/sync?UISF=DB4DF4F3ABA5459F8F03CDAFD3B376F8

Request Chain 200

https://um.simpli.fi/tapad HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=DB4DF4F3ABA5459F8F03CDAFD3B376F8 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=DB4DF4F3ABA5459F8F03CDAFD3B376F8

Request Chain 201

https://um.simpli.fi/ad_advisor HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=DB4DF4F3ABA5459F8F03CDAFD3B376F8 HTTP 302
https://d.agkn.com/pixel/10751/?che=1706666990988&ip=81.95.5.37&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D217153104778000126231 HTTP 302
https://um.simpli.fi/aa_px?sk=217153104778000126231 HTTP 302
https://um.simpli.fi/empty.gif

Request Chain 202

https://um.simpli.fi/intentiq HTTP 302
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=DB4DF4F3ABA5459F8F03CDAFD3B376F8

Request Chain 205

https://um.simpli.fi/dtnx HTTP 302
https://fei.pro-market.net/engine?du=24;csync=DB4DF4F3ABA5459F8F03CDAFD3B376F8;mimetype=img; HTTP 302
https://fei.pro-market.net/engine?du=24;csync=DB4DF4F3ABA5459F8F03CDAFD3B376F8;mimetype=img;sr HTTP 302
https://cms.analytics.yahoo.com/cms?partner_id=DATCS HTTP 302
https://ups.analytics.yahoo.com/ups/58726/cms?partner_id=DATCS

Request Chain 206

https://um.simpli.fi/exelatem HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=DB4DF4F3ABA5459F8F03CDAFD3B376F8&j=0 HTTP 302
https://loadm.exelator.com/load/?p=204&g=2191&simid=DB4DF4F3ABA5459F8F03CDAFD3B376F8&j=0&xl8blockcheck=1

Request Chain 208

https://um.simpli.fi/beachfront HTTP 302
https://sync.bfmio.com/sync?pid=141&uid=DB4DF4F3ABA5459F8F03CDAFD3B376F8

Request Chain 209

https://um.simpli.fi/bluekai HTTP 302
https://stags.bluekai.com/site/29931?id=DB4DF4F3ABA5459F8F03CDAFD3B376F8

Request Chain 210

https://um.simpli.fi/crwdcntrl HTTP 302
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=DB4DF4F3ABA5459F8F03CDAFD3B376F8

Request Chain 211

https://um.simpli.fi/lj_match HTTP 302
https://ce.lijit.com/merge?pid=2&3pid=DB4DF4F3ABA5459F8F03CDAFD3B376F8

Request Chain 212

https://um.simpli.fi/liveramp_match HTTP 302
https://idsync.rlcdn.com/419566.gif?partner_uid=DB4DF4F3ABA5459F8F03CDAFD3B376F8

Request Chain 213

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1706666990807&cv=7&fst=1706666990807&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1837091277&cv=7&fst=1706666990807&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&ocp_id=7qu5Za36M_rMxdwPoL6S4AU&sscte=1&crd=&pscrd=IhMIran1_cWGhAMVemaRBR0gnwRc HTTP 302
https://www.google.com/pagead/1p-conversion/1026675585/?random=1837091277&cv=7&fst=1706666990807&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMIran1_cWGhAMVemaRBR0gnwRc&is_vtc=1&ocp_id=7qu5Za36M_rMxdwPoL6S4AU&cid=CAQSKQAvHhf_6ZFLd8me3rYP8RA9UlME_tZYhCUIGxC5HPrHLn_Blyfs639D&random=1975971558 HTTP 302
https://www.google.de/pagead/1p-conversion/1026675585/?random=1837091277&cv=7&fst=1706666990807&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMIran1_cWGhAMVemaRBR0gnwRc&is_vtc=1&ocp_id=7qu5Za36M_rMxdwPoL6S4AU&cid=CAQSKQAvHhf_6ZFLd8me3rYP8RA9UlME_tZYhCUIGxC5HPrHLn_Blyfs639D&random=1975971558&ipr=y

Request Chain 215

https://um.simpli.fi/an HTTP 302
https://ib.adnxs.com/setuid?entity=66&code=DB4DF4F3ABA5459F8F03CDAFD3B376F8 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3DDB4DF4F3ABA5459F8F03CDAFD3B376F8

Request Chain 216

https://um.simpli.fi/rb_match HTTP 302
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=DB4DF4F3ABA5459F8F03CDAFD3B376F8&expires=365

Request Chain 217

https://um.simpli.fi/ox_match HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072966&val=DB4DF4F3ABA5459F8F03CDAFD3B376F8

Request Chain 218

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc HTTP 302
https://um.simpli.fi/g_match?id=&google_gid=CAESEFgw7JoyA8ckwMhqq1zpPNA&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=DB4DF4F3ABA5459F8F03CDAFD3B376F8 HTTP 302
https://um.simpli.fi/g_match?id=

Request Chain 272

https://insight.adsrvr.org/tags/0v1kpom/u9beit9/iframe HTTP 301
https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe

319 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request ransomwares-playing-a-broken-game Show response
www.cyberark.com/resources/threat-research-blog/ 283 KB
54 KB 310ms
284ms Document
text/html 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74919b0f053c18d9f2d32ea8082862f05c1305f78bdaa933ea09a65607b0759e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.cyberark.com/
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 84de6a20dd5a65d7-FRA
content-encoding: gzip
content-language: en
content-security-policy: frame-ancestors 'self' https://www.cyberark.com/
content-type: text/html; charset=UTF-8
date: Wed, 31 Jan 2024 02:09:47 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
referrer-policy: unsafe-url
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block

GET
H2 200 lato.css
content.cdntwrk.com/css/google-fonts/ 6 KB
960 B 44ms
7ms Stylesheet
text/css 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.cdntwrk.com/css/google-fonts/lato.css?v=075928935a99
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 88b4bd1c3c8e9af6516b562e9679955ff48479ee6a5771e97ef425d1c5425e1f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 18:28:34 GMT
content-encoding: gzip
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
age: 459674
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 13 Dec 2023 19:45:29 GMT
server: AmazonS3
etag: W/"37291223d8c6a87c6435a8740e28f134"
access-control-max-age: 0
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
vary: Accept-Encoding
x-amz-cf-id: BLgnaiWGglJaMvOTPZEU0KU5FrcqqXi0aXoKWFpC8lPIhMspYT8BQQ==

GET
H2 200 hubs.00b1d4acfe61970d73c9.css
content.cdntwrk.com/css/hubs/ 260 KB
44 KB 43ms
7ms Stylesheet
text/css 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.cdntwrk.com/css/hubs/hubs.00b1d4acfe61970d73c9.css
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 22f8377b75e8bf91649227ee7fa17265058b0e6aad499609a50180d7cfa362c5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 16:35:37 GMT
content-encoding: gzip
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
age: 34451
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 30 Jan 2024 16:34:20 GMT
server: AmazonS3
etag: W/"aa822323bd2b9df5770bcc49894e411f"
access-control-max-age: 0
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
vary: Accept-Encoding
x-amz-cf-id: wD4_u2_bo2bVLMW5CGdiwADZbQLtPjl-cksuLvBv9xEs_BgcYHmHhw==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 313 KB
102 KB 53ms
29ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

abb15ddd1f878f101678d02f04e67f7727b66932d2b0cfae83e2aa5522f3e90c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 103575
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 31 Jan 2024 02:09:48 GMT

GET
H2 200 en.css
cihost.uberflip.com/cyberArk/master/build/en/ 512 KB
76 KB 56ms
8ms Stylesheet
text/css 2600:9000:2156:9a00:12:53a8:95c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9a00:12:53a8:95c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5e81401d2a127d7754b03d63b9cf7f3bf22355faa2a0a5f8232f42e4a2de29eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 22:19:43 GMT
content-encoding: gzip
via: 1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
last-modified: Tue, 30 Jan 2024 22:19:22 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1706653155/ctime:1706653156/gid:127/gname:docker/md5:7b1598146f88edc5b525dd2bf6401fc7/mode:33188/mtime:1706653156/uid:1001/uname:runner
x-amz-cf-pop: FRA50-C1
age: 13806
etag: W/"7b1598146f88edc5b525dd2bf6401fc7"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
x-amz-cf-id: cdSI4HH8C7d-I3-Zc5EQ3Go8QFiSE2liV0Wm6ylIYfC-y7eqvBedyA==

GET
H2 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/ 46 KB
9 KB 32ms
13ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8891a160f8a2afb81de5259f9f68e5af3782348ea2927ad9e969bc88c7d39984

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Origin: https://www.cyberark.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:47 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1748766
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 8281
last-modified: Mon, 04 May 2020 16:10:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e60-b752"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Ll4fKvC98qBY72sj9RJd7Obx%2B4en7e6o23Na0m5hL4T21uwEf8Vw%2BjsaJo1G3hbw0PuRWhY0IwF2GUzsNj0DpA%2FDnBRen%2Fo0%2FoxkfPu9Oocl6lDmNb7cKf0%2FXQjTgt1HddelWqRDDD6cyc45fDDmjxx"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 84de6a22eb0a9be6-FRA
expires: Mon, 20 Jan 2025 02:09:47 GMT

GET
H2 200 css
fonts.googleapis.com/ 11 KB
2 KB 49ms
20ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400&display=swap

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

20762aa0fe40492f41569768f84afe1a8a50f2ed1b54861f966ba12fe8aab763

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 31 Jan 2024 02:09:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 01:18:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 31 Jan 2024 02:09:47 GMT

GET
H2 200 enlighterjs.min.css
www.cyberark.com/wp-content/themes/understrap-child/includes/enlighter/ 78 KB
12 KB 33ms
32ms Stylesheet
text/css 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/wp-content/themes/understrap-child/includes/enlighter/enlighterjs.min.css?ver=5.4.2

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ef8a267de455c3a72237bf7db0c97c97e35e52452ff9ece15876d0d60f9c0e9

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:47 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
content-encoding: gzip
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 5505616
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 31 Aug 2020 16:20:25 GMT
server: cloudflare
etag: W/"5f4d2349-13634"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
cf-ray: 84de6a22cf8f65d7-FRA
expires: Thu, 30 Jan 2025 02:09:47 GMT

GET
H2 200 enlighterjs.min.js Show response
www.cyberark.com/wp-content/themes/understrap-child/includes/enlighter/ 57 KB
20 KB 22ms
21ms Script
application/javascript 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/wp-content/themes/understrap-child/includes/enlighter/enlighterjs.min.js?ver=5.4.2

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a117f36dba1eb2100f340bb68f3cc4d4c04d50d8a1d61c36a5d0a682aed9d362

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:47 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
content-encoding: gzip
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 5348035
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 31 Aug 2020 16:20:25 GMT
server: cloudflare
etag: W/"5f4d2349-e307"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
cf-ray: 84de6a22cf9065d7-FRA
expires: Thu, 30 Jan 2025 02:09:47 GMT

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
1010 B 48ms
19ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto+Mono&display=swap

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d99d2429e8e90014f3b5cb16a9bc0a773d0ddfb3d384c6e6b7f706236ae4848f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 31 Jan 2024 02:09:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 01:49:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 31 Jan 2024 02:09:47 GMT

GET
H2 200 launch-e8e6adf0fe30.min.js Show response
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/ 298 KB
88 KB 50ms
9ms Script
application/x-javascript 2a02:26f0:480:980::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:980::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: f6305ad97ebc710e618453ab70661972a83d3349a3f31754007f33daffc12f3f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: gzip
last-modified: Fri, 27 Oct 2023 18:01:16 GMT
server: AkamaiNetStorage
etag: "60d658145e599ce761bf926739eb76c7:1698429676.422454"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 89810
expires: Wed, 31 Jan 2024 03:09:48 GMT

GET
H2 200 84cf3062f98cbab994d639a975b2798e.js Show response
ob.segreencolumn.com/i/ 100 KB
37 KB 36ms
9ms Script
text/javascript 2600:9000:2490:400:18:15b9:5a80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2490:400:18:15b9:5a80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Caddy /
Resource Hash: 6c3be82a5e536cb0991aa349d0d9de1c2639425d9c252f5a4336091ddaca8f33

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 19:21:20 GMT
content-encoding: gzip
via: 1.1 bfb5bffe90e3b0e760933a7a07d850ba.cloudfront.net (CloudFront)
server: Caddy
x-amz-cf-pop: FRA56-P6
age: 24508
etag: "18fa4-erEqFcRXQ2P1h3MKw+VZIx6uBxE"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
cache-control: max-age=43200
content-length: 37353
x-amz-cf-id: HFkAgpk5xj3tGuG_HQd9L9lOlskZxpPkcmaYpQcDGlp0nfRP3xja6w==
expires: Wed, 31 Jan 2024 07:21:20 GMT

GET
H2 200 logo.svg
cihost.uberflip.com/cyberArk/OB-8671/build/assets/ 14 KB
5 KB 64ms
17ms Image
image/svg+xml 2600:9000:2156:9a00:12:53a8:95c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cihost.uberflip.com/cyberArk/OB-8671/build/assets/logo.svg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9a00:12:53a8:95c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 952f35790a58d6c58cd01db0b7994f8b1e3f2d4328f8dd2ed423c01579d403c6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 06:29:45 GMT
content-encoding: gzip
via: 1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
last-modified: Mon, 12 Dec 2022 14:33:49 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1670855619/ctime:1670855619/gid:123/gname:docker/md5:f86c6ef84b83b048b2a5521fb36ab761/mode:33188/mtime:1670855619/uid:1001/uname:runner
x-amz-cf-pop: FRA50-C1
age: 70826
x-amz-server-side-encryption: AES256
etag: W/"f86c6ef84b83b048b2a5521fb36ab761"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-id: _B8pNfn9EidXVSgEVw-okhbnI2i4IRlHs1yH-Gk-v-JE3wUFpaifUw==

GET
H2 200 WhyCA_Menu-LeftHandCallOut.png
www.cyberark.com/wp-content/uploads/2021/02/ 25 KB
29 KB 26ms
25ms Image
image/webp 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2021/02/WhyCA_Menu-LeftHandCallOut.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b96b944dbdb9c2afcdecae184e3bdc4717c30dc4f5d4624cfd1727461d6569fa

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:47 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 7778103
cf-polished: origFmt=png, origSize=39669
content-disposition: inline; filename="WhyCA_Menu-LeftHandCallOut.webp"
content-length: 25958
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Tue, 02 Feb 2021 20:17:47 GMT
server: cloudflare
etag: "6019b36b-9af5"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 84de6a22cf9265d7-FRA
expires: Thu, 30 Jan 2025 02:09:47 GMT

GET
H2 200 Assets-Icons-Industries-Medical.png
www.cyberark.com/wp-content/uploads/2020/12/ 362 B
4 KB 25ms
24ms Image
image/webp 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2020/12/Assets-Icons-Industries-Medical.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e6098f9e4e64f667bc006876813632d5ac79ac56e5284a95c9c821870907cad

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 5348036
cf-polished: origFmt=png, origSize=997
content-disposition: inline; filename="Assets-Icons-Industries-Medical.webp"
content-length: 362
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Wed, 23 Dec 2020 22:10:13 GMT
server: cloudflare
etag: "5fe3c045-3e5"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 84de6a22ffa865d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 Products_Menu-LeftHandCallOut.png
www.cyberark.com/wp-content/uploads/2021/02/ 15 KB
18 KB 28ms
28ms Image
image/webp 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2021/02/Products_Menu-LeftHandCallOut.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

08330120c6d9d4407fd599bae49187289878c557ed68e58d0e091fd5e1ac6c7f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 5257755
cf-polished: origFmt=png, origSize=22261
content-disposition: inline; filename="Products_Menu-LeftHandCallOut.webp"
content-length: 15210
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Tue, 02 Feb 2021 20:10:12 GMT
server: cloudflare
etag: "6019b1a4-56f5"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 84de6a231fbb65d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 Privilege.svg
www.cyberark.com/wp-content/uploads//2021/02/ 3 KB
5 KB 30ms
21ms Image
image/svg+xml 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads//2021/02/Privilege.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b0e7a4bdf115afb8e8c5b9b671b0dc4441236f8cf56906d146b7d46a0ee14a8

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
content-encoding: gzip
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6808462
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 02 Feb 2021 20:54:15 GMT
server: cloudflare
etag: W/"6019bbf7-c52"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
cf-ray: 84de6a24082265d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 Access.svg
www.cyberark.com/wp-content/uploads//2021/02/ 5 KB
5 KB 33ms
23ms Image
image/svg+xml 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads//2021/02/Access.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8e7fd76994e9fe7f19af8a2234efc259debc6e67de4ae8bf2f0e7471132bd02

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
content-encoding: gzip
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 4085038
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 02 Feb 2021 21:31:38 GMT
server: cloudflare
etag: W/"6019c4ba-12ba"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
cf-ray: 84de6a24082365d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 DevSecOps.svg
www.cyberark.com/wp-content/uploads//2021/02/ 6 KB
2 KB 31ms
22ms Image
image/svg+xml 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads//2021/02/DevSecOps.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91b7152c2708e116677591b018f23ed2910c747e932f8985b704f1884d807990

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 02 Feb 2021 21:31:31 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6993859
etag: W/"6019c4b3-185c"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 84de6a24082465d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 finance.svg
www.cyberark.com/wp-content/uploads//2021/02/ 7 KB
3 KB 30ms
21ms Image
image/svg+xml 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads//2021/02/finance.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

234f5e6b36c41a209c87e64949d11927b6360603b94ce3511c53df5bac0f4c26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 02 Feb 2021 21:33:34 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6739825
etag: W/"6019c52e-1a41"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 84de6a24082565d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 insurance.svg
www.cyberark.com/wp-content/uploads//2021/02/ 3 KB
4 KB 31ms
22ms Image
image/svg+xml 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads//2021/02/insurance.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9e70999bd0ed2afbb2967ca63898c752fc3e66ba8a86a4ac341723be85bb7319

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
content-encoding: gzip
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 5251896
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 02 Feb 2021 21:34:37 GMT
server: cloudflare
etag: W/"6019c56d-c9f"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
cf-ray: 84de6a24082665d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 healthcare.svg
www.cyberark.com/wp-content/uploads//2021/02/ 4 KB
5 KB 39ms
30ms Image
image/svg+xml 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads//2021/02/healthcare.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a654dbffdb656aacce15df139a6d2701ccae809fe7baab1ec042714bb6336eb9

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
content-encoding: gzip
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 5505616
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 02 Feb 2021 21:34:01 GMT
server: cloudflare
etag: W/"6019c549-10bb"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
cf-ray: 84de6a24082865d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 government.svg
www.cyberark.com/wp-content/uploads//2021/02/ 2 KB
4 KB 33ms
24ms Image
image/svg+xml 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads//2021/02/government.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

634358d77171f485bb1738fce1bf1e715e2cd0a94b2c4f3d5c6dafccd0d1031a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
content-encoding: gzip
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6739825
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 02 Feb 2021 21:34:22 GMT
server: cloudflare
etag: W/"6019c55e-881"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
cf-ray: 84de6a24082965d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 Nav-Image-ServicesSupport-e1609108892195.png
www.cyberark.com/wp-content/uploads/2020/12/ 21 KB
24 KB 26ms
25ms Image
image/webp 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2020/12/Nav-Image-ServicesSupport-e1609108892195.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ba3a74eb74823f80c522391734fdeafebfbd2f284167568ad17e7d44b1618e3

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 498947
cf-polished: origFmt=png, origSize=36292
content-disposition: inline; filename="Nav-Image-ServicesSupport-e1609108892195.webp"
content-length: 21460
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Sun, 27 Dec 2020 22:41:32 GMT
server: cloudflare
etag: "5fe90d9c-8dc4"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 84de6a232fbf65d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 TryBuy_Menu-LeftHandCallOut.png
www.cyberark.com/wp-content/uploads/2021/02/ 26 KB
29 KB 40ms
31ms Image
image/webp 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2021/02/TryBuy_Menu-LeftHandCallOut.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8aab45b2e3226eb83ceed37f3f622529d0a6ca0a82d8dd9a4d1fb8e46ba84f83

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6813876
cf-polished: origFmt=png, origSize=39090
content-disposition: inline; filename="TryBuy_Menu-LeftHandCallOut.webp"
content-length: 26540
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Tue, 02 Feb 2021 20:19:11 GMT
server: cloudflare
etag: "6019b3bf-98b2"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 84de6a24082a65d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 Icons-Globe@2x.png
www.cyberark.com/wp-content/uploads/2020/12/ 456 B
4 KB 37ms
29ms Image
image/webp 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2020/12/Icons-Globe@2x.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45aca110620ac12009925cac1e38aa4e71426a2b83ee7f356010069b45539d56

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 5256116
cf-polished: origFmt=png, origSize=1147
content-disposition: inline; filename="Icons-Globe@2x.webp"
content-length: 456
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Wed, 30 Dec 2020 23:04:11 GMT
server: cloudflare
etag: "5fed076b-47b"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 84de6a24082b65d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H3 200 ajax-loader-white-2x.gif
content.cdntwrk.com/img/hubs/ 3 KB
3 KB 15ms
9ms Image
image/gif 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/img/hubs/ajax-loader-white-2x.gif?v=19a554b579c4
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c1cd0852f3077f1b059e16529d8de16acb490990d6cb796dd74873de0bfd8a91

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 00:24:37 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
age: 524712
x-amz-cf-pop: FRA6-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 2707
last-modified: Wed, 13 Dec 2023 19:45:36 GMT
server: AmazonS3
etag: "5217392f882b27d35ec2e72946f2df7e"
access-control-max-age: 0
access-control-allow-methods: GET, HEAD
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: sGVBPRp6nhUUz8iNfM1CGUVgcAge1vyma7og9FpirCh2wZRpVhCHMw==

GET
H3 200 chevron-down-64x64.png
content.cdntwrk.com/img/hubs/ 760 B
1 KB 15ms
10ms Image
image/png 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/img/hubs/chevron-down-64x64.png?v=78668873251b
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5e240679c3215c840cf754104fe7291c77f2f52ad551c95e8c8364d0124938ec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 01:30:03 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
age: 177494
x-amz-cf-pop: FRA6-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 760
last-modified: Wed, 13 Dec 2023 19:45:36 GMT
server: AmazonS3
etag: "26818bdf0706c780af4a52b44ea17fdc"
access-control-max-age: 0
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: 2ZPWMMuZJZ5ZJX4XZw0PV8oYlupbUt9uiifzSscpg_X7TDgXDPqBNg==

GET
H2 200 untangling-the-strings.png
www.cyberark.com/wp-content/uploads/2024/01/ 16 KB
19 KB 23ms
23ms Image
image/webp 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2024/01/untangling-the-strings.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

621bafd8b2419f30d42474df7bb292286548afd73dcc9689f5c3719f7b191ef8

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:47 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6028
cf-polished: origFmt=png, origSize=62097
content-disposition: inline; filename="untangling-the-strings.webp"
content-length: 16466
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Thu, 25 Jan 2024 07:10:20 GMT
server: cloudflare
etag: "65b2095c-f291"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 84de6a22cf9165d7-FRA
expires: Thu, 30 Jan 2025 02:09:47 GMT

GET
H2 200 play-for-approximately-300x96.png
www.cyberark.com/wp-content/uploads/2024/01/ 27 KB
30 KB 33ms
25ms Image
image/webp 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2024/01/play-for-approximately-300x96.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1ca3d3ed4102816e2de0d015a3a1b442991f093419dbc8638c946989d289ce54

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6029
cf-polished: origFmt=png, origSize=35430
content-disposition: inline; filename="play-for-approximately-300x96.webp"
content-length: 27544
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Thu, 25 Jan 2024 07:14:18 GMT
server: cloudflare
etag: "65b20a4a-8a66"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 84de6a24082c65d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 keygen-loop.png
www.cyberark.com/wp-content/uploads/2024/01/ 9 KB
13 KB 43ms
36ms Image
image/webp 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2024/01/keygen-loop.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

778347605ae980421f7a0b819bb5eed18658e24f873f7d77eb1e481e1166e7cd

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6029
cf-polished: origFmt=png, origSize=22430
content-disposition: inline; filename="keygen-loop.webp"
content-length: 9452
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Thu, 25 Jan 2024 07:18:54 GMT
server: cloudflare
etag: "65b20b5e-579e"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 84de6a24183565d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 swatch
fast.wistia.com/embed/medias/27v1i6bir9/ 3 KB
3 KB 54ms
7ms Image
image/jpeg 2a04:4e42:400::644
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fast.wistia.com/embed/medias/27v1i6bir9/swatch

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::644 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

envoy /

Resource Hash

12a2f409f03bad041a44d07d99ca2ba49f1d198da96c688343d545acfe9a36a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
access-control-request-method: *
via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront), 1.1 47c0295005ec7d8570406951491004c2.cloudfront.net (CloudFront), 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=0
x-cdn: cloudfront
x-amz-cf-pop: IAD12-P1, IAD89-C3
age: 38704
edge-cache-tag: 720108237abe64d91c196c702445cf32
x-cache: Miss from cloudfront, HIT, HIT
x-envoy-upstream-service-time: 40
content-disposition: inline
content-length: 2612
x-served-by: cache-iad-kcgs7200152-IAD, cache-fra-eddf8230024-FRA
x-browser-version: 120
last-modified: Thu, 25 Jan 2024 12:16:05 UTC
server: envoy
x-timer: S1706666988.200975,VS0,VE1
etag: KLLIvBwxxExFZlLE_SMJb9XMdeQ=
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, no-cache,max-age=31536000
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: TZD80pLK8xplyGqGc2tOpPLQ2kttDPILXckWbKqSjNVNRysn1ar3NA==
x-cache-hits: 34, 1

GET
H3 200 mediaproxy
content.cdntwrk.com/ 7 KB
7 KB 20ms
15ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F12%2Fsafenet-banner.jpg&size=1&version=1706628344&sig=337419f261463737e67f24a1db9d7489&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: bce8ce0d0f68ceecff66a7d2a6c3dd78fce20c7595f4239a69909d7c5e2c363a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 15:26:27 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Tue, 30 Jan 2024 15:26:18 GMT
age: 38600
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="safenet-banner.webp"
alt-svc: h3=":443"; ma=86400
content-length: 7054
x-amz-cf-id: qa53jzGsJW2CC_qsMoW65ZQ9ReYPMBi2G_XSqDJftbZMKWeL0OFeBw==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 173 KB
173 KB 21ms
16ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F10%2Ffuzzer_v.png&size=1&version=1701202140&sig=42b4e86002c5f13aaa0bb84223ac6b91&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 864c44b8b866936ec27dcee84017dbc8ff988248461b1246fbe13f0615a43741

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:17:04 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Tue, 28 Nov 2023 20:16:54 GMT
age: 5464364
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="fuzzer_v.webp"
alt-svc: h3=":443"; ma=86400
content-length: 177114
x-amz-cf-id: SIJAkosB8q_v172HWTNI_-rLe7XBswdC0mO_bUGuEowXW3r6BTriNw==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 7 KB
8 KB 21ms
17ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F08%2Fnvme.jpg&size=1&version=1702327603&sig=7efa404e885cdbc3403c9fea11632c70&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: fe68ada9a3d8295f355417eee75328dc8b09a238e2a2cf2dcbb738d4e5ddc511

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 20:48:56 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Mon, 11 Dec 2023 20:48:46 GMT
age: 4339252
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="nvme.webp"
alt-svc: h3=":443"; ma=86400
content-length: 7518
x-amz-cf-id: hgbGkbFFS__DvXSgVsouDY-Xy9qDQwkwdQihXSpg8aY07ZRCpsAWgQ==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 12 KB
12 KB 21ms
17ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F08%2Ffantastic-rootkits.jpg&size=1&version=1702327603&sig=cdf6f774c9a1f1232aa7c07d308d8e2b&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: ad48841a67a5fe1429379e173147275e4e87794f01df53c9ec53257ebd3b1042

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 20:48:56 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Mon, 11 Dec 2023 20:48:46 GMT
age: 4339252
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="fantastic-rootkits.webp"
alt-svc: h3=":443"; ma=86400
content-length: 12384
x-amz-cf-id: jwBY-42ED2nj9r4De4-7OOGgIrqsj755IJElvbuF6ETX9jlhNwua1w==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 42 KB
43 KB 34ms
29ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F07%2Fdeep-dive-into-penetration-testing.jpg&size=1&version=1698955973&sig=ae96a254e2efdb4e9a61d289fba9c6ae&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 33679051037335d4feb2347865be5976837c7076c799674062d46285a7d00dce

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 20:15:02 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Thu, 02 Nov 2023 20:14:52 GMT
age: 7710886
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="deep-dive-into-penetration-testing.webp"
alt-svc: h3=":443"; ma=86400
content-length: 43266
x-amz-cf-id: inphXQVKk0YHDW2sAMcaGArwkT7gmxOCg1_fpRL1Dtnb93ZILS5TRQ==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 6 KB
7 KB 25ms
21ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F07%2Fdeep-dive-into-penetration-testing.jpg&size=1&version=1702327603&sig=b5d54618dff1c37316f9f41f143194c6&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 8dd7a7eeccaaffd8a75ac8a2420ae500376d9f7f652dd8545deebd399bb96cfa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 20:48:56 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Mon, 11 Dec 2023 20:48:46 GMT
age: 4339252
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="deep-dive-into-penetration-testing.webp"
alt-svc: h3=":443"; ma=86400
content-length: 6536
x-amz-cf-id: qJtun4gtitufcn2oK0EEfw5QbkxcdQb8Hn9g_ePylpuO-74I6Pj9NA==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 144 KB
145 KB 34ms
30ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F05%2Fhow-to-write-a-poc-for-an-uninitialized-heade-image.jpg&size=1&version=1698956133&sig=466f0b43ed9ebe88643fa7fb13d978b8&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 8242e73795aa5b9757183fc6b9969c3e9a898f2e8f1e4d224d2bf9c982054e73

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 20:16:01 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Thu, 02 Nov 2023 20:15:52 GMT
age: 7710826
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="how-to-write-a-poc-for-an-uninitialized-heade-image.webp"
alt-svc: h3=":443"; ma=86400
content-length: 147774
x-amz-cf-id: 2krhMYa8wtP0A0bG8wgweCsxqZvaKt0JhBTwqKOrfHO3tsZbVABOxw==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 137 KB
138 KB 34ms
30ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F04%2Fwhite-pheonix-blog.png&size=1&version=1702327603&sig=5a6d2b6874e194f98893caf14ae72cca&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: c48e0d3f95034cda3ba46d64e2a0b9b588b9d567fa498c1ac7887a6ddd40b7a7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 20:48:56 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Mon, 11 Dec 2023 20:48:47 GMT
age: 4339251
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="white-pheonix-blog.webp"
alt-svc: h3=":443"; ma=86400
content-length: 140518
x-amz-cf-id: I9m584Kd0DguFJXyeoavNblkjhC7KyCCIiYc7z_u2R9X0xoDzNemkQ==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 66 KB
67 KB 39ms
35ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F05%2Ffantastic-rootkits-pt-2_header-image.png&size=1&version=1702327603&sig=5e84033174827f0f3481e7671dec44a1&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 1e20c277f9215eea696595f6dbb57825b4a7f87cddfec2f565379bf742252ecb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 20:48:56 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Mon, 11 Dec 2023 20:48:46 GMT
age: 4339252
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="fantastic-rootkits-pt-2_header-image.webp"
alt-svc: h3=":443"; ma=86400
content-length: 68084
x-amz-cf-id: TwFX-SQUu4v1fz9VfhNLlys9M3MVT3Tip9-5P3BH-lkiXjee7d1sjA==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 224 KB
225 KB 38ms
34ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F04%2Fbreaking-docker-header-image.png&size=1&version=1702327603&sig=ceca4c8f8564b2400034c57bedebbae1&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 027ca73659dab51fe9987fd4d19b9eedd940202da076fec561dab2b297dfa820

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 20:48:56 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Mon, 11 Dec 2023 20:48:46 GMT
age: 4339252
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="breaking-docker-header-image.webp"
alt-svc: h3=":443"; ma=86400
content-length: 229772
x-amz-cf-id: EzhG5k_L4dDn91rt3yfsxT5Tmj3zYhJ3Z0F9UjZ8_a3GxD7JWkMgfA==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 149 KB
149 KB 24ms
21ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F04%2Fheader-image-.png&size=1&version=1692112173&sig=a60a831dc27bae40a7e989010dee4de1&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 7be1b3df507b34b7d05c60510836564455b0f85be0871e96e48201e4947d4cfd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 23 Sep 2023 04:38:28 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Sat, 23 Sep 2023 04:38:18 GMT
age: 11223080
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="header-image-.webp"
alt-svc: h3=":443"; ma=86400
content-length: 152128
x-amz-cf-id: ex7zUARbyYY78ZXhmLbp9ox8DeddLPC2tJ6PVoGq9IPWqMvave4F-w==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 38 KB
38 KB 38ms
34ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F02%2Fpersistence-header-image.jpg&size=1&version=1702327603&sig=b3bb55d7898d3cf879f0ece75ac6f07a&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 94e3cdd5f056065d29360bb92657b5d0e6ce640a685585e12520c3e27f3d1ba9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 23:41:25 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Tue, 12 Dec 2023 23:41:15 GMT
age: 4242503
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="persistence-header-image.webp"
alt-svc: h3=":443"; ma=86400
content-length: 38970
x-amz-cf-id: 5ySBC9Ver5VxcSx4Ng7OXmUEAydEk-3Uda4CAX5pTVUnpgjVzOi6gg==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 9 KB
9 KB 38ms
34ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F02%2Ftr-phishing-service-hero.jpg&size=1&version=1702327603&sig=05246990939dd5ece678af58a5fdff3e&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 86ccdb948d25950b2b56fa681d1d87e712e5549719d476f355b240fd802f27b5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 20:56:54 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Tue, 19 Dec 2023 20:56:44 GMT
age: 3647574
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="tr-phishing-service-hero.webp"
alt-svc: h3=":443"; ma=86400
content-length: 9084
x-amz-cf-id: QY--i4CaOY0cMLIzVXAeZ_9ejFc2mAbohpEgpfRtLWgj5MAGVkt6vQ==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 91 KB
92 KB 39ms
35ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F02%2Flinux-kernel-hero.png&size=1&version=1702327604&sig=c9a2749cde37d6f5c70376be5e36902a&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 8642675885c3a57a6673d673550ef1b5cb983e7b8232e00cf7d804cbe6a1f034

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 23:41:25 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Tue, 12 Dec 2023 23:41:15 GMT
age: 4242503
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="linux-kernel-hero.webp"
alt-svc: h3=":443"; ma=86400
content-length: 93428
x-amz-cf-id: mpLAmfahcU9frLgWo8Pq8lBkC3OtPKfmM8vcgQXVHIVKkvHfy91org==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 51 KB
52 KB 38ms
35ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F02%2Fdocker-desktop-privilege-escalation-1.jpg&size=1&version=1702327604&sig=39c402ff25db28fbf23a5106fbfb1182&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 7633cd7887e2046b023bdbd496e3d087f5c38e823b267e17244c474e00b6c1c1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 20:48:56 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Mon, 11 Dec 2023 20:48:46 GMT
age: 4339252
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="docker-desktop-privilege-escalation-1.webp"
alt-svc: h3=":443"; ma=86400
content-length: 52608
x-amz-cf-id: 3QjEynlhvfbuK5YFviMqduAfakVjT3FEYfqGPL5dIltsRueU_zNF3A==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 27 KB
27 KB 38ms
35ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F01%2Fhero-tr-digital-world-map.jpg&size=1&version=1702327604&sig=96d1258d9976f05ee112e6fb827cea4a&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 5a478e51589e707487742d84d8e3fa5cbe095d5e0060e2080ae6a8b019c9d171

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 20:48:56 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Mon, 11 Dec 2023 20:48:46 GMT
age: 4339252
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="hero-tr-digital-world-map.webp"
alt-svc: h3=":443"; ma=86400
content-length: 27322
x-amz-cf-id: D6S6oXcNgrXFUXCfPjRgKlLZEaP1IbnUTUBdXCDbx2DdcfmgkgyqkA==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 17 KB
17 KB 42ms
39ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F01%2Fhero-tr-hand-microchip.jpg&size=1&version=1702327605&sig=bbadb4d2b7ef29f8462f8ad03402e784&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 11831be78f4141b18b1ff045a65cf7703f8181a822699cde5f2319dc392c5f67

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 20:48:56 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Mon, 11 Dec 2023 20:48:46 GMT
age: 4339252
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="hero-tr-hand-microchip.webp"
alt-svc: h3=":443"; ma=86400
content-length: 17332
x-amz-cf-id: UuznkvsuLuP5RiIzpE7b3IUtn3idjXNSOkMbG7jG4zMX4Fz_6J-_9Q==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 10 KB
10 KB 38ms
35ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2022%2F12%2Fthreat-research-blog-hero.jpeg&size=1&version=1702327605&sig=35c7f7401e782f460e5d21ee9ed9f742&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: aa7648e4c28aadc70b11a874b9fa4423e79f88d8bf87bd22cb956aa8fedad29f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 20:48:56 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Mon, 11 Dec 2023 20:48:46 GMT
age: 4339252
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="threat-research-blog-hero.webp"
alt-svc: h3=":443"; ma=86400
content-length: 10018
x-amz-cf-id: aBeYbU8weZf3f8TKYE3tqSxiyOOiMcHZzm-R_vmohfkuVQG-ihmtPw==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 196 KB
196 KB 42ms
39ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2022%2F12%2Fthreat-research-hero.jpeg&size=1&version=1692112173&sig=ddada10ff92149e9f4c87e9f7fb6e7f9&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 86e8b37fa004ddf5f2a20b33ffec6905866feb64aae71c065524e17fd5687f38

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 17 Sep 2023 14:37:24 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Sun, 17 Sep 2023 14:37:15 GMT
age: 11705543
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="threat-research-hero.webp"
alt-svc: h3=":443"; ma=86400
content-length: 200412
x-amz-cf-id: UbpyceN-wJKR30wp-ZBRo_iCsmVhQUohlamrxn0GqVgyKBDB4pJPiQ==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 20 KB
21 KB 24ms
21ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2022%2F11%2Fthreat-research-hero.jpg&size=1&version=1702327605&sig=713fdfbfe50dff002934c865aa54b9f6&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 952366b677cb051dfd4b892f04df0437d34570634196a971cfc4a95f3b563302

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 20:48:56 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Mon, 11 Dec 2023 20:48:46 GMT
age: 4339252
x-amz-cf-pop: FRA6-C1
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="threat-research-hero.webp"
alt-svc: h3=":443"; ma=86400
content-length: 20860
x-amz-cf-id: aXvFv2Q4TPoXnBhRSlQRSUqaWo5-ZZUwQK7SIwKFQfLmf1cf5L0osg==

GET
H2 200 email-decode.min.js Show response
www.cyberark.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
801 B 12ms
11ms Script
application/javascript 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Fri, 26 Jan 2024 10:32:07 GMT
server: cloudflare
content-encoding: gzip
etag: W/"65b38a27-4d7"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 84de6a234fce65d7-FRA
expires: Fri, 02 Feb 2024 02:09:48 GMT

GET
H2 200 hubs_app.00b1d4acfe61970d73c9.js Show response
content.cdntwrk.com/js/hubs/ 1 MB
312 KB 8ms
7ms Script
application/javascript 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.cdntwrk.com/js/hubs/hubs_app.00b1d4acfe61970d73c9.js
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f10bb7a28b21582f2d86a4715c62135e4940bf6149322102a331c982782cda1f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 16:35:37 GMT
content-encoding: gzip
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
age: 34452
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 30 Jan 2024 16:34:30 GMT
server: AmazonS3
etag: W/"31a902c2a7437d38450a26329087a9df"
access-control-max-age: 0
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding
x-amz-cf-id: TfClKjggIQR-5Q73Fdpc9mAt8p-Pd2BD1z4TPBYgmxpT4QovQrGhsw==

GET
H2 200 en.bundle.js Show response
cihost.uberflip.com/cyberArk/master/build/en/ 297 KB
86 KB 8ms
7ms Script
text/javascript 2600:9000:2156:9a00:12:53a8:95c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.bundle.js
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9a00:12:53a8:95c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5091bbe138e04f9f2176182d823e6a7cb8a30237acd606e8896d04f0fc04820f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 22:19:43 GMT
content-encoding: gzip
via: 1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
last-modified: Tue, 30 Jan 2024 22:19:22 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1706653155/ctime:1706653155/gid:127/gname:docker/md5:bf767c20e727a4cd2e51c9c0babe51fb/mode:33188/mtime:1706653155/uid:1001/uname:runner
x-amz-cf-pop: FRA50-C1
age: 13806
etag: W/"bf767c20e727a4cd2e51c9c0babe51fb"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: rycVF9GE5RgFrHLJbbV9B6cDbFASFfw-MUNM3Q4xCRFqPvvR2p-K3g==

GET
H3 200 sha256.min.js Show response
cdnjs.cloudflare.com/ajax/libs/js-sha256/0.9.0/ 9 KB
4 KB 23ms
13ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/js-sha256/0.9.0/sha256.min.js

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7157511697db744d384a5a2a8646af23f3c90560abf93bb240fdd690b29a898a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 974522
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2977
last-modified: Mon, 04 May 2020 16:11:50 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec6-2339"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LhxAMSa0nvjiKxwGNSdYrxVYxN4wWhHSj3vtWhd3fgCnOGH73ruPq2PGj1LoyzWsxcPNdj%2Bzb95NDJJtX7qx9FolMjkFeVbqFKBYMTLjIg%2FT0Q5v4GbLU%2FzvJdMtAtO5yfwh5RohiBvrRho0uOcLmUx%2B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 84de6a238cd32c1a-FRA
expires: Mon, 20 Jan 2025 02:09:48 GMT

GET
H2 200 External.svg
cihost.uberflip.com/cyberark-migration-tv2/OB-CyberArk_Migration_Tv2/assets/images/ 2 KB
1 KB 12ms
8ms Image
image/svg+xml 2600:9000:2156:9a00:12:53a8:95c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cihost.uberflip.com/cyberark-migration-tv2/OB-CyberArk_Migration_Tv2/assets/images/External.svg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9a00:12:53a8:95c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 49bdaf43b043fdd5e79f321a889502b341e83fb3d71caa9ec286369bcb205373

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 05:44:36 GMT
content-encoding: gzip
via: 1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
last-modified: Fri, 29 Jan 2021 17:35:02 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1611941654/ctime:1611941654/gid:117/gname:docker/md5:cd7c2cec63b67d7f1108cb091b478569/mode:33188/mtime:1611941654/uid:1001/uname:runner
x-amz-cf-pop: FRA50-C1
age: 73513
etag: W/"cd7c2cec63b67d7f1108cb091b478569"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-id: aIVot6getmjmImV82WGc6-w0-c0gvfdPAfKNSog-UDwUDJrJsuM40g==

GET
H2 200 External-darkblue.svg
cihost.uberflip.com/cyberark-migration-tv2/OB-CyberArk_Migration_Tv2/assets/images/ 952 B
1 KB 12ms
8ms Image
image/svg+xml 2600:9000:2156:9a00:12:53a8:95c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cihost.uberflip.com/cyberark-migration-tv2/OB-CyberArk_Migration_Tv2/assets/images/External-darkblue.svg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9a00:12:53a8:95c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1f150486021d4182821249f13273a7a87862756e2b021e3d19121aaae6a2e09d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 07:15:21 GMT
via: 1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
last-modified: Fri, 29 Jan 2021 20:02:50 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1611950517/ctime:1611950517/gid:117/gname:docker/md5:98bf2668c3bae975ce6b211e1acc322f/mode:33188/mtime:1611950517/uid:1001/uname:runner
x-amz-cf-pop: FRA50-C1
age: 68068
etag: "98bf2668c3bae975ce6b211e1acc322f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
accept-ranges: bytes
content-length: 952
x-amz-cf-id: UF5_dU0DLlv45UBKHo1mVj4iPUaPkgywQmfEIKkvRQvDtGozYJuR-g==

GET
H2 200 cyberark-logo-dark.svg
www.cyberark.com/wp-content/uploads/2021/01/ 4 KB
5 KB 40ms
37ms Image
image/svg+xml 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2021/01/cyberark-logo-dark.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67e2f25233ffe02ea0a70301e7440e6371d8943ca3f759b1d128b590e7e9419b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
content-encoding: gzip
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 503019
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 25 Jun 2021 13:14:28 GMT
server: cloudflare
etag: W/"60d5d6b4-f6a"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
cf-ray: 84de6a24183665d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 css
fonts.googleapis.com/ 28 KB
2 KB 21ms
20ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800&display=swap

Requested by

Host: cihost.uberflip.com
URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c6134e6ac14d17d2359f910de71889d3e82743aef08773c93901a12acf72f393

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 02:09:48 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 31 Jan 2024 02:09:48 GMT

GET
H2 200 css2
fonts.googleapis.com/ 676 KB
180 KB 24ms
23ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Noto+Sans+JP:wght@100;300;400;500;700;900&display=swap

Requested by

Host: cihost.uberflip.com
URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bb37fafaa4238ac3ff4133b841f54bde67b67063679de27cee551baf2696da3c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 01:24:21 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 31 Jan 2024 02:09:48 GMT

GET
H2 200 ajax_ping Show response
www.cyberark.com/resources/hubsFront/ 49 B
297 B 173ms
170ms XHR
application/json 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/resources/hubsFront/ajax_ping

Requested by

Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.00b1d4acfe61970d73c9.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74935268619be1f087ce67765abd72f80107125f23b346f7615cc9e6a19d4595

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.cyberark.com/
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: frame-ancestors 'self' https://www.cyberark.com/
referrer-policy: unsafe-url
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-frame-options: DENY
content-type: application/json
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
content-language: en
cf-ray: 84de6a24e89665d7-FRA
x-xss-protection: 1; mode=block

GET
H2 200 stats_temp_item_686500055xa651ab34a95142621fb02c36016982d35c05741c5f76aef7d17f8358f35489d0170666698741b8c092761467ec48fb748687efa4d4128da0890b88c04d95c983c832b1c773
www.cyberark.com/resources/hubsFront/signalMetricsTemp/ 0
178 B 166ms
166ms Image
text/html 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/resources/hubsFront/signalMetricsTemp/stats_temp_item_686500055xa651ab34a95142621fb02c36016982d35c05741c5f76aef7d17f8358f35489d0170666698741b8c092761467ec48fb748687efa4d4128da0890b88c04d95c983c832b1c773?t=1706666988317

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.cyberark.com/
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: frame-ancestors 'self' https://www.cyberark.com/
referrer-policy: unsafe-url
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-frame-options: DENY
content-type: text/html; charset=UTF-8
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
content-language: en
cf-ray: 84de6a2508a465d7-FRA
x-xss-protection: 1; mode=block

GET
H2 200 tag.aspx Show response
ml314.com/ 31 KB
11 KB 412ms
333ms Script
application/javascript 34.111.234.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?310
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.234.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 236.234.111.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 23f95a90d6e6ba09a92bd4eae99823b0a6b0137a9abe10e3c050c062fb15efe4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: br
x-guploader-uploadid: ABPtcPrGXMunJ8rhkyHZVouMcryNl5Y2W25bLT3Ji6jasEBd_HuVp5rp6IGHAibIm3Ityt6y0TQ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
last-modified: Mon, 10 Apr 2023 17:13:24 GMT
server: UploadServer
etag: W/"b0965f051977c0dd95ffe2c736cac352"
vary: Accept-Encoding
x-goog-generation: 1681146804366265
content-type: application/javascript
cache-id: FRA-fa985ced
x-goog-hash: crc32c=wVdAwA==, md5=sJZfBRl3wN2V/+LHNsrDUg==
cache-control: public,max-age=3600
x-cache-hit: miss
x-goog-stored-content-length: 32213
accept-ranges: none

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 31ms
7ms Script
application/x-javascript 184.31.85.59
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.85.59 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-85-59.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 31 Jan 2024 02:09:48 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H2 200 27v1i6bir9.jsonp Show response
fast.wistia.com/embed/medias/ 6 KB
2 KB 22ms
21ms Script
application/javascript 2a04:4e42:400::644
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/embed/medias/27v1i6bir9.jsonp

Requested by

Host: cihost.uberflip.com
URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::644 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

envoy /

Resource Hash

967db37138f1ed6222ca79897757975e45c87e73d6fccd0ac6785f3eb45090d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
x-player-privacy-mode: 1
x-content-type-options: nosniff
strict-transport-security: max-age=0
content-encoding: br
x-permitted-cross-domain-policies: none
via: 1.1 bf87b64ab79c59322d0e3419ad3e412a.cloudfront.net (CloudFront), 1.1 varnish, 1.1 varnish
x-amz-cf-pop: LAX50-P3
age: 38693
x-cache: Miss from cloudfront, HIT, HIT
x-envoy-upstream-service-time: 99
content-length: 1707
x-request-id: ed30087c-a567-4f4f-8f22-e3acd7841235
x-served-by: cache-iad-kjyo7100175-IAD, cache-fra-eddf8230024-FRA
x-runtime: 0.096868
x-browser-version: 120
server: envoy
x-timer: S1706666988.369354,VS0,VE1
etag: W/"967db37138f1ed6222ca79897757975e"
vary: Accept-Encoding,X-Forwarded-Proto,X-ECMA-Override
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, no-cache
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: hge9d4NYC7dOohqNqvxw-knL4iFPFKjGPINexqlVZZsugm1xz0wFoQ==
x-cache-hits: 14, 1

GET
H2 200 E-v1.js Show response
fast.wistia.com/assets/external/ 753 KB
127 KB 7ms
7ms Script
text/javascript 2a04:4e42:400::644
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/E-v1.js

Requested by

Host: cihost.uberflip.com
URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::644 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

042035f678e7f9dc023e5591b5e1a265fcf1540f7232e955efa255b329ec24cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: br
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=0
age: 1311
x-amz-server-side-encryption: AES256
x-cache: MISS, HIT
content-length: 129497
x-served-by: cache-iad-kcgs7200047-IAD, cache-fra-eddf8230024-FRA
x-browser-version: 120
last-modified: Tue, 30 Jan 2024 21:04:45 GMT
server: AmazonS3
x-timer: S1706666988.369430,VS0,VE0
etag: "be0f0f55f78542279ae31ee8ddb6b304"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=3600
x-browser: chrome
asset-version: 0c1863c09d8b681818d2eec147310f2ec40ee2ef
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 0, 35

GET
H3 200 sprite-1x.png
content.cdntwrk.com/img/hubs/ 59 KB
59 KB 9ms
8ms Image
image/png 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/img/hubs/sprite-1x.png
Requested by: Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/css/hubs/hubs.00b1d4acfe61970d73c9.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a249bcffb2d8e92a3bdff919def43b14841803ad93b80ffa864db1090e007594

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://content.cdntwrk.com/css/hubs/hubs.00b1d4acfe61970d73c9.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 06:07:15 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
age: 504153
x-amz-cf-pop: FRA6-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 60511
last-modified: Wed, 24 Jan 2024 23:39:21 GMT
server: AmazonS3
etag: "9e7227669aa01cd19bcc27e802668929"
access-control-max-age: 0
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: oCSkn9WQ2uNoNR8KOoWGYnU6Hb0KPSsOkat3E0qKlJd5FfRi9CPfRA==

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 uparrow.png
content.cdntwrk.com/img/hubs/ 194 B
542 B 8ms
7ms Image
image/png 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/img/hubs/uparrow.png
Requested by: Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/css/hubs/hubs.00b1d4acfe61970d73c9.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1fb7ee27fdfb34869f89aa51d9af1cf86ecc6800ab591ec3ca78f155742200b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://content.cdntwrk.com/css/hubs/hubs.00b1d4acfe61970d73c9.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 29 Jan 2024 02:39:02 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
age: 171047
x-amz-cf-pop: FRA6-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 194
last-modified: Thu, 18 Jan 2024 23:03:29 GMT
server: AmazonS3
etag: "e5bbd7205c8f2ff1cd6c9f777f31da64"
access-control-max-age: 0
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: I6xX3Z8nlEAQRdhzvOWuOZdjp1kGMVK7JvmfH5oGjvbptS6oROH3tA==

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
48 KB 35ms
11ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.cyberark.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 18:59:51 GMT
x-content-type-options: nosniff
age: 25797
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Jan 2025 18:59:51 GMT

GET
H2 200 fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/webfonts/ 61 KB
61 KB 14ms
13ms Font
application/octet-stream 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/webfonts/fa-solid-900.woff2

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62738b62849a46842f34013b8528886f10c8d0e1c9aec47d636e05d631e2f60e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css
Origin: https://www.cyberark.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
strict-transport-security: max-age=15780000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 504493
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 62472
last-modified: Mon, 04 May 2020 16:10:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e60-f408"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E%2FDiAw3D0%2BZdW8J0gLJA%2BY9hBAlDV1EtdqUh201QEQyBDlsocd4Vxr1pISI7X91eHhLbbkGsEX0CQ1smpXDhhxtxOJMebsQATKDOhI33SzpQw8iMbdeYWeDZw1cXvXjlNi9NWttG0pHLk%2BjWYmyw8A18"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 84de6a255d559be6-FRA
expires: Mon, 20 Jan 2025 02:09:48 GMT

GET
H2 200 372722_2_unhinted_0.woff2
cihost.uberflip.com/cyberArk/OB-3963/build/fonts/ 25 KB
26 KB 27ms
10ms Font
binary/octet-stream 2600:9000:2156:9a00:12:53a8:95c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cihost.uberflip.com/cyberArk/OB-3963/build/fonts/372722_2_unhinted_0.woff2
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9a00:12:53a8:95c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2f5f9d511700318e988d3ef843afc49224162c8bb2435db7b9dc3590f525306f

Request headers

Referer: https://www.cyberark.com/
Origin: https://www.cyberark.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 07:27:18 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
age: 67351
x-cache: Hit from cloudfront
content-length: 26033
last-modified: Wed, 27 May 2020 16:17:01 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1590596208/ctime:1590596208/gid:116/gname:docker/md5:83914a011477cb60998949144e2ac5aa/mode:33188/mtime:1590596208/uid:1001/uname:runner
etag: "83914a011477cb60998949144e2ac5aa"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, HEAD
content-type: binary/octet-stream
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: qMplyb5jYuos33iD7SR1DOzgidIat5vXOcif_EuptIBCx_-dN7tl1g==

GET
H2 200 372722_4_unhinted_0.woff2
cihost.uberflip.com/cyberArk/OB-3963/build/fonts/ 25 KB
25 KB 38ms
22ms Font
binary/octet-stream 2600:9000:2156:9a00:12:53a8:95c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cihost.uberflip.com/cyberArk/OB-3963/build/fonts/372722_4_unhinted_0.woff2
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9a00:12:53a8:95c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 66c708b80cab108a2fde84cac9677c07435537bc9d06085ccd1ac80cb93513b4

Request headers

Referer: https://www.cyberark.com/
Origin: https://www.cyberark.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 05:49:51 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
age: 73198
x-cache: Hit from cloudfront
content-length: 25237
last-modified: Wed, 27 May 2020 16:17:01 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1590596208/ctime:1590596208/gid:116/gname:docker/md5:da77e86db861301f9320c467d834e649/mode:33188/mtime:1590596208/uid:1001/uname:runner
etag: "da77e86db861301f9320c467d834e649"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, HEAD
content-type: binary/octet-stream
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: g4Vs-MABYteJelOjF9TCK7FDQJpzNuHzwiQHqrwIDE-G3Q7RPEyktw==

GET
H2 200 fa-brands-400.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/webfonts/ 63 KB
63 KB 15ms
13ms Font
application/octet-stream 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/webfonts/fa-brands-400.woff2

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5567c5a47f8bbd27707bd2cffdb1679c292a07ccf09a8578e1b9eba7ab481cf3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css
Origin: https://www.cyberark.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
strict-transport-security: max-age=15780000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5443635
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 64144
last-modified: Mon, 04 May 2020 16:10:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e60-fa90"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yOZ61BXEsno4JiqHO5fRaFAOKG1%2BYOCTCMGC9LAFD68%2F9RyhLJsrwN2XRR4NoQCV99M1c3Etu2uvolvhjpmsYFOj%2BGohdV3svyomc%2FR%2FXR34zojRZbojyHDP2n0IOIddM%2FC992anWRTuSFU0rK3eCxsg"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 84de6a256d5c9be6-FRA
expires: Mon, 20 Jan 2025 02:09:48 GMT

GET
H2 200 372722_1_unhinted_0.woff2
cihost.uberflip.com/cyberArk/OB-3963/build/fonts/ 25 KB
26 KB 36ms
20ms Font
binary/octet-stream 2600:9000:2156:9a00:12:53a8:95c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cihost.uberflip.com/cyberArk/OB-3963/build/fonts/372722_1_unhinted_0.woff2
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9a00:12:53a8:95c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d4761d421bbf2f059126b9ce4f5e0a9f7bc83b046a58162780a2b9c3ab8c9a56

Request headers

Referer: https://www.cyberark.com/
Origin: https://www.cyberark.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 05:49:51 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
age: 73198
x-cache: Hit from cloudfront
content-length: 26041
last-modified: Wed, 27 May 2020 16:17:01 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1590596208/ctime:1590596208/gid:116/gname:docker/md5:0601eae673330329b340003d42fc1c36/mode:33188/mtime:1590596208/uid:1001/uname:runner
etag: "0601eae673330329b340003d42fc1c36"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, HEAD
content-type: binary/octet-stream
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: bjmW2flBy8TTPd9R__yknz-JJSfBe0gsuQH6hiRz41CvL0CZhyjVnw==

GET
H2 200 fontawesome-webfont.woff2
cihost.uberflip.com/cyberark-migration-tv2/OB-CyberArk_Migration_Tv2/assets/fonts/ 75 KB
76 KB 39ms
23ms Font
binary/octet-stream 2600:9000:2156:9a00:12:53a8:95c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cihost.uberflip.com/cyberark-migration-tv2/OB-CyberArk_Migration_Tv2/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: cihost.uberflip.com
URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9a00:12:53a8:95c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
Origin: https://www.cyberark.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 07:15:23 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a02.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
age: 68066
x-cache: Hit from cloudfront
content-length: 77160
last-modified: Wed, 27 Jan 2021 17:56:57 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1611770160/ctime:1611770160/gid:117/gname:docker/md5:af7ae505a9eed503f8b8e6982036873e/mode:33188/mtime:1611770160/uid:1001/uname:runner
etag: "af7ae505a9eed503f8b8e6982036873e"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, HEAD
content-type: binary/octet-stream
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: d6pn1T95yPUklMGbnwm8kIJLHUtudbCDeNfj4xg1ZzFZLSHvvyoTzg==

GET
H2 200 id Show response
dpm.demdex.net/ 367 B
917 B 144ms
30ms XHR
application/json 52.209.137.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=9AB97041603F3EDB0A495C66%40AdobeOrg&d_nsid=0&ts=1706666988420

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.209.137.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-209-137-59.eu-west-1.compute.amazonaws.com

Software

Resource Hash

eb18e0f900e94a80c5651502a21a454e97ecb22d662bcf0e9ff7e86737c511b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

dcs: dcs-prod-irl1-2-v054-0df1f10d6.edge-irl1.demdex.com 1 ms
pragma: no-cache
date: Wed, 31 Jan 2024 02:09:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-tid: 2QPCAB5FQJ0=
vary: Origin
content-type: application/json;charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://www.cyberark.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 311
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 34 KB
12 KB 8ms
8ms Script
application/x-javascript 2a02:26f0:480:980::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:980::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "dfdd9e1f988805f0c2fbb10cd6b8f034:1663863409.614694"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12384
expires: Wed, 31 Jan 2024 03:09:48 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 3 KB
2 KB 7ms
7ms Script
application/x-javascript 2a02:26f0:480:980::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:980::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "b89fcb8870ac40eecb6d3cc844d35389:1663863409.92483"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1598
expires: Wed, 31 Jan 2024 03:09:48 GMT

GET
H2 200 d24194f2-6101-4c07-b071-d2eb5d40f5e6.js Show response
j.6sc.co/j/ 854 B
1 KB 463ms
436ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/d24194f2-6101-4c07-b071-d2eb5d40f5e6.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: b06ee181a056d674f14dc07a3cf5eaf2b4f85aa65def46ee9c33cffda18573bb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-amz-version-id: E_7p8DmUGF.SFGebCI0B6mb0uV3e3zDK
date: Wed, 31 Jan 2024 02:09:48 GMT
x-amz-cf-pop: FRA60-P1
x-amz-server-side-encryption: AES256
x-amz-meta-content-type: application/json
content-length: 854
pragma: no-cache
last-modified: Thu, 07 Sep 2023 14:27:11 GMT
server: AmazonS3
etag: "b87bd20cfa5f7954aff6c87638984d17"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: RrJ8mGcYC97k8KKKIojNVK1UIVGH81hPkQoInYOQ1JdvCt_Q0saoYw==
expires: Wed, 31 Jan 2024 02:09:48 GMT

GET
H/1.1 200
OK rtp.js Show response
sjrtp6-cdn.marketo.com/rtp-api/v1/ 152 KB
42 KB 405ms
147ms Script
application/x-javascript 104.122.39.154
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.122.39.154 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-122-39-154.deploy.static.akamaitechnologies.com

Software

Jetty(9.4.45.v20220203) /

Resource Hash

aa65b2577c91e2a417e095cd4f53f3c6990e7d6fd7d4bc8088467b187f0a9bfa

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Strict-Transport-Security: max-age=63113904
Content-Encoding: gzip
Date: Wed, 31 Jan 2024 02:09:48 GMT
Last-Modified: Sat, 13 Jan 2024 02:04:47 GMT
Server: Jetty(9.4.45.v20220203)
Vary: Accept-Encoding
Content-Type: application/x-javascript; charset=UTF-8
Cache-Control: public, max-age=149
Connection: keep-alive
Content-Length: 42537

GET
H2 200 notice Show response
consent.trustarc.com/ 14 KB
6 KB 79ms
42ms Script
text/javascript 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/notice?domain=cyberark.com&c=teconsent&js=nj&noticeType=bb&gtm=1&pcookie=1&text=true&language=en

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

fa419d389bf4bc139c32766832915eaab6bd0a1348d06b139c35a20d059a44a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 2b2e2811e641703aebf776da39317b9c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-cache: Miss from cloudfront
cloudfront-viewer-country: DE
content-length: 5465
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
cloudfront-viewer-country-region: BY
timing-allow-origin: *
x-amz-cf-id: -A1_TyJ6RAmF3bT_UG4MK69d2tPvdBehYezntoxoGyVjFaid9R5o3g==
expires: Wed, 31 Jan 2024 03:09:48 GMT

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 28 KB
9 KB 32ms
8ms Script
application/javascript 2a04:4e42:600::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: eec8fb654765dfbba9b783382bfc8ecda7db21a2e24ffde27d19624ae2287d9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Tue, 30 Jan 2024 22:08:33 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "cdb613b732483a878e5e73924ee9a02f"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 8623

GET
H2 200 ransomware-playing-a-broken-game.png
www.cyberark.com/wp-content/uploads/2024/01/ 160 KB
164 KB 21ms
20ms Image
image/webp 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2024/01/ransomware-playing-a-broken-game.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

109ca7e634fbb0f86039dbc8e7c61e891170326321f7e4be3ba29c9caa364ccc

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6029
cf-polished: origFmt=png, origSize=181372
content-disposition: inline; filename="ransomware-playing-a-broken-game.webp"
content-length: 164256
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Thu, 25 Jan 2024 08:10:15 GMT
server: cloudflare
etag: "65b21767-2c47c"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 84de6a25e8ff65d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 ct Show response
obs.segreencolumn.com/ 4 KB
2 KB 611ms
406ms Script
text/javascript 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.segreencolumn.com/ct?id=45375&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&sf=0&tpi=&ch=cheq4ppc&uvid=&tsf=0&tsfmi=&tsfu=&cb=1706666988565&hl=2&op=0&ag=3007465733&rand=537861119220721198210962661068110481604668860124707296065012046911165669110789180069&fs=1600x1200&fst=1600x1200&np=win32&nv=google%20inc.&ref=&ss=1600x1200&nc=0&at=&di=W1siZWYiLDMwMjddLFsxMiwie1wiY3R4XCI6XCJ3ZWJnbFwiLFwidlwiOlwiaW50ZWwgaW5jLlwiLFwiclwiOlwiaW50ZWwgaXJpcyBvcGVuZ2wgZW5naW5lXCIsXCJzbHZcIjpcIndlYmdsIGdsc2wgZXMgMS4wIChvcGVuZ2wgZXMgZ2xzbCBlcyAxLjAgY2hyb21pdW0pXCIsXCJndmVyXCI6XCJ3ZWJnbCAxLjAgKG9wZW5nbCBlcyAyLjAgY2hyb21pdW0pXCIsXCJndmVuXCI6XCJ3ZWJraXRcIixcImJlblwiOjUsXCJ3Z2xcIjoxLFwiZ3JlblwiOlwid2Via2l0IHdlYmdsXCIsXCJzZWZcIjozNjk4NTE4NzEwLFwic2VjXCI6XCJcIn0iXSxbMzcsIlszMzE2MjI0MDQ5LGZ1bmN0aW9uKG5ld1ZhbHVlKSB7XG4gICAgICAgICAgICAgIGFkZENvbnRlbnRXaW5kb3dQcm94eSh0aGlzKVxuICAgICAgICAgICAgICAvLyBSZXNldCBwcm9wZXJ0eSwgdGhlIGhvb2sgaXMgb25seSBuZWVkZWQgb25jZVxuICAgICAgICAgICAgICBPYmplY3QuZGVmaW5lUHJvcGVydHkoaWZyYW1lLCAnc3JjZG9jJywge1xuICAgICAgICAgICAgICAgIGNvbmZpZ3VyYWJsZTogZmFsc2UsXG4gICAgICAgICAgICAgICAgd3JpdGFibGU6IGZhbHNlLFxuICAgICAgICAgICAgICAgIHZhbHVlOiBfc3JjZG9jXG4gICAgICAgICAgICAgIH0pXG4gICAgICAgICAgICAgIF9pZnJhbWUuc3JjZG9jID0gbmV3VmFsdWVcbiAgICAgICAgICAgIH1dIl0sWyJjYiIsIjEsMCwwLDAsMCwwLDAsMCwwLDIsMCwwLDcsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMjIsMCwwLDAsMCwwLDAsMCwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsNSwwLDEsMCwwLDAsMCwwLDMsMCJdLFstMSwiLSJdLFstMiwiNixlQUhXWDEvZjNxekN2Ymt1eW1Rd2dsSWFGM3BFc1JFRVRwb1ZkRlZCUVFwUmNSQkZTS0lJZ2lSSXIwS2hKUnFwU0F0Q0FrUUhwSXp5YmJYcG1aci81L2Q5NmJ6Y3VTQVBKL0d0Il0sWy0zLCJbXCJpbnRlcm5hbC1wZGYtdmlld2VyXCIsXCJtaGpmYm1kZ2NmamJicGFlb2pvZm9ob2VmZ2llaGphaVwiLFwiaW50ZXJuYWwtbmFjbC1wbHVnaW5cIl0iXSxbLTQsIi0iXSxbLTUsIi0iXSxbLTYsIi0iXSxbLTcsIi0iXSxbLTgsIi0iXSxbLTksIisiXSxbLTEwLCItIl0sWy0xMSwie1widFwiOlwiXCIsXCJtXCI6W1widGl0bGVcIixcImRlc2NyaXB0aW9uXCIsXCJvZzp0aXRsZVwiLFwib2c6ZGVzY3JpcHRpb25cIixcInR3aXR0ZXI6dGl0bGVcIixcInR3aXR0ZXI6ZGVzY3JpcHRpb25cIl19Il0sWy0xMiwibnVsbCJdLFstMTMsIi0iXSxbLTE0LCItIl0sWy0xNSwiLSJdLFstMTYsIjAiXSxbLTE3LCI0Il0sWy0xOCwiWzAsMCwwLDFdIl0sWy0xOSwiWzAsMCwwLDAsMCwwLDEsMjQsMjQsXCItXCIsMTYwMCwxMjAwLDE2MDAsMTIwMCwxNjAwLDEyMDAsMTYwMCwxMjAwLDAsMCwwLDAsXCItXCIsXCItXCIsMTYwMCwxMjAwXSJdLFstMjAsIi0iXSxbLTIxLCItIl0sWy0yMiwiW1wiblwiLFwiblwiXSJdLFstMjMsIisiXSxbLTI0LCJbXSJdLFstMjUsIi0iXSxbLTI2LCJ7XCJ0amhzXCI6MjA1MDAwMDAsXCJ1amhzXCI6MTUyMDAwMDAsXCJqaHNsXCI6Mzc2MDAwMDAwMH0iXSxbLTI3LCJbMCw5LjksMCxcIjRnXCIsbnVsbF0iXSxbLTI4LCJlbi1VUyxlbiJdLFstMjksIi0iXSxbLTMwLCJbXCJ2XCIsMF0iXSxbLTMxLCJmYWxzZSJdLFstMzIsIi0iXSxbLTMzLCItIl0sWy0zNCwiLSJdLFstMzUsIlsxNzA2NjY2OTg4NTI2LC0xXSJdLFstMzYsIltcIjQvM1wiLFwiNC8zXCJdIl0sWy0zNywiLTE0NC02Ni0xODAtIl0sWy0zOCwibCwtMSwtMSwwLDAsOSwwLDAsMTcsMjk4LC0xLDAsLCw4OTgsODk5Il0sWy0zOSwiW1wiMjAwMzAxMDdcIiw0LFwiR2Vja29cIixcIk5ldHNjYXBlXCIsXCJNb3ppbGxhXCIsbnVsbCxudWxsLHRydWUsOCxmYWxzZSxudWxsLDMsZmFsc2UsdHJ1ZSxudWxsLDAsdHJ1ZSx0cnVlXSJdLFstNDAsIjMzIl0sWy00MSwiLSJdLFstNDIsIjE3MjQyOTc2NTMiXSxbLTQzLCIwMDAwMDAwMTAxMDAwMDAxMDAxMTEwMTEwMDEwMTEwMTAwMDAwMSJdLFstNDQsIjAsMCwwLDUiXSxbLTQ1LCI2MjAsNjc3LDAsMCwwLDU2MiwwLDAsNjQ4LDAsMCwwLDAsMCwwLDAsMCwwLDAsNjg0LDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwIl0sWy00NiwiMCJdLFstNDcsIkV1cm9wZS9CZXJsaW4sZW4tVVMsbGF0bixncmVnb3J5Il0sWy00OCwiMCwwIl0sWy00OSwiLSJdLFstNTAsIi0iXSxbLTUxLCItIl0sWy01MiwiLSJdLFstNTMsIjEwMCJdLFstNTQsIntcImhcIjpbXCIzNTc0NDA3MDA3XCIsXCIyNzg4NTQwNDU1XCIsXCJfM1wiLFwiMjg3Mjg5OTMyMFwiLFwiMzY4MDM3Nzk5MlwiLFwiNzUwNTYyNzQyXCJdLFwiZFwiOltdLFwiYlwiOltdLFwic1wiOjF9Il0sWy01NSwiMSJdLFstNTYsImxhbmRzY2FwZS1wcmltYXJ5Il0sWy01NywiV0UwWlYxeE9jVmhYWFZWY1N4Y0ZXbFpVU1V4TlhGMEhHV0pZU2hsWVNVbFZRR1FaRVZ4UFdGVVpXRTBaQlZoWFZsZEFWRlpNU2djWkVRTU9Bd2dNQ1E0SUFSQVZHUVZZVjFaWFFGUldURW9IQXdnQkF3b0pFQlZZVFJsNFMwdFlRQmRjWEJrUlVVMU5TVW9ERmhaV1d4ZEtYRjVMWEZ4WFdsWlZURlJYRjFwV1ZCWlFGZ0VOV2w4S0NROExYd0FCV2x0WVd3QUFEVjBQQ2dCWUFBNE1Xd3NPQUFGY0YxTktBd2dERHc4SUNnRVFGVmhOR1UwWFhFRkpWa3ROU2hrUlVVMU5TVW9ERmhaV1d4ZEtYRjVMWEZ4WFdsWlZURlJYRjFwV1ZCWlFGZ0VOV2w4S0NROExYd0FCV2x0WVd3QUFEVjBQQ2dCWUFBNE1Xd3NPQUFGY0Z3PT0iXSxbLTU4LCItIl0sWy01OSwiZGVmYXVsdCJdLFstNjAsMjIyXSxbLTYxLCJ7XCJ3Z3NsXCI6XCIwO1wiLFwicGNmXCI6XCJiZ3JhOHVub3JtXCJ9Il0sWy02MiwiODAiXSxbLTYzLCIwIl0sWy02NCwiWzAsXCJcIixbXV0iXSxbLTY1LCItIl0sWy02NiwiZ2VvbG9jYXRpb24sc3RvcmFnZWFjY2VzcyxnYW1lcGFkLGNoZWN0LG1pZGksZGlzcGxheWNhcHR1cmUsdXNiLGxvY2FsZm9udHMscGljdHVyZWlucGljdHVyZSxwdWJsaWNrZXljcmVkZW50aWFsc2dldCxvdHBjcmVkZW50aWFscyxjaHVhZm9ybWZhY3RvcixlbmNyeXB0ZWRtZWRpYSxjaHNhdmVkYXRhLGNodWFmdWxsdmVyc2lvbmxpc3QsY2h1YXdvdzY0LGNoZG93bmxpbmssY2hwcmVmZXJzY29sb3JzY2hlbWUsc3luY3hocixjaHVhbW9kZWwsY2hwcmVmZXJzcmVkdWNlZHRyYW5zcGFyZW5jeSxzZXJpYWwsY2FtZXJhLGNocHJlZmVyc3JlZHVjZWRtb3Rpb24scHJpdmF0ZXN0YXRldG9rZW5pc3N1YW5jZSxpZGVudGl0eWNyZWRlbnRpYWxzZ2V0LGNodWFmdWxsdmVyc2lvbixmdWxsc2NyZWVuLGNoZHByLHVubG9hZCxrZXlib2FyZG1hcCxjaHVhcGxhdGZvcm0sZ3lyb3Njb3BlLGNodWFtb2JpbGUsd2luZG93bWFuYWdlbWVudCxjaHVhLG1hZ25ldG9tZXRlcixhY2NlbGVyb21ldGVyLHByaXZhdGVzdGF0ZXRva2VucmVkZW1wdGlvbixjaHVhYXJjaCx4cnNwYXRpYWx0cmFja2luZyxpZGxlZGV0ZWN0aW9uLGNodWFwbGF0Zm9ybXZlcnNpb24sY2h3aWR0aCxjbGlwYm9hcmRyZWFkLGNodmlld3BvcnR3aWR0aCxwYXltZW50LGNodmlld3BvcnRoZWlnaHQsY2hydHQsYXV0b3BsYXksY3Jvc3NvcmlnaW5pc29sYXRlZCxoaWQsY2h1YWJpdG5lc3Msc2NyZWVud2FrZWxvY2ssY2xpcGJvYXJkd3JpdGUsY2hkZXZpY2VtZW1vcnksbWljcm9waG9uZSJdLFstNjcsIjI1MzIzMTI4ODg6MTgiXSxbLTY4LCItIl0sWyJkZGIiLCIwLDYsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMSwwLDAsMCwwLDAsMCwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMSwxLDAsMCwwLDAsMCwxLDEsOSwwLDAsMCwwLDEsMCwwLDAsMCwwLDAsMCwxLDAsNCwwLDAsMCwwLDAsMSwxOCwwIl0sWyJibmNoIiw5MV0sWyJhYm5jaCIsOTFdXQ%3D%3D&dep=0&pre=0&sdd=%7B%7D&cri=OK0RJ8WkM1&pto=937&ver=58&gac=-&mei=&ap=&fe=1&duid=1.1706666988.tzQBQN1kVVf08y1p&suid=1.1706666988.7OpGjhjFIbto6RkH&tuid=1.1706666988.5Ggva5KXzNujjZ1L&fbc=-&gtm=W10%3D&it=60%2C332%2C239&fbcl=-&gacl=-&gacsd=-&rtic=-&bgc=-&spa=1&urid=0&ab=jx.2.0%3B
Requested by: Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 0c06a244d9282c17ecb2ae5d1d3f3ca3a103b0207904cb31af0b86c5e5073b00

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

content-type: text/javascript
pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 1458
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 aHViPTEwODU0MCZjbWQ9YmFja2dyb3VuZF9pbWFnZSZ2ZXJzaW9uPTE2OTk0NjY2MDEmc2lnPWI2YzQzMzhjYjNhMjI2NGQ2NjExNDIyNjlhYjM3MTFj
content.cdntwrk.com/files/ 93 KB
93 KB 9ms
8ms Image
image/webp 99.86.4.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/files/aHViPTEwODU0MCZjbWQ9YmFja2dyb3VuZF9pbWFnZSZ2ZXJzaW9uPTE2OTk0NjY2MDEmc2lnPWI2YzQzMzhjYjNhMjI2NGQ2NjExNDIyNjlhYjM3MTFj
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.86.4.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-13.fra6.r.cloudfront.net
Software: /
Resource Hash: 619ddc1d756bc60de4717303471873db6bbc6da6106ad99231472aecdb6c3040

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 08 Nov 2023 18:04:04 GMT
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
last-modified: Thu, 18 Feb 2021 22:21:19 GMT
age: 7200343
x-amz-cf-pop: FRA6-C1
etag: "1613686879-be99bf6a6e12dc968d17e108eb199e37"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=15552000
content-disposition: inline; filename="background_image.webp"
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: Z67-zfawW0wyk6CSseNiBlxwwPOTz09PE3G4DvAutI9dR08g4fk6aw==

POST
H2 200 ajax_updateMAPUsers Show response
www.cyberark.com/resources/hubsFront/ 126 B
188 B 153ms
152ms XHR
application/json 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/resources/hubsFront/ajax_updateMAPUsers

Requested by

Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.00b1d4acfe61970d73c9.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b98e0f76f97857fce1b3fbd8e9ed5775988e85fffd71dcc2422f8d012378ea34

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.cyberark.com/
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: frame-ancestors 'self' https://www.cyberark.com/
referrer-policy: unsafe-url
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-frame-options: DENY
content-type: application/json
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
content-language: en
cf-ray: 84de6a26a94365d7-FRA
x-xss-protection: 1; mode=block

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 32ms
7ms Script
text/javascript 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 31 Jan 2024 01:48:09 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 1299
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 31 Jan 2024 03:48:09 GMT

GET
H2 200 secondary-structures.png
www.cyberark.com/wp-content/uploads/2024/01/ 10 KB
14 KB 23ms
22ms Image
image/webp 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2024/01/secondary-structures.png

Requested by

Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.00b1d4acfe61970d73c9.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9021d8e270fe8789573c83781201ae6654fb9453631271456ca0a6cbff2a7fee

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6029
cf-polished: origFmt=png, origSize=56162
content-disposition: inline; filename="secondary-structures.webp"
content-length: 10578
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Thu, 25 Jan 2024 07:31:27 GMT
server: cloudflare
etag: "65b20e4f-db62"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 84de6a27196e65d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 1400-milliseconds.png
www.cyberark.com/wp-content/uploads/2024/01/ 7 KB
11 KB 25ms
24ms Image
image/webp 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2024/01/1400-milliseconds.png

Requested by

Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.00b1d4acfe61970d73c9.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf71d755c2a7a19f401bce0018d981f8cc4a08dae5301a8fd78b78cb8a8881d2

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com .segreencolumn.com cnv.event.prod.bidr.io simpli.fi .simpli.fi data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6029
cf-polished: origFmt=png, origSize=18092
content-disposition: inline; filename="1400-milliseconds.webp"
content-length: 7600
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Thu, 25 Jan 2024 07:34:32 GMT
server: cloudflare
etag: "65b20f08-46ac"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 84de6a27196f65d7-FRA
expires: Thu, 30 Jan 2025 02:09:48 GMT

GET
H2 200 dest5.html Show response
cyberark.demdex.net/ Frame 0974 7 KB
3 KB 57ms
30ms Document
text/html 52.209.137.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cyberark.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.209.137.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-209-137-59.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Wed, 31 Jan 2024 02:09:48 GMT
dcs: dcs-prod-irl1-2-v054-0ead1cbb3.edge-irl1.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Wed, 8 Nov 2023 17:04:15 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: IIQDDxOzSRU=

GET
H2

200

ibs:dpid=411&dpuuid=Zbmr7AAAAN0jwANe
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=29536971682366275851737429685191035098
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zbmr7AAAAN0jwANe

42 B
717 B

31ms
30ms

Image
image/gif

52.209.137.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zbmr7AAAAN0jwANe

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Server

52.209.137.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-209-137-59.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

dcs: dcs-prod-irl1-1-v054-0c9232abe.edge-irl1.demdex.com 1 ms
pragma: no-cache
date: Wed, 31 Jan 2024 02:09:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: zbG6MldPQZY=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Zbmr7AAAAN0jwANe
Date: Wed, 31 Jan 2024 02:09:48 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 delivery Show response
cyberark.tt.omtrdc.net/rest/v1/ 351 B
845 B 126ms
44ms XHR
application/json 66.235.152.225
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://cyberark.tt.omtrdc.net/rest/v1/delivery?client=cyberark&sessionId=64b61cd44bef410f83edc62961441729&version=2.10.2

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.225 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-66-235-152-225.data.adobedc.net

Software

jag /

Resource Hash

3927bde3719197a23a7d4e791123e5d0a13648789d66e6fd67cc31c84b964cfe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: jag
x-content-type-options: nosniff
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.cyberark.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
x-request-id: 4bfe46f0-2dd4-482d-9954-3d4ef714d921

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 12ms
12ms Script
application/x-javascript 184.31.85.59
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.85.59 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-85-59.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 31 Jan 2024 02:09:48 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Fri, 10 May 2024 02:09:48 GMT

GET
H2 200 v1.7-4958 Show response
consent.trustarc.com/asset/notice.js/v/ 92 KB
27 KB 26ms
9ms Script
text/javascript 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/asset/notice.js/v/v1.7-4958

Requested by

Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=cyberark.com&c=teconsent&js=nj&noticeType=bb&gtm=1&pcookie=1&text=true&language=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

b30331795881ff744d78b4dd58ff581d6d10f2bb4fce96ea7c18e01f79a17c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Origin: https://www.cyberark.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:17:47 GMT
content-encoding: gzip
via: 1.1 286eb4b50e0acf373dd03645aee00b7e.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA2-C2
age: 3121
x-cache: Hit from cloudfront
pragma: public
last-modified: Mon, 22 Jan 2024 02:40:13 GMT
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: b27y9yO8pLanZxT1qsylCz-LXk0jso3VtYgafHVGH6zsKx0ltjC6og==
expires: Fri, 01 Mar 2024 01:17:47 GMT

GET
H2 200 get Show response
consent.trustarc.com/ Frame A353 2 KB
1 KB 9ms
8ms Document
text/html 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/get?name=crossdomain.html&domain=cyberark.com

Requested by

Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=cyberark.com&c=teconsent&js=nj&noticeType=bb&gtm=1&pcookie=1&text=true&language=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

4e02fda4bdfbdf9df0e3523b8b2b385afbd007a3f8318e0e640f8d0a0da100be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3221
cache-control: max-age=2592000
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Wed, 31 Jan 2024 01:16:07 GMT
expires: Fri, 01 Mar 2024 01:16:07 GMT
pragma: public
strict-transport-security: max-age=31536000; includeSubDomains
timing-allow-origin: *
vary: Origin
via: 1.1 2b2e2811e641703aebf776da39317b9c.cloudfront.net (CloudFront)
x-amz-cf-id: dWWTIydk6_BqqfWE1uIRAsN3aHfa8GrQfx4v7wLY5uqtsLPiWvXzdw==
x-amz-cf-pop: FRA2-C2
x-cache: Hit from cloudfront

GET
H2 200 log
consent.trustarc.com/ 43 B
427 B 40ms
39ms Image
image/gif 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.trustarc.com/log?domain=cyberark.com&country=de&state=&behavior=expressed&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW&c=f229&referer=https://www.cyberark.com

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:48 GMT
via: 1.1 2b2e2811e641703aebf776da39317b9c.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA2-C2
vary: Origin
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
x-amz-cf-id: 4j5loevPxHkbJZ1nauNbhjNBjSuuRnbY0-c91rvw_FTSfON0hfTofg==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 t2_o2i62ves_telemetry Show response
conversions-config.reddit.com/v1/pixel/config/ 86 B
424 B 34ms
10ms XHR
application/json 151.101.1.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://conversions-config.reddit.com/v1/pixel/config/t2_o2i62ves_telemetry
Requested by: Host: www.redditstatic.com
URL: https://www.redditstatic.com/ads/pixel.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
nel: {"report_to":"w3-reporting-nel","max_age":14400,"include_subdomains":false,"success_fraction":0.3,"failure_fraction":0.3}
report-to: {"group":"w3-reporting-nel","max_age":14400,"include_subdomains":false,"endpoints":[{"url":"https://w3-reporting-nel.reddit.com/reports"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=300
content-length: 86
x-served-by: cache-fra-etou8220104-FRA

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 30ms
6ms Image
image/gif 151.101.1.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1706666988736&id=t2_o2i62ves&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=ce75cd82-b6ad-40b1-9bf7-fcecbb93b577&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_26e8ea0f&dpm=&dpcc=&dprc=
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 RCaadfaa88901e4f0e8cbb8050b0941051-source.min.js Show response
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/c9fca00f1528/ 538 B
585 B 9ms
8ms Script
application/x-javascript 2a02:26f0:480:980::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/c9fca00f1528/RCaadfaa88901e4f0e8cbb8050b0941051-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:980::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: add45a468bcd64e33645f15b1870b5813d1ff1fe97c59cb4bcd9e98fa09c66fe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: gzip
last-modified: Fri, 27 Oct 2023 18:01:17 GMT
server: AkamaiNetStorage
etag: "27301ca53ed689497d352b9a4a49a8d7:1698429677.369864"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 327
expires: Wed, 31 Jan 2024 03:09:48 GMT

GET
H2

200

main.js Show response
www.cyberark.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea25f566/ Frame 50F7
Redirect Chain

https://www.cyberark.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://www.cyberark.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea25f566/main.js

7 KB
4 KB

12ms
12ms

Script
application/javascript

104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea25f566/main.js

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5d5440531634243b964eb7c0402577b778dd37c79e8bd00e968a74a1a5ee8d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
vary: accept-encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 84de6a2889e965d7-FRA

Redirect headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
vary: accept-encoding
access-control-allow-origin: *
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/ea25f566/main.js
cache-control: max-age=300, public
cf-ray: 84de6a27f9ae65d7-FRA

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
222 B 18ms
17ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=697407376&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&ul=en-us&de=UTF-8&dt=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEABAAAAACAEK~&jid=2034540886&gjid=1504615115&cid=649116550.1706666989&tid=UA-44168172-9&_gid=1195797681.1706666989&_slc=1&gtm=45He41t0n715SFWTHv72025662&cd6=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&cd7=&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&z=605865899

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5cbd2c4ce1325baae0fa325bdd95a25a925b094d7e88fc6fcebb834a6906c5b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.cyberark.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
350 B 61ms
20ms XHR
text/plain 2a00:1450:400c:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-44168172-9&cid=649116550.1706666989&jid=2034540886&gjid=1504615115&_gid=1195797681.1706666989&_u=YGBAgEABAAAAAGAEK~&z=1027481915

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0b::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Wed, 31 Jan 2024 02:09:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.cyberark.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 183 KB
67 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9920016

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

95317aa6431ef9b6b7d41a92c40a9fa04a1480d01bf66c7ffef3a808e6fad87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68110
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 31 Jan 2024 02:09:48 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 264 KB
86 KB 31ms
31ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-XTLTD7RKN5&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

418cd513eedba428ed1de803a768ba7f89ad95211264ed386511779082b64a9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 88062
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 31 Jan 2024 02:09:48 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 50ms
21ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-44168172-9&cid=649116550.1706666989&jid=2034540886&_u=YGBAgEABAAAAAGAEK~&z=189530080

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 46ms
21ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-44168172-9&cid=649116550.1706666989&jid=2034540886&_u=YGBAgEABAAAAAGAEK~&z=189530080

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK visitWebPage
316-czp-275.mktoresp.com/webevents/ 2 B
318 B 1093ms
159ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://316-czp-275.mktoresp.com/webevents/visitWebPage?_mchNc=1706666988924&_mchCn=&_mchId=316-CZP-275&_mchTk=_mch-cyberark.com-1706666988924-93023&_mchHo=www.cyberark.com&_mchPo=&_mchRu=%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&_mchPc=https%3A&_mchVr=163&_mchEcid=9AB97041603F3EDB0A495C66%40AdobeOrg%3A6%3A24522342195950103481362658830194909047&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 31 Jan 2024 02:09:49 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 10c27dfe-d6a1-4a99-ac87-f234bd8dc344

GET
H2 200 utsync.ashx Show response
ml314.com/ 62 B
309 B 103ms
101ms Script
application/javascript 34.111.234.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=52079&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&pv=1706666988927_nu8udxnj5&bl=en-us&cb=2512060&return=&ht=&d=&dc=&si=1706666988927_nu8udxnj5&cid=production%7C%7C108540%7C%7C6824673%7C%7C686500055&s=1600x1200&rp=&v=2.5.3.49
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?310
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.234.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 236.234.111.34.bc.googleusercontent.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
via: 1.1 google
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: application/javascript; charset=utf-8
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62
expires: 0

GET
H/1.1 200
OK ud.ashx Show response
in.ml314.com/ 20 B
482 B 485ms
187ms Script
application/javascript 54.161.243.53
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://in.ml314.com/ud.ashx?topiclimit=&cb=3102024&v=2.5.3.49
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?310
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.161.243.53 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-161-243-53.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 31 Jan 2024 02:09:49 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public
Connection: keep-alive
Content-Length: 138
Expires: Thu, 01 Feb 2024 02:09:49 GMT

GET
DATA 200
OK truncated
/ 2 KB
2 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe2d7250cc0730dc655721c5fa4bf5236dcabdf57f8593e8fe2096a42c0c8baf

Request headers

Referer
Origin: https://www.cyberark.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 720108237abe64d91c196c702445cf32.webp
embed-ssl.wistia.com/deliveries/ 71 KB
72 KB 66ms
9ms Image
image/webp 2600:9000:211e:5a00:1e:c86:4140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://embed-ssl.wistia.com/deliveries/720108237abe64d91c196c702445cf32.webp?image_crop_resized=1894x918
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:5a00:1e:c86:4140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: envoy /
Resource Hash: 11dfb20b20673222042301dcd78e577249c31bf357b58ebf97a4c7ecb241beeb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 15:37:44 GMT
access-control-request-method: *
via: 1.1 3acba66e95e31977aee0842f44a6f08e.cloudfront.net (CloudFront)
x-cdn: cloudfront
x-amz-cf-pop: FRA56-C2
age: 37925
edge-cache-tag: 720108237abe64d91c196c702445cf32
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 375
content-disposition: inline
surrogate-key: 720108237abe64d91c196c702445cf32 thumbnail-delivery
last-modified: Thu, 25 Jan 2024 12:16:05 UTC
server: envoy
etag: 7SqNpehd3Nksm1qk2DvOl5NHt2o=
vary: Origin
content-type: image/webp
cache-control: max-age=31536000
accept-ranges: none
x-amz-cf-id: 2d3YvroRKpiuBvjo9wsRYdmu5ZojvolCaWuVc392AnyN-DmYw7Gf-A==

GET
H2 200 RC215bf8f3db2048f5a863a53bd773832d-source.min.js Show response
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/c9fca00f1528/ 429 B
536 B 9ms
7ms Script
application/x-javascript 2a02:26f0:480:980::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/c9fca00f1528/RC215bf8f3db2048f5a863a53bd773832d-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:980::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 94fa9986e84282779b163982fac7dde36adcabd7ae376b82ce764edfccc59894

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:49 GMT
content-encoding: gzip
last-modified: Fri, 27 Oct 2023 18:01:17 GMT
server: AkamaiNetStorage
etag: "27301ca53ed689497d352b9a4a49a8d7:1698429677.369864"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 278
expires: Wed, 31 Jan 2024 03:09:49 GMT

POST
H2 200 84de6a20dd5a65d7 Show response
www.cyberark.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 50F7 0
318 B 36ms
34ms XHR
text/plain 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/cdn-cgi/challenge-platform/h/g/jsd/r/84de6a20dd5a65d7

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 31 Jan 2024 02:09:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
content-encoding: gzip
server: cloudflare
cf-ray: 84de6a2a1a7d65d7-FRA
content-type: text/plain; charset=UTF-8

GET
H/1.1 200
OK jquery-ui-insightera-custom-1.9.6.css
rtp-static.marketo.com/rtp/libs/ 22 KB
4 KB 293ms
10ms Stylesheet
text/css 104.122.39.154
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rtp-static.marketo.com/rtp/libs/jquery-ui-insightera-custom-1.9.6.css
Requested by: Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.122.39.154 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-122-39-154.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 339b2b60e94b6dc169fd9e5b68ac16b1ca08ef6a4968e98a0f43c2add405e79a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 31 Jan 2024 02:09:49 GMT
Content-Encoding: gzip
Last-Modified: Tue, 07 Nov 2017 08:57:42 GMT
Server: AkamaiNetStorage
ETag: "7f5b0bee9b1f7af8413b351cbceca223:1510045062"
Vary: Accept-Encoding
Access-Control-Max-Age: 86400
Content-Type: text/css
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Credentials: false
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 3752

GET
H/1.1 200
OK trw Show response
sjrtp6.marketo.com/gw1/ 226 B
663 B 874ms
158ms Script
application/x-javascript 192.28.146.116
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp6.marketo.com/gw1/trw?aid=cyberarksoftware&trwv.uid=cyberarksoftware-1706666989153-b81e0208&trwv.vc=1&trwsa.sid=cyberarksoftware-1706666989155-3d2bc845&trwsb.cpv=1&ctzo=+01:00&uri=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&ma=id%3A316-CZP-275%26token%3A_mch-cyberark.com-1706666988924-93023&pm=&viewedTypes=&rts=1706666989167

Requested by

Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.28.146.116 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(9.4.45.v20220203) /

Resource Hash

453c78760d17ea7145d18997521ee8e9262d5215ff3e1e0eec900f4628df4773

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 31 Jan 2024 02:09:49 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=63113904
Server: Jetty(9.4.45.v20220203)
Connection: close
Content-Length: 226
Content-Type: application/x-javascript;charset=utf-8

GET
H/1.1 200
OK ga-integration-2.0.5.js Show response
rtp-static.marketo.com/rtp/libs/ 18 KB
6 KB 277ms
11ms Script
application/x-javascript 104.122.39.154
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.5.js
Requested by: Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.122.39.154 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-122-39-154.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: bf6806d8c92e228249230195772afe2e68791d52763b782be9aa2855fab3b641

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 31 Jan 2024 02:09:49 GMT
Content-Encoding: gzip
Last-Modified: Thu, 15 Jun 2023 08:00:53 GMT
Server: AkamaiNetStorage
ETag: "18a7b0f60655900c0010a35d07b9da0f:1686816053.163727"
Vary: Accept-Encoding
Access-Control-Max-Age: 86400
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Credentials: false
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 5654

GET
H2 200 6si.min.js Show response
j.6sc.co/ 64 KB
17 KB 9ms
8ms Script
application/javascript 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/d24194f2-6101-4c07-b071-d2eb5d40f5e6.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

d3851af1bf48f6e0903b5d66e5d64141a559aa05a2da8c76b502dda2b6473933

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 20 Dec 2023 22:26:50 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "65836a2a-ff05"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17577
expires: Wed, 31 Jan 2024 02:09:49 GMT

GET
H2 200 / Show response
consent-pref.trustarc.com/ Frame 8A07 5 KB
3 KB 68ms
37ms Document
text/html 52.222.236.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW

Requested by

Host: consent.trustarc.com
URL: https://consent.trustarc.com/asset/notice.js/v/v1.7-4958

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-129.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

9f565b4cdf200b503b4c09d2e4644a1fbec24230e60b873ab7e09ae969a6fc1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 31 Jan 2024 02:09:49 GMT
etag: W/"5111-1705371684000"
expect-ct: max-age=86400; enforce;
last-modified: Tue, 16 Jan 2024 02:21:24 GMT
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding Origin
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-id: RdqOZBsv8JylnCgsqZ0J5lc8K0t2UIej5MwY97AZNeGOloAmM92QDw==
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-xss-protection: 1

GET
H2 200 noticemsg
consent.trustarc.com/ 43 B
428 B 41ms
37ms Image
image/gif 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.trustarc.com/noticemsg?action=consent&domain=cyberark.com&behavior=expressed&country=de&language=en&rand=0.693943641275218&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW&referer=https://www.cyberark.com

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
via: 1.1 2b2e2811e641703aebf776da39317b9c.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA2-C2
vary: Origin
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
x-amz-cf-id: A1kyE7m-70zMKeX07iQIpXshCrbuzgXBElXrDJw00cHYf9kLLcZf8g==
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
255 B 51ms
19ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-XTLTD7RKN5&_ono=1&gtm=45je41t0v9135218693&_p=1706666987957&_gaz=1&gcd=11l1l1l1l2&dma_cps=sypham&dma=1&ul=en-us&sr=1600x1200&cid=649116550.1706666989&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=EBAI&_s=1&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&dt=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&sid=1706666989&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_6=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&tfd=1644
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XTLTD7RKN5&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.cyberark.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 23ms
19ms Ping
text/plain 2a00:1450:400c:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&_ono=1&tid=G-XTLTD7RKN5&cid=649116550.1706666989&gtm=45je41t0v9135218693&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XTLTD7RKN5&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0b::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.cyberark.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 22ms
18ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ono=1&tid=G-XTLTD7RKN5&cid=649116550.1706666989&gtm=45je41t0v9135218693&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l2&z=1948888154

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK msg Show response
sjrtp6.marketo.com/gw1/ 0
426 B 785ms
159ms Script
text/javascript 192.28.146.116
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp6.marketo.com/gw1/msg?a=2&sid=cyberarksoftware-1706666989155-3d2bc845&aid=cyberarksoftware&ma=id%3A316-CZP-275%26token%3A_mch-cyberark.com-1706666988924-93023&viewedTypes=&0.4718728545521349&rts=1706666989301

Requested by

Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.28.146.116 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(9.4.45.v20220203) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 31 Jan 2024 02:09:50 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=63113904
Server: Jetty(9.4.45.v20220203)
Connection: close
Content-Length: 0
Content-Type: text/javascript;charset=utf-8

GET
H2 200 defaultpreferencemanager.nocache.js Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame 8A07 5 KB
3 KB 36ms
35ms Script
application/javascript 52.222.236.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/defaultpreferencemanager.nocache.js

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-129.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

7c28cfd451fc7eb20c03103195db3a5ac12be83eaf3d876821af8648db2691d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:49 GMT
content-encoding: gzip
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 16 Jan 2024 02:21:42 GMT
server: nginx
etag: W/"4867-1705371702000"
expect-ct: max-age=86400; enforce;
vary: Accept-Encoding, Origin
content-type: application/javascript; charset=UTF-8
cache-control: no-cache
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: 5WTcCkv6VOypNCiLaMH9rZNBMlEKWGDoylM8rQ-L6stddC_TL_T8Ug==
expires: Wed, 31 Jan 2024 02:09:48 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 216 KB
77 KB 32ms
31ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1071691665

Requested by

Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b43f1b911f9ba7809a0ad756563aa9d500c8f13018f689923dded00c29d0e1b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 78342
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 31 Jan 2024 02:09:49 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 216 KB
77 KB 32ms
32ms Script
application/javascript 2a00:1450:4001:80e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1071691665&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6118f929bfb52cbe76ebddf83812e8d5ec05052e8e7caea362b15246f1b10c2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 78371
x-xss-protection: 0
last-modified: Wed, 31 Jan 2024 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 31 Jan 2024 02:09:49 GMT

GET
H2 200 tc_imp.gif
obs.segreencolumn.com/tracker/ 43 B
79 B 95ms
95ms Image
image/gif 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://obs.segreencolumn.com/tracker/tc_imp.gif?e=37dfbd8ee84e00126ae8c133ec4e82949225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5a148e6a2217071a10acf9f29f6718d0d780037a381efe717304863adb3096556556249100510a34055bc7b8634677be26bb25cb43e2916af05365ac097c7a1bda53ee14f497d7df3dbb2807ff7ecaa8556d8e0e3143714493d60264fc60b3f493a0180dec1edae97dfa2bc8169b1adc597cff3200e714561c4b92177af998ffe4198b6dec06c213f85e162ae7d133722b325f817c99ec59b058609fc6e359143e3dd385293e88864c06513c157a77bb9e70392652b48d1c2ad7f4ec3ee3b8192d4079b4a7a7948677a0dbde53e2489e5a3a72aeb9cce4b46d8fd9e16c893008c3e5db6e4d57e56b7dfa964030e7dcf3728704f617b0804c90469f9b2b976a37979974d96297dbeaf09df3f1477fe425bfbef92a4d26f9913f82be50eb0102419457459a9796dd8dfd9e30cf3ad38ebcc479e373362483692683849049369dfe79bb06e485028670be7a415b55c679bf03d1c2e36fbb8b29ca13f28cccdc76c14b4a6ee6551856314a31c7bc6ebd42d8838227aa9925b3d02addc2b1ad33cfa0e05c777384a906158aec471a03b4b4a212d12886f80efdea2fae6ee5608759d008c5ea69914f65a6fbd074352d721f38580405a0f3df348743b3050e103be4a6118ede415baffc86e5e27ec8ffbaee9aeaf8a0381365ae19c2cf0d7c89517809cb710b231faa22fa285dbbbfd369987dc53999e970dfb26684720f21211e7f0f81c6e5dd206656921b5996d1dfa7b3c95a1983b3b57c8ad2707cd1ce0f3a69f88dc45021b33b985c991aff229d12d9d40ef9ba32e29b94cf994762efe3277e8376a68db6b70b9d6c34160288754250b1a35793f115ca9998c848d08687330d365ba33cab05a957ae9c68963247275d277c7fe15e899d2e54b96fc5a79829cb9b08d52061a5037d329eefd10c5ce877fc8618c4437b6138dd452dd9c9b13ecb5f779bc501bdcd9ebad916c85747230bf37025549a960a55b234f9f9be6df889b4542b05f02e7f0e66946f42fa8baa5d48c4707bc1969940ced4bcc95f24b338b3196f219b08727aaeb84e3fce8cb9bce3ce01fd28e42e8337cbe46fd8ffba6f6efd8c40de8ceae380a2aa926713c8bf7a0bf96ac553c200f3ee2ab4dd998033a08cd6fbf25a69d4bcb7ec49c0489a124b37507ac0933a3fc077aa0097983cf35274be714c9173e0df6d7ea47b624e06cfa19a3f8fd85d2b655573938c9fa89876d349e7b02067d5fb567a571e3a6266bd74a1f12d06a2e48588&cri=OK0RJ8WkM1&ts=773&cb=1706666989339
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H2 200 get Show response
consent-st.trustarc.com/ Frame 8A07 20 KB
5 KB 45ms
7ms Script
text/javascript 143.204.98.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-st.trustarc.com/get?name=combined_static_cm_minified.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-35.fra50.r.cloudfront.net

Software

Resource Hash

f1ba71d3bf034aeceecb8895e71a44f4806dbb5bcc44e46fd8fc461a774eb880

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: public
date: Sun, 07 Jan 2024 10:51:10 GMT
content-encoding: gzip
via: 1.1 c6702f5f3b6e77da6f394e67ef1a6aaa.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA50-C1
age: 2042319
vary: Origin
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: DfkqGlN9wrg6YQbTw_kOCGQRr5D1liABTuIjVe8Qaa6ZDFNwdaMqOw==
expires: Tue, 06 Feb 2024 10:51:10 GMT

GET
H2 200 loading.gif
consent-pref.trustarc.com/images/ Frame 8A07 3 KB
3 KB 10ms
9ms Image
image/gif 52.222.236.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent-pref.trustarc.com/images/loading.gif

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-129.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

eb7cfd3d959b2e09c170f532e29f8b825f9bc770b2279fde58e595617753e244

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:53:57 GMT
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
age: 953
x-cache: Hit from cloudfront
content-length: 2608
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 16 Jan 2024 02:21:24 GMT
server: nginx
etag: W/"2608-1705371684000"
expect-ct: max-age=86400; enforce;
vary: Origin
content-type: image/gif
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
accept-ranges: bytes
x-amz-cf-id: WuOWGT5fXkzNIhV7Y5X7m9ikhsNjLjOVDyC2xxD8slZu6ZbGLF2Q8w==

GET
BLOB 200
OK dc615cd3-441f-473d-9d58-8af26037f1dc
https://www.cyberark.com/ 261 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.cyberark.com/dc615cd3-441f-473d-9d58-8af26037f1dc
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e2de2046e0b566acced02881ab6a7719eb3e1c615ac82cb22d50f664026d8c1d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Length: 261
Content-Type

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
697 B 60ms
15ms XHR
application/json 185.89.210.82
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
an-x-request-uuid: bf1c4d45-e98c-4376-8ba8-c059bd480a9f
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.cyberark.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.37; 81.95.5.37; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 11
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 17ms
15ms XHR
text/html 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-100-184.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:49 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.cyberark.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 14 B
301 B 40ms
8ms XHR
text/html 2a02:26f0:480:23::1726:629c
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:23::1726:629c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 7f682ef3fa82a2d4c331a0595aecf32fdbfd76a2d1c4b14710c519920303b1df

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.cyberark.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2a01:4a0:2b::9
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1706666989380_388391900_144048758_19_736_6_16_219";dur=1
content-length: 14
expires: Wed, 31 Jan 2024 02:09:49 GMT

GET
BLOB 200
OK c7789628-9649-45fe-901f-621eb4d3242f
https://www.cyberark.com/ 529 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.cyberark.com/c7789628-9649-45fe-901f-621eb4d3242f
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f9aded115091d50d47d7754707791323361dc3b0845d6cdfbd79b5b6f511c362

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Length: 529
Content-Type

GET
H2 200 ajax_ping Show response
www.cyberark.com/resources/hubsFront/ 49 B
132 B 428ms
427ms XHR
application/json 104.16.15.87
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/resources/hubsFront/ajax_ping

Requested by

Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.00b1d4acfe61970d73c9.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.16.15.87 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74935268619be1f087ce67765abd72f80107125f23b346f7615cc9e6a19d4595

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.cyberark.com/
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:49 GMT
content-security-policy: frame-ancestors 'self' https://www.cyberark.com/
referrer-policy: unsafe-url
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-frame-options: DENY
content-type: application/json
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
content-language: en
cf-ray: 84de6a2bbb1765d7-FRA
x-xss-protection: 1; mode=block

GET
H2 200 DFE2FFD93897F8EBCB55E7DCE8C0F692.cache.html Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame B0E7 147 KB
48 KB 8ms
8ms Document
text/html 52.222.236.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/DFE2FFD93897F8EBCB55E7DCE8C0F692.cache.html

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/defaultpreferencemanager.nocache.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-129.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

552f36235edc79f9c9bf1fe929c9713108fae2302f65349e57d0f3c9dd32eff0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Referer: https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 540355
cache-control: max-age=315360000
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 24 Jan 2024 20:03:54 GMT
etag: W/"150748-1705371702000"
expect-ct: max-age=86400; enforce;
expires: Thu, 31 Dec 2037 23:55:55 GMT
last-modified: Tue, 16 Jan 2024 02:21:42 GMT
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
referrer-policy: strict-origin-when-cross-origin
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding Origin
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-amz-cf-id: aVa0XQm1yzlMW2CsHhsFwxmwuiKLjzNE3TvwZByGYnBksAAMPGUkiw==
x-amz-cf-pop: FRA56-P4
x-cache: Hit from cloudfront
x-content-type-options: nosniff
x-xss-protection: 1

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 193ms
192ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=059bf2ba2b88e39bb3200769d2e411fc&svisitor=null&visitor=a21fcf4f-cfdd-4ff0-8f30-88019c868e74&session=d5f38bae-5fa3-458a-8685-b391206d0783&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A2b%3A%3A9%22%7D&isIframe=false&m=%7B%22description%22%3A%22Abstract%20The%20Play%20ransomware%20group%20is%20one%20of%20the%20most%20successful%20ransomware%20syndicates%20today.%20All%20it%20takes%20is%20a%20quick%20peek%20with%20a%20disassembler%20to%20know%20why%20this%20group%20has%20become%20infamous.%20This%20is...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game%22%2C%22prod-cat%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&pageViewId=8b990d15-a0c9-42a5-849c-14f5a58fdb46&webTagId=d24194f2-6101-4c07-b071-d2eb5d40f5e6&v=1.1.14

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:49 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/ 3 KB
2 KB 48ms
21ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/?random=1706666989432&cv=11&fst=1706666989432&bg=ffffff&guid=ON&async=1&gtm=45be41t0v898648185&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&hn=www.googleadservices.com&frm=0&tiba=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&pscdl=noapi&auid=1992125960.1706666988&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1071691665

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b31e3c4c8f964c4459df4ffebac0b6594b1cbf9df690e5c7045e25ea9d06c5a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1324
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/1071691665/ 3 KB
2 KB 87ms
46ms Script
text/javascript 216.58.206.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1071691665/?random=1706666989447&cv=11&fst=1706666989447&bg=ffffff&guid=ON&async=1&gtm=45be41t0v898648185&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&label=H8zfCNSYxvwYEJHvgv8D&hn=www.googleadservices.com&frm=0&tiba=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&gtm_ee=1&pscdl=noapi&auid=1992125960.1706666988&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1071691665

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f2.1e100.net

Software

cafe /

Resource Hash

1d36681a89fc34572e53868ae68a5ee003d545a5a724caa76ca2707d2c3b723b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1657
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 193ms
192ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=059bf2ba2b88e39bb3200769d2e411fc&svisitor=null&visitor=a21fcf4f-cfdd-4ff0-8f30-88019c868e74&session=d5f38bae-5fa3-458a-8685-b391206d0783&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2031%20Jan%202024%2002%3A09%3A49%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Abstract%20The%20Play%20ransomware%20group%20is%20one%20of%20the%20most%20successful%20ransomware%20syndicates%20today.%20All%20it%20takes%20is%20a%20quick%20peek%20with%20a%20disassembler%20to%20know%20why%20this%20group%20has%20become%20infamous.%20This%20is...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game%22%2C%22prod-cat%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&pageViewId=8b990d15-a0c9-42a5-849c-14f5a58fdb46&an_uid=0&webTagId=d24194f2-6101-4c07-b071-d2eb5d40f5e6&v=1.1.14

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:49 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 195ms
194ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=059bf2ba2b88e39bb3200769d2e411fc&svisitor=null&visitor=a21fcf4f-cfdd-4ff0-8f30-88019c868e74&session=d5f38bae-5fa3-458a-8685-b391206d0783&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22059bf2ba2b88e39bb3200769d2e411fc%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2031%20Jan%202024%2002%3A09%3A49%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2031%20Jan%202024%2002%3A09%3A49%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2031%20Jan%202024%2002%3A09%3A49%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2031%20Jan%202024%2002%3A09%3A49%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2031%20Jan%202024%2002%3A09%3A49%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2031%20Jan%202024%2002%3A09%3A49%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%7B%5C%5C%5C%22name%5C%5C%5C%22%3A%5C%5C%5C%22prod-cat%5C%5C%5C%22%7D%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2031%20Jan%202024%2002%3A09%3A49%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%22d24194f2-6101-4c07-b071-d2eb5d40f5e6%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2031%20Jan%202024%2002%3A09%3A49%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2031%20Jan%202024%2002%3A09%3A49%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2031%20Jan%202024%2002%3A09%3A49%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Wed%2C%2031%20Jan%202024%2002%3A09%3A49%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Abstract%20The%20Play%20ransomware%20group%20is%20one%20of%20the%20most%20successful%20ransomware%20syndicates%20today.%20All%20it%20takes%20is%20a%20quick%20peek%20with%20a%20disassembler%20to%20know%20why%20this%20group%20has%20become%20infamous.%20This%20is...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game%22%2C%22prod-cat%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&pageViewId=8b990d15-a0c9-42a5-849c-14f5a58fdb46&an_uid=0&webTagId=d24194f2-6101-4c07-b071-d2eb5d40f5e6&v=1.1.14

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:49 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 truste Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame 8A07 1 KB
1 KB 37ms
32ms XHR
application/json 52.222.236.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/truste

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/DFE2FFD93897F8EBCB55E7DCE8C0F692.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-129.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

365c4e4e15bb05abb8135ba921b7ff58c93459e1b8eda9e1835c13ba7ecec1b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

X-GWT-Module-Base: https://consent-pref.trustarc.com/defaultpreferencemanager/
X-GWT-Permutation: DFE2FFD93897F8EBCB55E7DCE8C0F692
Referer: https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/x-gwt-rpc; charset=UTF-8

Response headers

date: Wed, 31 Jan 2024 02:09:49 GMT
content-encoding: gzip
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
content-disposition: attachment
content-length: 481
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
server: nginx
expect-ct: max-age=86400; enforce;
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: rZWJmWVRMjos7Rpo8JANSf0IBWVJEvG0S29X5glghYeCDY9b1FXCww==

POST
H2 200 truste Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame 8A07 48 B
621 B 39ms
34ms XHR
application/json 52.222.236.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/truste

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/DFE2FFD93897F8EBCB55E7DCE8C0F692.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-129.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

e2f6edeb43684c52476fafa30df1d715dd0721691ec4ddd736c3245c4db4d844

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

X-GWT-Module-Base: https://consent-pref.trustarc.com/defaultpreferencemanager/
X-GWT-Permutation: DFE2FFD93897F8EBCB55E7DCE8C0F692
Referer: https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/x-gwt-rpc; charset=UTF-8

Response headers

date: Wed, 31 Jan 2024 02:09:49 GMT
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
content-disposition: attachment
content-length: 48
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
server: nginx
expect-ct: max-age=86400; enforce;
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: X4ntmdr5TjTpggTCclEmodQ0jSYo5NVceWcXG0cXV8XwhsP0uyR5Dg==

GET
H2 200 /
www.google.com/pagead/1p-user-list/1071691665/ 42 B
154 B 26ms
23ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1071691665/?random=1706666989432&cv=11&fst=1706666400000&bg=ffffff&guid=ON&async=1&gtm=45be41t0v898648185&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&frm=0&tiba=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_KbiUx-pW3YVcWa_gnewFkL3dU0VluA&random=580822822&rmt_tld=0&ipr=y

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/1071691665/ 42 B
64 B 26ms
25ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1071691665/?random=1706666989432&cv=11&fst=1706666400000&bg=ffffff&guid=ON&async=1&gtm=45be41t0v898648185&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&frm=0&tiba=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_KbiUx-pW3YVcWa_gnewFkL3dU0VluA&random=580822822&rmt_tld=1&ipr=y

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.google.de/pagead/1p-conversion/1071691665/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/?random=1758822605&cv=11&fst=1706666989447&bg=ffffff&guid=ON&async=1&gtm=45be41t0v898648185&gcd=11l1l1l1l1&dma_cps=sypham...
https://www.google.com/pagead/1p-conversion/1071691665/?random=1758822605&cv=11&fst=1706666989447&bg=ffffff&guid=ON&async=1&gtm=45be41t0v898648185&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1...
https://www.google.de/pagead/1p-conversion/1071691665/?random=1758822605&cv=11&fst=1706666989447&bg=ffffff&guid=ON&async=1&gtm=45be41t0v898648185&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=12...

42 B
64 B

48ms
48ms

Image
image/gif

2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/1071691665/?random=1758822605&cv=11&fst=1706666989447&bg=ffffff&guid=ON&async=1&gtm=45be41t0v898648185&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&label=H8zfCNSYxvwYEJHvgv8D&hn=www.googleadservices.com&frm=0&tiba=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&gtm_ee=1&pscdl=noapi&auid=1992125960.1706666988&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ05uaXJRWVEtN0RJMnMtUGpza0JFaVlBSXRfb0VTZVZsYWlTTTByNWo4OXpCYmI3emNhLUtxS3NhdjYyd1JwZWp3Z3RyUGtVa0EaWkNoRUlnTm5pclFZUTlxdkFyWWFyLTR5LUFSSXVBQ3VBdmQ4QVdKa0lWR0lMZ0x6dGxFYWpPWkRBb3pUSVVaZXNaNVVnQ0lrWUlaR1ZOQnBaMzB5UGFVNXJydyITCLSro_3FhoQDFStMkQUdI88Mig&is_vtc=1&ocp_id=7au5ZfSAH6uYxdwPo56z0Ag&cid=CAQSKQAvHhf_VoAW-vgLJ2wQ2QnY_YFukfSKY10zLkTgdyTeLTeYXbBY-36T&random=3662310862&ipr=y

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:49 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-conversion/1071691665/?random=1758822605&cv=11&fst=1706666989447&bg=ffffff&guid=ON&async=1&gtm=45be41t0v898648185&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&label=H8zfCNSYxvwYEJHvgv8D&hn=www.googleadservices.com&frm=0&tiba=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&gtm_ee=1&pscdl=noapi&auid=1992125960.1706666988&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEFJZ05uaXJRWVEtN0RJMnMtUGpza0JFaVlBSXRfb0VTZVZsYWlTTTByNWo4OXpCYmI3emNhLUtxS3NhdjYyd1JwZWp3Z3RyUGtVa0EaWkNoRUlnTm5pclFZUTlxdkFyWWFyLTR5LUFSSXVBQ3VBdmQ4QVdKa0lWR0lMZ0x6dGxFYWpPWkRBb3pUSVVaZXNaNVVnQ0lrWUlaR1ZOQnBaMzB5UGFVNXJydyITCLSro_3FhoQDFStMkQUdI88Mig&is_vtc=1&ocp_id=7au5ZfSAH6uYxdwPo56z0Ag&cid=CAQSKQAvHhf_VoAW-vgLJ2wQ2QnY_YFukfSKY10zLkTgdyTeLTeYXbBY-36T&random=3662310862&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 EuPreferenceManager.css
consent-pref.trustarc.com/ Frame 8A07 30 KB
7 KB 10ms
8ms Stylesheet
text/css 52.222.236.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/EuPreferenceManager.css

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/DFE2FFD93897F8EBCB55E7DCE8C0F692.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-129.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

2ccd80e8d18c5487a17486887b1fb9e6b39d10aa2442f0ac754fc8d2792eb2cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:39:50 GMT
content-encoding: gzip
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
age: 1801
x-cache: Hit from cloudfront
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 16 Jan 2024 02:21:24 GMT
server: nginx
etag: W/"30672-1705371684000"
expect-ct: max-age=86400; enforce;
vary: Accept-Encoding, Origin
content-type: text/css
cache-control: no-cache
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: XGNZZq5cKOEaf1aWefu_5OLrSotXapS1EnqrOwRtuXU07J4dIPbnsA==
expires: Wed, 31 Jan 2024 01:39:47 GMT

GET
H2 200 11.cache.js Show response
consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/DFE2FFD93897F8EBCB55E7DCE8C0F692/ Frame 8A07 267 KB
91 KB 11ms
9ms XHR
application/javascript 52.222.236.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/DFE2FFD93897F8EBCB55E7DCE8C0F692/11.cache.js

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/DFE2FFD93897F8EBCB55E7DCE8C0F692.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-129.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

720f86921badb8a5eac35a3d3c69a85ce08694d881bbd8fdfe7c102b9a8bf691

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 20:03:54 GMT
content-encoding: gzip
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
age: 540353
x-cache: Hit from cloudfront
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 16 Jan 2024 02:21:42 GMT
server: nginx
etag: W/"273729-1705371702000"
expect-ct: max-age=86400; enforce;
vary: Accept-Encoding, Origin
content-type: application/javascript; charset=UTF-8
cache-control: max-age=315360000
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: FPNLhS8g0N9bjvyMo8gVt92zPMnVNVtUcospbfgLqHaTx0uMlisi3Q==
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1.cache.js Show response
consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/DFE2FFD93897F8EBCB55E7DCE8C0F692/ Frame 8A07 21 KB
9 KB 7ms
7ms XHR
application/javascript 52.222.236.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/DFE2FFD93897F8EBCB55E7DCE8C0F692/1.cache.js

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/DFE2FFD93897F8EBCB55E7DCE8C0F692.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-129.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

8df3fad21ac78f5382a5993803be1dea1ba725a0fb55d23eef360d3b7a407964

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 20:03:55 GMT
content-encoding: gzip
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
age: 540354
x-cache: Hit from cloudfront
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 16 Jan 2024 02:21:42 GMT
server: nginx
etag: W/"21449-1705371702000"
expect-ct: max-age=86400; enforce;
vary: Accept-Encoding, Origin
content-type: application/javascript; charset=UTF-8
cache-control: max-age=315360000
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: KUE2joHud5HY5clUV7PRkXzD6BswiETIONYUK1rKvuAFhqY01v5Gcw==
expires: Thu, 31 Dec 2037 23:55:55 GMT

POST
H2 200 truste Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame 8A07 914 B
989 B 31ms
30ms XHR
application/json 52.222.236.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/truste

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/DFE2FFD93897F8EBCB55E7DCE8C0F692.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-129.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

dfeecee70ce9544105ce0e0919a4cd09cf6e239cd588b991d8809b99e9873d40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

X-GWT-Module-Base: https://consent-pref.trustarc.com/defaultpreferencemanager/
X-GWT-Permutation: DFE2FFD93897F8EBCB55E7DCE8C0F692
Referer: https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/x-gwt-rpc; charset=UTF-8

Response headers

date: Wed, 31 Jan 2024 02:09:49 GMT
content-encoding: gzip
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
content-disposition: attachment
content-length: 398
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
server: nginx
expect-ct: max-age=86400; enforce;
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: r7aedglDDtwNM4pQaGxAGQYbLiGi8dFr4HBbxpsYvMYKfCLQsrotFg==

POST
H2 200 truste Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame 8A07 24 KB
6 KB 35ms
35ms XHR
application/json 52.222.236.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/truste

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/DFE2FFD93897F8EBCB55E7DCE8C0F692.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-129.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

3decbe1c69b0f91d975610f54b2615be61a887c20f8ade1049be9743168198aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

X-GWT-Module-Base: https://consent-pref.trustarc.com/defaultpreferencemanager/
X-GWT-Permutation: DFE2FFD93897F8EBCB55E7DCE8C0F692
Referer: https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/x-gwt-rpc; charset=UTF-8

Response headers

date: Wed, 31 Jan 2024 02:09:49 GMT
content-encoding: gzip
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-amz-cf-pop: FRA56-P4
x-cache: Miss from cloudfront
content-disposition: attachment
content-length: 6052
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
server: nginx
expect-ct: max-age=86400; enforce;
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: xCJQBwobETofgxVq3SEnXcH8hxoaXkaZoPWH332xKiyDdb3TpKZ1Ew==

GET
H2 200 trustarc-logo-small.png
consent-pref.trustarc.com/images/ Frame 8A07 4 KB
5 KB 7ms
6ms Image
image/png 52.222.236.129
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent-pref.trustarc.com/images/trustarc-logo-small.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-129.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

91c4a6c4295f8889e8b04339a4a2c2e86d5eef71ba808164e641d0d8a6435004

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:39:50 GMT
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
age: 1800
x-cache: Hit from cloudfront
content-length: 4197
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 16 Jan 2024 02:21:24 GMT
server: nginx
etag: W/"4197-1705371684000"
expect-ct: max-age=86400; enforce;
vary: Origin
content-type: image/png
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
accept-ranges: bytes
x-amz-cf-id: 9ph6FLdg_dmPCZCscB2sjXFZTGurizNGz4XyhRIxR77C0dNR2pC-KA==

GET
H/1.1 200
OK msg Show response
sjrtp6.marketo.com/gw1/ 0
426 B 469ms
157ms Script
text/javascript 192.28.146.116
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.28.146.116 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(9.4.45.v20220203) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 31 Jan 2024 02:09:50 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=63113904
Server: Jetty(9.4.45.v20220203)
Connection: close
Content-Length: 0
Content-Type: text/javascript;charset=utf-8

GET
H2 200 6.cache.js Show response
consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/DFE2FFD93897F8EBCB55E7DCE8C0F692/ Frame 8A07 8 KB
4 KB 7ms
6ms XHR
application/javascript 52.222.236.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/DFE2FFD93897F8EBCB55E7DCE8C0F692/6.cache.js

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/DFE2FFD93897F8EBCB55E7DCE8C0F692.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-129.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

f8a01ce1f0b884745f17415c8a29fc513ad070438b31b18e17c59b597c5a0473

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=cyberark_v2&site=cyberark.com&country=de&action=notice&locale=en&behavior=expressed&gtm=1&layout=default_eu&behaviorManager=eu&irm=false&from=https://consent.trustarc.com/&session=885d63d8-9876-499d-8967-d6737b91d5c6&userType=NEW
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 24 Jan 2024 20:03:55 GMT
content-encoding: gzip
via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA56-P4
age: 540355
x-cache: Hit from cloudfront
x-xss-protection: 1
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 16 Jan 2024 02:21:42 GMT
server: nginx
etag: W/"7796-1705371702000"
expect-ct: max-age=86400; enforce;
vary: Accept-Encoding, Origin
content-type: application/javascript; charset=UTF-8
cache-control: max-age=315360000
permissions-policy: midi=(),accelerometer=(),autoplay=(),gyroscope=(),microphone=(),camera=(),fullscreen=(),magnetometer=(),payment=()
x-amz-cf-id: zJ-Syh6bDYgqhwnKU7MCSbyfYWp-u0YnOn0BK5dp8Ybm2_X2BnnHTg==
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 get
consent.trustarc.com/ Frame 8A07 219 KB
114 KB 10ms
9ms Font
font/ttf 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/get?name=OpenSans-Bold.ttf

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

5894a3649b213cf5b2d673b6e7a871815fd1d120fa68a463592f27db14eae323

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://consent-pref.trustarc.com/
Origin: https://consent-pref.trustarc.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: public
date: Wed, 31 Jan 2024 01:41:16 GMT
content-encoding: gzip
via: 1.1 286eb4b50e0acf373dd03645aee00b7e.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA2-C2
age: 1714
x-cache: Hit from cloudfront
content-type: font/ttf
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: 9ADJ7G2jY67I9K3U_Y_zGZqRp7uwPSz7SG3PGfZ-PplQGtZ2pb7N9g==
expires: Fri, 01 Mar 2024 01:41:16 GMT

GET
H2 200 get
consent.trustarc.com/ Frame 8A07 127 KB
76 KB 27ms
25ms Font
font/ttf 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/get?name=OpenSans-Light.ttf

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

abca0004f2960ea162b161a82240a139fce6012733a76f3859febb9bed38b420

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://consent-pref.trustarc.com/
Origin: https://consent-pref.trustarc.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: public
date: Wed, 31 Jan 2024 01:46:04 GMT
content-encoding: gzip
via: 1.1 286eb4b50e0acf373dd03645aee00b7e.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA2-C2
age: 1426
x-cache: Hit from cloudfront
content-type: font/ttf
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: TbVhBKb-jzu_IXHS-Hg5OD-q0TBX27lr3a8bVkC8lndYVCEfCsNONg==
expires: Fri, 01 Mar 2024 01:46:04 GMT

GET
H2 200 get
consent.trustarc.com/ Frame 8A07 127 KB
77 KB 34ms
32ms Font
font/ttf 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/get?name=OpenSans-SemiBold.ttf

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

89275a1c66640733265b5be89864b6daefef1cc3f275566dd8fd29bd66601a83

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://consent-pref.trustarc.com/
Origin: https://consent-pref.trustarc.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: public
date: Wed, 31 Jan 2024 01:50:14 GMT
content-encoding: gzip
via: 1.1 286eb4b50e0acf373dd03645aee00b7e.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA2-C2
age: 1176
x-cache: Hit from cloudfront
content-type: font/ttf
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: 7CQbjuQZbvfSUtQ0Fw68zKYOx-LIcyBuC6oB3kkE7AdurzuUi1sryQ==
expires: Fri, 01 Mar 2024 01:50:14 GMT

GET
H2 200 get
consent.trustarc.com/ Frame 8A07 127 KB
77 KB 36ms
34ms Font
application/octet-stream 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/get?name=OpenSans-Regular.ttf

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

8bcb1671142844b9c10b5247053d513b9110ad9e3ad7ec0b751d42c977611f83

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://consent-pref.trustarc.com/
Origin: https://consent-pref.trustarc.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: public
date: Wed, 31 Jan 2024 01:38:24 GMT
content-encoding: gzip
via: 1.1 286eb4b50e0acf373dd03645aee00b7e.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA2-C2
age: 1886
x-cache: Hit from cloudfront
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: 7yixYHop3ihgYZAnfQIazYCAJ2vkx0tYK9OuinnDPMtH3YXOFgcueQ==
expires: Fri, 01 Mar 2024 01:38:24 GMT

GET
H2 200 get
consent.trustarc.com/ Frame 8A07 5 KB
5 KB 19ms
19ms Image
image/png 13.225.78.35
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.trustarc.com/get?name=CyberArk_H4C_logo.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.35 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-35.fra2.r.cloudfront.net

Software

Resource Hash

6df07acc4226892a09f5d94cfb28cd6f560b073f5fb5e4060fede31cba893989

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: public
date: Wed, 31 Jan 2024 01:31:28 GMT
content-encoding: gzip
via: 1.1 2b2e2811e641703aebf776da39317b9c.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA2-C2
age: 2302
vary: Origin
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: S-IPYOVDjp4Z_aZX_tzhRt6HlInh3q72owDgqYiPrr9Ugh0C4fi2rw==
expires: Fri, 01 Mar 2024 01:31:28 GMT

POST
H2 200 mon Show response
obs.segreencolumn.com/ 0
148 B 107ms
101ms XHR
application/json 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.segreencolumn.com/mon
Requested by: Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://www.cyberark.com
date: Wed, 31 Jan 2024 02:09:50 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

POST
H2 200 mon Show response
obs.segreencolumn.com/ 0
16 B 102ms
99ms XHR
application/json 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.segreencolumn.com/mon
Requested by: Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://www.cyberark.com
date: Wed, 31 Jan 2024 02:09:50 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 195ms
192ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=059bf2ba2b88e39bb3200769d2e411fc&svisitor=null&visitor=a21fcf4f-cfdd-4ff0-8f30-88019c868e74&session=d5f38bae-5fa3-458a-8685-b391206d0783&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2031%20Jan%202024%2002%3A09%3A50%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2031%20Jan%202024%2002%3A09%3A49%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%221003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Abstract%20The%20Play%20ransomware%20group%20is%20one%20of%20the%20most%20successful%20ransomware%20syndicates%20today.%20All%20it%20takes%20is%20a%20quick%20peek%20with%20a%20disassembler%20to%20know%20why%20this%20group%20has%20become%20infamous.%20This%20is...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game%22%2C%22prod-cat%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&pageViewId=8b990d15-a0c9-42a5-849c-14f5a58fdb46&an_uid=0&webTagId=d24194f2-6101-4c07-b071-d2eb5d40f5e6&v=1.1.14

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 playPauseLoadingControl.js Show response
fast.wistia.com/assets/external/ 80 KB
21 KB 24ms
8ms Script
text/javascript 2a04:4e42:400::644
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/playPauseLoadingControl.js

Requested by

Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::644 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

3c25dd38b7a4c67ac1844d3fe2a66b04241a624409142c27274c679335d1365f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
Origin: https://www.cyberark.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
content-encoding: br
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=0
age: 236
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
content-length: 21180
x-served-by: cache-iad-kjyo7100149-IAD, cache-fra-eddf8230043-FRA
x-browser-version: 120
last-modified: Tue, 30 Jan 2024 21:04:45 GMT
server: AmazonS3
x-timer: S1706666991.582113,VS0,VE0
etag: "6d38973c7831e0ee624acf8248d39146"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=3600
x-browser: chrome
asset-version: 0c1863c09d8b681818d2eec147310f2ec40ee2ef
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 74, 4

GET
H2 200 RCfa64ba9b591a453aa9e951ba10209d4b-source.min.js Show response
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/c9fca00f1528/ 1 KB
790 B 10ms
9ms Script
application/x-javascript 2a02:26f0:480:980::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/c9fca00f1528/RCfa64ba9b591a453aa9e951ba10209d4b-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:980::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 6a3ed8cee1f3e321efead56af44dc4392527febf7910f50083caa12e86027ad5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
content-encoding: gzip
last-modified: Fri, 27 Oct 2023 18:01:17 GMT
server: AkamaiNetStorage
etag: "27301ca53ed689497d352b9a4a49a8d7:1698429677.369864"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 532
expires: Wed, 31 Jan 2024 03:09:50 GMT

GET
H/1.1 200
OK jquery-custom-ui.min.js Show response
rtp-static.marketo.com/rtp/libs/jqueryui/1.9.2f/ 126 KB
35 KB 18ms
18ms Script
application/x-javascript 104.122.39.154
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rtp-static.marketo.com/rtp/libs/jqueryui/1.9.2f/jquery-custom-ui.min.js
Requested by: Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.122.39.154 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-122-39-154.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 35f273e01e70db780ae423347dffecfc27cc348ba4abbd6099331559a7c5cd31

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 31 Jan 2024 02:09:50 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Jan 2018 12:54:21 GMT
Server: AkamaiNetStorage
ETag: "5a9f8dd85d85afd20544bd437a505338:1515502461"
Vary: Accept-Encoding
Access-Control-Max-Age: 86400
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Credentials: false
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 35484

GET
H2 200 hls_video.js Show response
fast.wistia.com/assets/external/engines/ 474 KB
116 KB 16ms
8ms Script
text/javascript 2a04:4e42:400::644
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/engines/hls_video.js

Requested by

Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::644 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

02091aa39549dbde668309a0c7e6f03bd384e437bd761b7a3b26b8b926a16067

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
Origin: https://www.cyberark.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
content-encoding: br
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=0
age: 236
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
content-length: 118094
x-served-by: cache-iad-kiad7000096-IAD, cache-fra-eddf8230043-FRA
x-browser-version: 120
last-modified: Tue, 30 Jan 2024 21:04:45 GMT
server: AmazonS3
x-timer: S1706666991.582100,VS0,VE0
etag: "478b0f55f6b4e9e779b15a97e4851be2"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=3600
x-browser: chrome
asset-version: 0c1863c09d8b681818d2eec147310f2ec40ee2ef
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 72, 4

POST
H2 200 mput Show response
pipedream.wistia.com/ 2 B
330 B 159ms
100ms Fetch
text/plain 2600:9000:236e:5600:3:471f:5240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pipedream.wistia.com/mput?topic=metrics
Requested by: Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:236e:5600:3:471f:5240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: envoy /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f4.cloudfront.net (CloudFront)
server: envoy
x-amz-cf-pop: FRA60-P1
x-cache: Miss from cloudfront
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: *
content-type: text/plain; charset=utf-8
x-envoy-upstream-service-time: 1
content-length: 2
x-amz-cf-id: w2G8xGRxKkbof0tGqJ8ZnFNWF63HCMmwUTqwcwjPYFXFFef3zGokwA==

POST
H2 204 x
distillery.wistia.com/ 0
0 160ms
104ms Fetch 18.245.86.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://distillery.wistia.com/x
Requested by: Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.86.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-86-6.fra60.r.cloudfront.net
Software: envoy /
Resource Hash

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
via: 1.1 1c3c1c03f4bbd4e68725363918cb3454.cloudfront.net (CloudFront)
server: envoy
x-amz-cf-pop: FRA60-P6
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 6
x-amz-cf-id: 8OcZhBuQw0ThF3VD3Kfn9aoDpK9ngVMMoFd4vN92sn2Q1dQnTELRcQ==

GET
H2 200 ey22i6m9p82y.js Show response
js.driftt.com/include/1706667000000/ 220 KB
62 KB 354ms
318ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1706667000000/ey22i6m9p82y.js

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

52d87460560d706c4aa2b62216ad84345b4292322c818c69fd55bb234afd4c83

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-amz-version-id: HprHXY.99uyuv4UI_XMdF2xIfeEfDySD
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Wed, 31 Jan 2024 02:09:50 GMT
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 56
last-modified: Tue, 30 Jan 2024 20:20:44 GMT
server: istio-envoy
etag: W/"8bb3282387347ab14b7a49c1d4f4e79f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Gj2xzA8PXfMsbGSoKbf1iTIz_h1V8orZaL_TI7zVlHcwbrN0Pgn6Ow==

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/ 3 KB
1 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/?random=1706666990580&cv=11&fst=1706666990580&bg=ffffff&guid=ON&async=1&gtm=45He41t0v72025662&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&hn=www.googleadservices.com&frm=0&tiba=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&pscdl=noapi&auid=1992125960.1706666988&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

428b3c9619b58c9ea969aa74e73d5f196f92ea31968dabac58d13ae593687075

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1319
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 43 KB
16 KB 45ms
8ms Script
application/javascript 2a02:26f0:480:f::213:7edd
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:f::213:7edd Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b5474d3ed408366dcebededf5c987f44b43b389137272c282c6c972852a14fc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 23 Jan 2024 14:42:29 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=71054
accept-ranges: bytes
content-length: 15732

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 213 KB
58 KB 43ms
8ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b0388a2387283b8457b08aadd7fdcca2702ba989863981b18e673a1394e74c4f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 31 Jan 2024 02:09:50 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57158
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: oTLhiiid3cpys3UlzCIUVdbPFx2nFxfI/vGw8titZJlDikBuB5S7D8/l+CVXR8+i1ANCSmF5RXm7JFdo9Rdg0g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/choozle/14963/ 28 KB
9 KB 75ms
6ms Script
application/javascript 2600:9000:206f:e600:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/14963/Bootstrap.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:e600:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 8078cebf9ab8ba5c0802536ed68317072ca51f1cb5293db16d63f923aad2e011

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 28 Oct 2023 14:31:31 GMT
x-amz-version-id: x04iqw22f74TR7YV8WcAUNCuLsQOa2Ho
content-encoding: br
via: 1.1 547a50460a0cda7ae3dafb1c0b6d0e1a.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 8163500
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Sat, 28 Oct 2023 14:30:41 GMT
server: CloudFront
etag: W/"ae9736f2c4e7558eebdb8be79cbd6a8d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300
x-amz-cf-id: Xdvz2X3TUKWU9mWg-mBcgG4YYcGBfQj0mICOoOyTKdEu6y7Ct1Wv2Q==

GET
H2

200

activityi;dc_pre=CPyg6_3FhoQDFdlTkQUd2NwLlg;src=9920016;type=websi0;cat=websi0;ord=2605111504476;auiddc=1992125960.1706666988;pscdl=noapi;gtm=45fe41t0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;... Show response
9920016.fls.doubleclick.net/ Frame 1E7D
Redirect Chain

https://9920016.fls.doubleclick.net/activityi;src=9920016;type=websi0;cat=websi0;ord=2605111504476;auiddc=1992125960.1706666988;pscdl=noapi;gtm=45fe41t0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab...
https://9920016.fls.doubleclick.net/activityi;dc_pre=CPyg6_3FhoQDFdlTkQUd2NwLlg;src=9920016;type=websi0;cat=websi0;ord=2605111504476;auiddc=1992125960.1706666988;pscdl=noapi;gtm=45fe41t0;gcd=11l1l1...

564 B
539 B

50ms
46ms

Document
text/html

142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9920016.fls.doubleclick.net/activityi;dc_pre=CPyg6_3FhoQDFdlTkQUd2NwLlg;src=9920016;type=websi0;cat=websi0;ord=2605111504476;auiddc=1992125960.1706666988;pscdl=noapi;gtm=45fe41t0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-9920016

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

1b1422bb0eba3d8b28017120e33bfbc49b21847f2fdedc5acc2d7273396637d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 336
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 Jan 2024 02:09:50 GMT
expires: Wed, 31 Jan 2024 02:09:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 Jan 2024 02:09:50 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://9920016.fls.doubleclick.net/activityi;dc_pre=CPyg6_3FhoQDFdlTkQUd2NwLlg;src=9920016;type=websi0;cat=websi0;ord=2605111504476;auiddc=1992125960.1706666988;pscdl=noapi;gtm=45fe41t0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 18 KB
7 KB 133ms
99ms Script
text/javascript 3.77.28.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.77.28.166 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-77-28-166.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 6d43cbfb3475ea98f326b23502fbff79982c29c93ddc700233aca7db3dea0716

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 31 Jan 2024 02:09:50 GMT
cache-control: max-age=5
content-encoding: gzip
content-type: text/javascript

GET
H2 200 dc000d50-4dbc-4d9a-ba52-c3015680f76c Show response
tag.simpli.fi/sifitag/ 3 KB
2 KB 72ms
15ms Script
application/javascript 35.204.89.238
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.simpli.fi/sifitag/dc000d50-4dbc-4d9a-ba52-c3015680f76c
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.204.89.238 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 238.89.204.35.bc.googleusercontent.com
Software: openresty /
Resource Hash: 329eba5224a490e972374a62dd94c61794c440471cc2d40a13a73d6586d7394d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:50 GMT
content-encoding: gzip
server: openresty
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
x-request-id: F69MlfAnU2g9p42K5qtB
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

cnv
cnv.event.prod.bidr.io/log/
Redirect Chain

https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=[ORDER]&ord=[CACHEBUSTER]
https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=%5BORDER%5D&ord=%5BCACHEBUSTER%5D&_bee_ppp=1

43 B
796 B

30ms
30ms

Image
image/gif

52.210.45.0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=%5BORDER%5D&ord=%5BCACHEBUSTER%5D&_bee_ppp=1

Protocol

HTTP/1.1

Server

52.210.45.0 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-210-45-0.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
Date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=%5BORDER%5D&ord=%5BCACHEBUSTER%5D&_bee_ppp=1
Date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2 200 RC5266e3ee597a459fbc388f1132b7e943-source.min.js Show response
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/c9fca00f1528/ 521 B
587 B 9ms
7ms Script
application/x-javascript 2a02:26f0:480:980::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/c9fca00f1528/RC5266e3ee597a459fbc388f1132b7e943-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:980::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: ce04010f81026943ad5db47aaac761f4ac4103774c970056ec95316d1fd5eaca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
content-encoding: gzip
last-modified: Fri, 27 Oct 2023 18:01:17 GMT
server: AkamaiNetStorage
etag: "27301ca53ed689497d352b9a4a49a8d7:1698429677.369864"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 329
expires: Wed, 31 Jan 2024 03:09:50 GMT

GET
H/1.1 200
OK visitor Show response
sjrtp6.marketo.com/gw1/rtp/api/v1_1/ 784 B
1 KB 779ms
157ms XHR
application/json 192.28.146.116
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp6.marketo.com/gw1/rtp/api/v1_1/visitor?sid=cyberarksoftware-1706666989155-3d2bc845&aid=cyberarksoftware&1706666990649

Requested by

Host: rtp-static.marketo.com
URL: https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.5.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.28.146.116 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(9.4.45.v20220203) /

Resource Hash

04e545b5be20845b92830f58259a279ea253b40de581740bfe0b95c18dc9e4c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Pragma: No-cache
Date: Wed, 31 Jan 2024 02:09:51 GMT
Strict-Transport-Security: max-age=63113904
Last-Modified: Tue Jan 30 20:09:51 CST 2024
Server: Jetty(9.4.45.v20220203)
Vary: Origin
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: https://www.cyberark.com
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Access-Control-Allow-Credentials: true
Connection: close
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK sgm Show response
sjrtp6.marketo.com/gw1/ga/ 799 B
1 KB 791ms
158ms XHR
text/json 192.28.146.116
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp6.marketo.com/gw1/ga/sgm?sid=cyberarksoftware-1706666989155-3d2bc845&1706666990650

Requested by

Host: rtp-static.marketo.com
URL: https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.5.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.28.146.116 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(9.4.45.v20220203) /

Resource Hash

6718cd8faf856f181f860473746fe497344c5f6e01360a65309d7f91640eb53d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 31 Jan 2024 02:09:51 GMT
Strict-Transport-Security: max-age=63113904
Server: Jetty(9.4.45.v20220203)
Content-Type: text/json;charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: close
Content-Length: 799

GET
H2 200 27v1i6bir9.m3u8 Show response
fast.wistia.com/embed/medias/ 1 KB
2 KB 8ms
8ms XHR
application/x-mpegurl 2a04:4e42:400::644
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/embed/medias/27v1i6bir9.m3u8

Requested by

Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/engines/hls_video.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::644 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

envoy /

Resource Hash

63f285c8e4892a07161fd53d4f726105db1631400ae791a7db4aa33e91278125

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
x-player-privacy-mode: 1
x-content-type-options: nosniff
strict-transport-security: max-age=0
via: 1.1 38ecebcaa39c8742da2b6336935bb446.cloudfront.net (CloudFront), 1.1 varnish, 1.1 varnish
x-permitted-cross-domain-policies: none
x-amz-cf-pop: IAD89-C3
age: 56081
x-cache: Miss from cloudfront, HIT, HIT
x-envoy-upstream-service-time: 42
content-length: 1349
x-request-id: bf322af2-9249-4cbb-9fc1-d21045a3b07f
x-served-by: cache-iad-kjyo7100152-IAD, cache-fra-eddf8230043-FRA
x-runtime: 0.040520
x-browser-version: 120
server: envoy
x-timer: S1706666991.721607,VS0,VE1
etag: W/"63f285c8e4892a07161fd53d4f726105"
vary: Accept-Encoding,X-Forwarded-Proto,X-ECMA-Override
content-type: application/x-mpegURL
access-control-allow-origin: *
cache-control: public, no-cache
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: -ig-4G7piFUw38IQI-6lsJCCm3rEwzvXEYJYzHrr92T8QSbtOUZxtA==
x-cache-hits: 12, 1

GET
H2 200 blank.gif
fast.wistia.com/assets/images/ 1 KB
2 KB 11ms
5ms Image
image/gif 2a04:4e42:400::644
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fast.wistia.com/assets/images/blank.gif

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::644 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

a78759ea185fd0fa42ca9be1fc5bca4d3167a2836dc6c85e479a19dbf57fe2c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Origin: https://www.cyberark.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=0
age: 3518
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
content-length: 1214
x-served-by: cache-iad-kcgs7200077-IAD, cache-fra-eddf8230043-FRA
x-browser-version: 120
last-modified: Wed, 10 May 2023 19:48:54 GMT
server: AmazonS3
x-timer: S1706666991.731547,VS0,VE0
etag: "fbdc4ed9a1e2ee4917a265306927bcf1"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=3600
x-browser: chrome
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 19, 33

GET
H3 200 /
www.google.com/pagead/1p-user-list/1071691665/ 42 B
64 B 23ms
23ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1071691665/?random=1706666990580&cv=11&fst=1706666400000&bg=ffffff&guid=ON&async=1&gtm=45He41t0v72025662&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&frm=0&tiba=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_kjzab_yHS8XnT44LzWkQBGjfm-r0PMwiDel5SCiKV-l_aPhB&random=734487259&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:50 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/1071691665/ 42 B
64 B 25ms
24ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1071691665/?random=1706666990580&cv=11&fst=1706666400000&bg=ffffff&guid=ON&async=1&gtm=45He41t0v72025662&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&frm=0&tiba=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_kjzab_yHS8XnT44LzWkQBGjfm-r0PMwiDel5SCiKV-l_aPhB&random=734487259&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:50 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 RCa5164e12c82447adb2cd80d0c9b8bb38-source.min.js Show response
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/c9fca00f1528/ 504 B
582 B 12ms
12ms Script
application/x-javascript 2a02:26f0:480:980::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/c9fca00f1528/RCa5164e12c82447adb2cd80d0c9b8bb38-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:980::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: ecceaab7dbf1f1fe1d9065a03b9b9e0f1b54e1f73b7db1c76a91fb2444dc67de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
content-encoding: gzip
last-modified: Fri, 27 Oct 2023 18:01:17 GMT
server: AkamaiNetStorage
etag: "27301ca53ed689497d352b9a4a49a8d7:1698429677.369864"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 324
expires: Wed, 31 Jan 2024 03:09:50 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1706666990750&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1706666990750&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&cookiesTest=true
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D17906%26time%3D1706666990750%26url%3Dhttps%253A%252F%252Fwww.cyberark.com%252Fres...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1706666990750&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&cookiesTest=tru...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1706666990750&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&cookiesTest=tr...

0
266 B

235ms
190ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1706666990750&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&cookiesTest=true&liSync=true&e_ipv6=AQJwvoCa7zRpKQAAAY1dR5-E049Y84Gjx9a_jx8KqRol4TXHp0KL8Uv-8ygqoG-v
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 8F3845245F054EC480D365D560FF518A Ref B: DUS30EDGE0322 Ref C: 2024-01-31T02:09:51Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYQNF/KnXqmaGUFskpBZA==

Redirect headers

date: Wed, 31 Jan 2024 02:09:51 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: F8100E048637400FAF1DBFA476381D75 Ref B: FRAEDGE1215 Ref C: 2024-01-31T02:09:51Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1706666990750&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&cookiesTest=true&liSync=true&e_ipv6=AQJwvoCa7zRpKQAAAY1dR5-E049Y84Gjx9a_jx8KqRol4TXHp0KL8Uv-8ygqoG-v
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYQNF/G69+yo0BeA2Asqg==

GET
H2 200 a37ec81fa5bc210278c55351e44afa5e8d27f104.m3u8 Show response
embed-cloudfront.wistia.com/deliveries/ 1 KB
2 KB 49ms
8ms XHR
application/vnd.apple.mpegurl 2600:9000:211e:fe00:1e:c86:4140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cloudfront.wistia.com/deliveries/a37ec81fa5bc210278c55351e44afa5e8d27f104.m3u8
Requested by: Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/engines/hls_video.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:fe00:1e:c86:4140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: envoy /
Resource Hash: c2861aa3df08bb8f1c303f91bcc8c8e8d9838b00afef972c32f2f42e4f64cd39

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 15:38:13 GMT
via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762e.cloudfront.net (CloudFront)
x-cdn: cloudfront
x-amz-cf-pop: FRA56-C2
age: 37897
edge-cache-tag: a37ec81fa5bc210278c55351e44afa5e8d27f104-hls-segment
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 55
content-length: 1195
surrogate-key: a37ec81fa5bc210278c55351e44afa5e8d27f104-hls-segment
last-modified: Mon, 05 Nov 2018 10:11:00 GMT
server: envoy
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
access-control-expose-headers: Server,range,Content-Length,Content-Range,x-cdn
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: no2g0fbelomFkTya0dkF82k00UaO1LC8vi1xb_4MYwWeKBxDwDiv5w==
expires: Wed, 29 Jan 2025 15:38:13 GMT

GET
H2 200 286320195733404 Show response
connect.facebook.net/signals/config/ 61 KB
12 KB 11ms
10ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/286320195733404?v=2.9.143&r=stable&domain=www.cyberark.com&hme=1e96626f56fb37feabdb16bd09d3dbece570479b2ec677eec7364c762eaf296e&ex_m=62%2C104%2C92%2C96%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C146%2C149%2C160%2C156%2C157%2C159%2C25%2C89%2C45%2C68%2C158%2C141%2C144%2C153%2C154%2C161%2C113%2C13%2C43%2C165%2C164%2C115%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C93%2C95%2C31%2C94%2C26%2C22%2C142%2C145%2C122%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C91%2C38%2C70%2C60%2C97%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C98

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

dff6fc5dcca6679a17f0219d59fd19797b87b52adc6a12cb5ec641b8722398b0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 31 Jan 2024 02:09:50 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 12656
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: 0zbTo++Q+GoU15nvkfzU3UP1AbnD3nnb+95bpDsONr7zzlFo/1eLU0FPYy2jIeSv/r2nZxmqX43f4+vCllpPEg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 p Show response
i.simpli.fi/ 798 B
757 B 27ms
18ms Script
application/javascript 35.204.89.238
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.simpli.fi/p?cid=440562&cb=sifi_att_42656._hp
Requested by: Host: tag.simpli.fi
URL: https://tag.simpli.fi/sifitag/dc000d50-4dbc-4d9a-ba52-c3015680f76c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 35.204.89.238 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 238.89.204.35.bc.googleusercontent.com
Software: openresty /
Resource Hash: 14f24d7498818913eeda69e8037aa1a2aa7f2e1d31a8ddde6ec03baffda80d9a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:50 GMT
content-encoding: gzip
server: openresty
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 dc_pre=CPyg6_3FhoQDFdlTkQUd2NwLlg;src=9920016;type=websi0;cat=websi0;ord=2605111504476;auiddc=*;pscdl=noapi;gtm=45fe41t0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;...
adservice.google.com/ddm/fls/z/ Frame 1E7D 42 B
401 B 89ms
51ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CPyg6_3FhoQDFdlTkQUd2NwLlg;src=9920016;type=websi0;cat=websi0;ord=2605111504476;auiddc=*;pscdl=noapi;gtm=45fe41t0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game

Requested by

Host: 9920016.fls.doubleclick.net
URL: https://9920016.fls.doubleclick.net/activityi;dc_pre=CPyg6_3FhoQDFdlTkQUd2NwLlg;src=9920016;type=websi0;cat=websi0;ord=2605111504476;auiddc=1992125960.1706666988;pscdl=noapi;gtm=45fe41t0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9920016.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/choozle/14963/ 387 B
718 B 45ms
44ms Script
text/javascript 2600:9000:206f:e600:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/14963/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/choozle/14963/code/&publishedOn=Sat%20Oct%2028%2014:30:32%20GMT%202023&ClientID=923&PageID=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/14963/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:e600:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: a9e1fe762e98db2f81933cfaf6078e9beb45b479de25a6a7ee288b08a0ea807d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
via: 1.1 547a50460a0cda7ae3dafb1c0b6d0e1a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C1
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
alt-svc: h3=":443"; ma=86400
content-length: 387
x-amz-cf-id: sOdlLdUjzU_dphbKh1BNU0wIqjHA3eRcslSgr3nOpPH1NZTaz5qxhA==
expires: Wed, 31 Jan 2024 02:09:49 GMT

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 101ms
98ms Stylesheet
text/css 3.77.28.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.77.28.166 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-77-28-166.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 45fc084d4788e26e26855549406938f7d5be45e6a9d8469681d4026f6b7e2f6c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 31 Jan 2024 02:09:50 GMT
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
2 KB 122ms
98ms Fetch
image/jpeg 3.77.28.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.77.28.166 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-77-28-166.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 31 Jan 2024 02:09:50 GMT
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
content-type: image/jpeg

GET
H2 200 seg-1-v1-a1.ts Show response
embed-cloudfront.wistia.com/deliveries/a37ec81fa5bc210278c55351e44afa5e8d27f104.m3u8/ 200 KB
201 KB 10ms
9ms XHR
video/mp2t 2600:9000:211e:fe00:1e:c86:4140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cloudfront.wistia.com/deliveries/a37ec81fa5bc210278c55351e44afa5e8d27f104.m3u8/seg-1-v1-a1.ts
Requested by: Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/engines/hls_video.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:fe00:1e:c86:4140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: envoy /
Resource Hash: d848c15dad5edf002d378962f1f92effea1479fe5bf2570ac95edb9318dfc070

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 15:37:46 GMT
via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762e.cloudfront.net (CloudFront)
x-cdn: cloudfront
x-amz-cf-pop: FRA56-C2
age: 37923
edge-cache-tag: a37ec81fa5bc210278c55351e44afa5e8d27f104-hls-segment
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 75
content-length: 204920
surrogate-key: a37ec81fa5bc210278c55351e44afa5e8d27f104-hls-segment
last-modified: Mon, 05 Nov 2018 10:11:00 GMT
server: envoy
content-type: video/MP2T
access-control-allow-origin: *
access-control-expose-headers: Server,range,Content-Length,Content-Range,x-cdn
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: Xlz4lcmvzUbWlnMmgSUADapEPwMpyBXOa8V6w3QNSa2wUw3Rr6iZFg==
expires: Wed, 29 Jan 2025 15:37:46 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 40ms
7ms Image
text/plain 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=286320195733404&ev=PageView&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&rl=&if=false&ts=1706666990824&sw=1600&sh=1200&v=2.9.143&r=stable&ec=0&o=4126&fbp=fb.1.1706666990821.959004997&cs_est=true&ler=empty&cdl=API_unavailable&it=1706666990780&coo=false&exp=e1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 31 Jan 2024 02:09:50 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2

204

/
s.ad.smaato.net/c/
Redirect Chain

https://um.simpli.fi/smaato
https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=DB4DF4F3ABA5459F8F03CDAFD3B376F8

0
237 B

61ms
23ms

Image
text/plain

2600:9000:211e:b400:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=DB4DF4F3ABA5459F8F03CDAFD3B376F8
Protocol: H2
Server: 2600:9000:211e:b400:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
cache-control: no-cache, must-revalidate
via: 1.1 e6959f77d21557f69683da8f0cd5578a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C2
x-amz-cf-id: nRfBhy3Y-FMKdrmCIgyLiru35nAvZ-w9kCeOj9R_hlCaytVPpIAU4g==
x-cache: Miss from cloudfront

Redirect headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://s.ad.smaato.net/c/?dspInit=1001136&dspCookie=DB4DF4F3ABA5459F8F03CDAFD3B376F8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 30 Jan 2024 02:09:50 GMT

GET
H2

200

RX-0d113d1f-1e82-4f5c-876f-f80dd81e529d-003
sync.targeting.unrulymedia.com/csync/
Redirect Chain

https://um.simpli.fi/nexxen
https://sync.1rx.io/usersync/simplifi/DB4DF4F3ABA5459F8F03CDAFD3B376F8
https://sync.1rx.io/usersync/simplifi/DB4DF4F3ABA5459F8F03CDAFD3B376F8?zcc=1&cb=1706666990983
https://sync.targeting.unrulymedia.com/csync/RX-0d113d1f-1e82-4f5c-876f-f80dd81e529d-003

43 B
378 B

65ms
14ms

Image
image/gif

46.228.174.117
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-0d113d1f-1e82-4f5c-876f-f80dd81e529d-003
Protocol: H2
Server: 46.228.174.117 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
content-length: 43
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

location: https://sync.targeting.unrulymedia.com/csync/RX-0d113d1f-1e82-4f5c-876f-f80dd81e529d-003
pragma: no-cache
date: Wed, 31 Jan 2024 02:09:51 GMT
cache-control: no-store, no-cache, must-revalidate
expires: 0
content-type: text/html

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=DB4DF4F3ABA5459F8F03CDAFD3B376F8&dongle=yf3

37 B
140 B

54ms
12ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7969&xuid=DB4DF4F3ABA5459F8F03CDAFD3B376F8&dongle=yf3
Protocol: H2
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
content-type: image/gif

Redirect headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://eb2.3lift.com/xuid?mid=7969&xuid=DB4DF4F3ABA5459F8F03CDAFD3B376F8&dongle=yf3
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 30 Jan 2024 02:09:50 GMT

GET
H2

200

sync
simplifi.partners.tremorhub.com/
Redirect Chain

https://um.simpli.fi/telaria_p
https://simplifi.partners.tremorhub.com/sync?UISF=DB4DF4F3ABA5459F8F03CDAFD3B376F8

43 B
175 B

336ms
91ms

Image
image/gif

2600:1f18:612b:4280:c452:8a8b:24f9:dc81
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simplifi.partners.tremorhub.com/sync?UISF=DB4DF4F3ABA5459F8F03CDAFD3B376F8
Protocol: H2
Server: 2600:1f18:612b:4280:c452:8a8b:24f9:dc81 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Wed, 31 Jan 2024 02:09:51 GMT
server: nginx
content-type: image/gif

Redirect headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://simplifi.partners.tremorhub.com/sync?UISF=DB4DF4F3ABA5459F8F03CDAFD3B376F8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 30 Jan 2024 02:09:50 GMT

GET
H2

200

check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain

https://um.simpli.fi/tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=DB4DF4F3ABA5459F8F03CDAFD3B376F8
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=DB4DF4F3ABA5459F8F03CDAFD3B376F8

95 B
427 B

20ms
17ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=DB4DF4F3ABA5459F8F03CDAFD3B376F8

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=DB4DF4F3ABA5459F8F03CDAFD3B376F8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

empty.gif
um.simpli.fi/
Redirect Chain

https://um.simpli.fi/ad_advisor
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=DB4DF4F3ABA5459F8F03CDAFD3B376F8
https://d.agkn.com/pixel/10751/?che=1706666990988&ip=81.95.5.37&l1=https%3A%2F%2Fum.simpli.fi%2Faa_px%3Fsk%3D217153104778000126231
https://um.simpli.fi/aa_px?sk=217153104778000126231
https://um.simpli.fi/empty.gif

43 B
361 B

16ms
16ms

Image
image/gif

35.204.158.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/empty.gif

Protocol

Server

35.204.158.49 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

49.158.204.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43

Redirect headers

date: Wed, 31 Jan 2024 02:09:51 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: /empty.gif
access-control-allow-origin: *
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142

GET
H2

403

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain

https://um.simpli.fi/intentiq
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=DB4DF4F3ABA5459F8F03CDAFD3B376F8

0
0

51ms
4ms

Image
text/html

52.222.214.69
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=DB4DF4F3ABA5459F8F03CDAFD3B376F8
Protocol: H2
Server: 52.222.214.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-69.fra56.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Redirect headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=DB4DF4F3ABA5459F8F03CDAFD3B376F8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 30 Jan 2024 02:09:50 GMT

GET
H2 200 pubmatic
um.simpli.fi/ 43 B
409 B 22ms
16ms Image
image/gif 35.204.158.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.158.49 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

49.158.204.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Tue, 30 Jan 2024 02:09:50 GMT

GET
H2 200 freewheel
um.simpli.fi/ 43 B
409 B 23ms
17ms Image
image/gif 35.204.158.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/freewheel

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.158.49 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

49.158.204.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Tue, 30 Jan 2024 02:09:50 GMT

GET
H2

204

cms
ups.analytics.yahoo.com/ups/58726/
Redirect Chain

https://um.simpli.fi/dtnx
https://fei.pro-market.net/engine?du=24;csync=DB4DF4F3ABA5459F8F03CDAFD3B376F8;mimetype=img;
https://fei.pro-market.net/engine?du=24;csync=DB4DF4F3ABA5459F8F03CDAFD3B376F8;mimetype=img;sr
https://cms.analytics.yahoo.com/cms?partner_id=DATCS
https://ups.analytics.yahoo.com/ups/58726/cms?partner_id=DATCS

0
87 B

190ms
179ms

Image
text/plain

3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58726/cms?partner_id=DATCS

Protocol

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.94 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.94
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/58726/cms?partner_id=DATCS
date: Wed, 31 Jan 2024 02:09:51 GMT
cache-control: no-store
content-type: text/html
server: ATS/9.1.10.94
content-length: 344
content-language: en

GET
H2

204

/
loadm.exelator.com/load/
Redirect Chain

https://um.simpli.fi/exelatem
https://loadm.exelator.com/load/?p=204&g=2191&simid=DB4DF4F3ABA5459F8F03CDAFD3B376F8&j=0
https://loadm.exelator.com/load/?p=204&g=2191&simid=DB4DF4F3ABA5459F8F03CDAFD3B376F8&j=0&xl8blockcheck=1

0
767 B

35ms
34ms

Image
text/plain

54.78.254.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadm.exelator.com/load/?p=204&g=2191&simid=DB4DF4F3ABA5459F8F03CDAFD3B376F8&j=0&xl8blockcheck=1
Protocol: H2
Server: 54.78.254.47 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-78-254-47.eu-west-1.compute.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

Redirect headers

date: Wed, 31 Jan 2024 02:09:51 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://loadm.exelator.com/load/?p=204&g=2191&simid=DB4DF4F3ABA5459F8F03CDAFD3B376F8&j=0&xl8blockcheck=1
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
content-length: 0

GET
H2 200 yahoo
um.simpli.fi/ 43 B
409 B 23ms
18ms Image
image/gif 35.204.158.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/yahoo

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.158.49 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

49.158.204.35.bc.googleusercontent.com

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Tue, 30 Jan 2024 02:09:50 GMT

GET
H/1.1

204

sync
sync.bfmio.com/
Redirect Chain

https://um.simpli.fi/beachfront
https://sync.bfmio.com/sync?pid=141&uid=DB4DF4F3ABA5459F8F03CDAFD3B376F8

0
421 B

418ms
91ms

Image
text/plain

52.54.120.189
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.bfmio.com/sync?pid=141&uid=DB4DF4F3ABA5459F8F03CDAFD3B376F8
Protocol: HTTP/1.1
Server: 52.54.120.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-120-189.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Connection: keep-alive
Date: Wed, 31 Jan 2024 02:09:50 GMT

Redirect headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://sync.bfmio.com/sync?pid=141&uid=DB4DF4F3ABA5459F8F03CDAFD3B376F8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 30 Jan 2024 02:09:50 GMT

GET
H2

200

29931
stags.bluekai.com/site/
Redirect Chain

https://um.simpli.fi/bluekai
https://stags.bluekai.com/site/29931?id=DB4DF4F3ABA5459F8F03CDAFD3B376F8

62 B
446 B

222ms
159ms

Image
image/gif

92.123.17.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/29931?id=DB4DF4F3ABA5459F8F03CDAFD3B376F8
Protocol: H2
Server: 92.123.17.8 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-123-17-8.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Wed, 31 Jan 2024 02:09:51 GMT
content-length: 62
content-type: image/gif

Redirect headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://stags.bluekai.com/site/29931?id=DB4DF4F3ABA5459F8F03CDAFD3B376F8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 30 Jan 2024 02:09:50 GMT

GET
H2

404

tpid=DB4DF4F3ABA5459F8F03CDAFD3B376F8
bcp.crwdcntrl.net/map/c=7625/tp=SIMP/
Redirect Chain

https://um.simpli.fi/crwdcntrl
https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=DB4DF4F3ABA5459F8F03CDAFD3B376F8

49 B
265 B

105ms
30ms

Image
image/gif

99.80.224.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=DB4DF4F3ABA5459F8F03CDAFD3B376F8
Protocol: H2
Server: 99.80.224.8 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-224-8.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:51 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.3.122
content-length: 49
expires: 0

Redirect headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=DB4DF4F3ABA5459F8F03CDAFD3B376F8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 30 Jan 2024 02:09:50 GMT

GET
H2

204

merge
ce.lijit.com/
Redirect Chain

https://um.simpli.fi/lj_match
https://ce.lijit.com/merge?pid=2&3pid=DB4DF4F3ABA5459F8F03CDAFD3B376F8

0
205 B

114ms
28ms

Image
text/plain

99.80.4.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=DB4DF4F3ABA5459F8F03CDAFD3B376F8
Protocol: H2
Server: 99.80.4.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-4-3.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

expires: Fri, 20 Mar 2009 00:00:00 GMT
pragma: no-cache
date: Wed, 31 Jan 2024 02:09:51 GMT
x-merge: GDPR Optout true
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
p3p: CP="CUR ADM OUR NOR STA NID"

Redirect headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://ce.lijit.com/merge?pid=2&3pid=DB4DF4F3ABA5459F8F03CDAFD3B376F8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 30 Jan 2024 02:09:50 GMT

GET
H2

451

419566.gif
idsync.rlcdn.com/
Redirect Chain

https://um.simpli.fi/liveramp_match
https://idsync.rlcdn.com/419566.gif?partner_uid=DB4DF4F3ABA5459F8F03CDAFD3B376F8

0
98 B

69ms
16ms

Image
text/plain

35.244.174.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/419566.gif?partner_uid=DB4DF4F3ABA5459F8F03CDAFD3B376F8
Protocol: H2
Server: 35.244.174.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

Redirect headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://idsync.rlcdn.com/419566.gif?partner_uid=DB4DF4F3ABA5459F8F03CDAFD3B376F8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 30 Jan 2024 02:09:50 GMT

GET
H3

200

/
www.google.de/pagead/1p-conversion/1026675585/
Redirect Chain

https://www.googleadservices.com/pagead/conversion/1026675585/?random=1706666990807&cv=7&fst=1706666990807&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1837091277&cv=7&fst=1706666990807&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&ocp_id=...
https://www.google.com/pagead/1p-conversion/1026675585/?random=1837091277&cv=7&fst=1706666990807&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMIran1_...
https://www.google.de/pagead/1p-conversion/1026675585/?random=1837091277&cv=7&fst=1706666990807&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMIran1_c...

42 B
64 B

29ms
25ms

Image
image/gif

2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/1026675585/?random=1837091277&cv=7&fst=1706666990807&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMIran1_cWGhAMVemaRBR0gnwRc&is_vtc=1&ocp_id=7qu5Za36M_rMxdwPoL6S4AU&cid=CAQSKQAvHhf_6ZFLd8me3rYP8RA9UlME_tZYhCUIGxC5HPrHLn_Blyfs639D&random=1975971558&ipr=y

Protocol

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:50 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:50 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-conversion/1026675585/?random=1837091277&cv=7&fst=1706666990807&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMIran1_cWGhAMVemaRBR0gnwRc&is_vtc=1&ocp_id=7qu5Za36M_rMxdwPoL6S4AU&cid=CAQSKQAvHhf_6ZFLd8me3rYP8RA9UlME_tZYhCUIGxC5HPrHLn_Blyfs639D&random=1975971558&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 spotx_match
um.simpli.fi/ 0
272 B 32ms
27ms Image
text/plain 35.204.158.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/spotx_match

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.204.158.49 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

49.158.204.35.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS

GET
H2

200

bounce
ib.adnxs.com/
Redirect Chain

https://um.simpli.fi/an
https://ib.adnxs.com/setuid?entity=66&code=DB4DF4F3ABA5459F8F03CDAFD3B376F8
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3DDB4DF4F3ABA5459F8F03CDAFD3B376F8

43 B
1 KB

17ms
14ms

Image
image/gif

185.89.210.82
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3DDB4DF4F3ABA5459F8F03CDAFD3B376F8

Protocol

Server

185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:51 GMT
an-x-request-uuid: 8761fd89-ce7e-4d6f-9421-bdedf9999cf6
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.37; 81.95.5.37; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:50 GMT
an-x-request-uuid: 2b1d7b7f-7e2b-4dc3-b813-6a736efd55e5
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D66%26code%3DDB4DF4F3ABA5459F8F03CDAFD3B376F8
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.37; 81.95.5.37; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://um.simpli.fi/rb_match
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=DB4DF4F3ABA5459F8F03CDAFD3B376F8&expires=365

0
239 B

81ms
8ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=DB4DF4F3ABA5459F8F03CDAFD3B376F8&expires=365
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: ef823186f233724f4775c0c4b9549d14
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=DB4DF4F3ABA5459F8F03CDAFD3B376F8&expires=365
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 30 Jan 2024 02:09:50 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://um.simpli.fi/ox_match
https://us-u.openx.net/w/1.0/sd?id=537072966&val=DB4DF4F3ABA5459F8F03CDAFD3B376F8

43 B
264 B

56ms
16ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072966&val=DB4DF4F3ABA5459F8F03CDAFD3B376F8
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:50 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Wed, 31 Jan 2024 02:09:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://us-u.openx.net/w/1.0/sd?id=537072966&val=DB4DF4F3ABA5459F8F03CDAFD3B376F8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 30 Jan 2024 02:09:50 GMT

GET
H2

204

g_match
um.simpli.fi/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
https://um.simpli.fi/g_match?id=&google_gid=CAESEFgw7JoyA8ckwMhqq1zpPNA&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=DB4DF4F3ABA5459F8F03CDAFD3B376F8
https://um.simpli.fi/g_match?id=

0
320 B

18ms
15ms

Image
text/plain

35.204.158.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/g_match?id=

Protocol

Server

35.204.158.49 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

49.158.204.35.bc.googleusercontent.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Tue, 30 Jan 2024 02:09:51 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://um.simpli.fi/g_match?id=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 229
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 08773fb052a2034353e4744495485b88.js Show response
nexus.ensighten.com/choozle/14963/code/ 673 B
1 KB 9ms
9ms Script
application/javascript 2600:9000:206f:e600:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/14963/code/08773fb052a2034353e4744495485b88.js?conditionId0=4910939
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/14963/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:e600:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 60f515991307abd345708ae3d50ff9a7751c68c208e2586d992c3c6ff729d6b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 28 Oct 2023 14:38:25 GMT
x-amz-version-id: kpkF4PXL.K8vMpkqxwzwd03dNtjBok8N
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
age: 8163086
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
content-length: 673
last-modified: Sat, 28 Oct 2023 14:30:41 GMT
server: CloudFront
etag: "314ad2369d67fe2807f627dbfdcbf52d"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: IJ99q1HlJoNZpN2cVtS_0VjRbO61yAGgcHHlZcTDnybddZLE3BpE-w==

GET
H3 200 d3d14424fac71699bdbff068d9b1184b.js Show response
nexus.ensighten.com/choozle/14963/code/ 2 KB
803 B 10ms
9ms Script
application/javascript 2600:9000:206f:e600:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/14963/code/d3d14424fac71699bdbff068d9b1184b.js?conditionId0=421905
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/14963/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:e600:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e80cfc6df2f882813f88dcf1175bc0c47e13c0cd8517bc240a65ee6cc758b0f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 28 Oct 2023 14:31:34 GMT
x-amz-version-id: ffPQ1iXE0NqYZgujQn.J5knMjbGtNIPl
content-encoding: br
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
age: 8163497
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Sat, 28 Oct 2023 14:30:45 GMT
server: CloudFront
etag: W/"e8e93310d35a9462151b8fdab5b436ce"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: cMD79UA_NSQEnjwMeG3llosBU3UjBSQECRk_1sCJvgrbHb2_fOgKrw==

GET
H2 200 8cb54bb4d870fc1722495b72ba1d98692166dac1.m3u8 Show response
embed-cloudfront.wistia.com/deliveries/ 1 KB
2 KB 8ms
5ms XHR
application/vnd.apple.mpegurl 2600:9000:211e:fe00:1e:c86:4140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://embed-cloudfront.wistia.com/deliveries/8cb54bb4d870fc1722495b72ba1d98692166dac1.m3u8
Requested by: Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/engines/hls_video.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:fe00:1e:c86:4140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: envoy /
Resource Hash: cf586f008acee3c57d9cd2e03d04c0ee3c9f804ced4b1c210d1e32a74a1e9c10

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 15:37:47 GMT
via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762e.cloudfront.net (CloudFront)
x-cdn: cloudfront
x-amz-cf-pop: FRA56-C2
age: 37923
edge-cache-tag: 8cb54bb4d870fc1722495b72ba1d98692166dac1-hls-segment
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 339
content-length: 1195
surrogate-key: 8cb54bb4d870fc1722495b72ba1d98692166dac1-hls-segment
last-modified: Mon, 05 Nov 2018 10:11:00 GMT
server: envoy
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
access-control-expose-headers: Server,range,Content-Length,Content-Range,x-cdn
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: V6tYiHVGuuCNpPPt1_zFiAMqHnsczN7TbNPF2vSliJ8adhFfMH3CEg==
expires: Wed, 29 Jan 2025 15:37:47 GMT

POST
H2 200 s41738074877947 Show response
cyberark.sc.omtrdc.net/b/ss/cyberarkproduction/1/JS-2.23.0-LDQM/ 43 B
390 B 77ms
19ms XHR
image/gif 63.140.62.27
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://cyberark.sc.omtrdc.net/b/ss/cyberarkproduction/1/JS-2.23.0-LDQM/s41738074877947

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.27 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-63-140-62-27.data.adobedc.net

Software

jag /

Resource Hash

55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 31 Jan 2024 02:09:51 GMT
x-content-type-options: nosniff
last-modified: Thu, 01 Feb 2024 02:09:51 GMT
server: jag
etag: 3665039457835089920-4617783393529925750
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.cyberark.com
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Tue, 30 Jan 2024 02:09:51 GMT

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 185 B
380 B 105ms
98ms XHR
text/plain 3.77.28.166
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=hLcqEj_jyS_TFE6yvRCw0w&is_js=true&landing_url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&t=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&tip=6MxgcMH3g3ylzUoGeAejmO5t7guj17ID_til-zc0TyE&host=https%3A%2F%2Fwww.cyberark.com&sa_conv_data_css_value=%270-c20b79d3-8b16-55e2-51ca-93c52ac8c5f4%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9c20b79d38b1655e251ca93c52ac8c5f4515f0525&sa-user-id-v3=s%253AAQAKIHdD5aik2sMuu9MUMiKohGwkzzWhkJfMui96JqsVistBEHwYBCDu1-atBjABOgQ7vvenQgQzZlXE.%252BWzbUo0qPrsWM3agz%252F6YikXGXH1u12eucLz4%252BsGY4FA&sa-user-id-v2=s%253Awgt504sWVeJRypPFKsjF9FFfBSU.FWZXYv3ZnNZGHMdIEaDafTCUhtwdSqb5SO1xy9sZedM&sa-user-id=s%253A0-c20b79d3-8b16-55e2-51ca-93c52ac8c5f4.Wj94abwqhGhIXBoledkDrcVwKDL1CJFTsIebEFEYYKY
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.77.28.166 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-77-28-166.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: b62a7cb7330e30caac7fbca43afcfd4f18e2fffd1fa372cab93c625f3d2f3f1a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-origin: https://www.cyberark.com
date: Wed, 31 Jan 2024 02:09:51 GMT
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 185
access-control-allow-methods: GET
content-type: text/plain; charset=utf-8

GET
H2 200 core Show response
js.driftt.com/ Frame 6B88 2 KB
1 KB 118ms
117ms Document
text/html 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1706667000000/ey22i6m9p82y.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

69dd333c29a4b5e4af6ba9979f292b4d48639a55d21b5a9c518c0338644aedcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 31 Jan 2024 02:09:51 GMT
etag: W/"709e1d949c69eada7a0ca9ed0b6ce540"
last-modified: Tue, 30 Jan 2024 20:20:36 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-id: AweIVs5F5xzQcgr404qvCJvh0ycVGblG_9WF3sEZLH2U3Urhbz75jA==
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-amz-version-id: xfIQAhP0Z7mzs2zkjcB.GGaWG5RrIbK2
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 13

GET
H2 200 chat Show response
js.driftt.com/core/ Frame EEE9 2 KB
1 KB 119ms
117ms Document
text/html 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1706667000000/ey22i6m9p82y.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

69dd333c29a4b5e4af6ba9979f292b4d48639a55d21b5a9c518c0338644aedcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 31 Jan 2024 02:09:51 GMT
etag: W/"709e1d949c69eada7a0ca9ed0b6ce540"
last-modified: Tue, 30 Jan 2024 20:20:36 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-id: zPaVWqkB9G8vqLIslJicjmohZIuRgpwvBAjqEQ2MKIm54wTlJ9EdUg==
x-amz-cf-pop: FRA60-P6
x-amz-server-side-encryption: AES256
x-amz-version-id: xfIQAhP0Z7mzs2zkjcB.GGaWG5RrIbK2
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 11

GET
H2 200 runtime~main.be089384.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 6 KB
3 KB 7ms
6ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

4891ae2b0a7fd1bd7180806843221e6d89a9d08d2bd1ea14adcf42cd74176a6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: xtycQo_IRyCLNoLddZPZ2is8sLxSxVEQ
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20955
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 34
last-modified: Tue, 30 Jan 2024 16:30:59 GMT
server: istio-envoy
etag: W/"a37d88c0ab512066f540acf513660ab4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: uy2V5DfEbLhXOLjITyitKw3VbcaqA-WMbYNWH7tCzgS57jDCp7zNiA==

GET
H2 200 9.4a3e9801.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 35 KB
13 KB 8ms
7ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:47 GMT
x-amz-version-id: xDLMc9.vfMRinFJv17uWwlTUqFMyHh91
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071464
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 14
last-modified: Tue, 19 Dec 2023 18:34:39 GMT
server: istio-envoy
etag: W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: cVSsgWfZy_T5AAdHCD11XqWjL7BcxtlD7rGXfLJ1EKUHwcRV10f0pA==

GET
H2 200 main~493df0b3.d2a43907.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 7 KB
3 KB 8ms
7ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.d2a43907.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 09:52:55 GMT
x-amz-version-id: vHJcyo5_wsHnB664RlshK2ErhD729WKk
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 5588216
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Tue, 21 Nov 2023 16:21:43 GMT
server: istio-envoy
etag: W/"e094b276ad2035c3a46871991c258c2d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bmWfEJ-BEl6gnRx6x6HRwyQFplHpbj5aeVfSvJ2rIEJflglDCecyQQ==

GET
H2 200 runtime~main.be089384.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 6 KB
3 KB 9ms
7ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

4891ae2b0a7fd1bd7180806843221e6d89a9d08d2bd1ea14adcf42cd74176a6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: xtycQo_IRyCLNoLddZPZ2is8sLxSxVEQ
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20955
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 34
last-modified: Tue, 30 Jan 2024 16:30:59 GMT
server: istio-envoy
etag: W/"a37d88c0ab512066f540acf513660ab4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2DQOkmZghLksXci9dtUhLL9alAeQY4OeDoTWwk5_lmuTL7obPn1xNw==

GET
H2 200 9.4a3e9801.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 35 KB
13 KB 10ms
7ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:47 GMT
x-amz-version-id: xDLMc9.vfMRinFJv17uWwlTUqFMyHh91
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071464
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 14
last-modified: Tue, 19 Dec 2023 18:34:39 GMT
server: istio-envoy
etag: W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: V15oZ1d5svMHpLmTjvSfK9oDSash-E6PyCEmXjkVdCYQ6F4rewhZLQ==

GET
H2 200 main~493df0b3.d2a43907.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 7 KB
3 KB 10ms
8ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.d2a43907.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
Origin: https://js.driftt.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 09:52:55 GMT
x-amz-version-id: vHJcyo5_wsHnB664RlshK2ErhD729WKk
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 5588216
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Tue, 21 Nov 2023 16:21:43 GMT
server: istio-envoy
etag: W/"e094b276ad2035c3a46871991c258c2d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: X6bO0J9YT34lS7CR__p2nhYgT2gjljVPoSwc8sQXDpVgMBjmH3TiHw==

GET
H2 200 51.558be3c5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 23 KB
8 KB 12ms
7ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 01:42:32 GMT
x-amz-version-id: jAn.UV4FUigTQ2pXuPEfcgJGaVkaFeLh
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 2334439
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Wed, 03 Jan 2024 21:36:01 GMT
server: istio-envoy
etag: W/"fa281fcbe4b2e35558d60fae3e316367"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: C-cptmsVY5nKAwBEu9GivoQXxkbg9O7o-5zGoKK3B8bWyGaDnDfSPA==

GET
H2 200 35.d0f1ccda.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 36 KB
10 KB 13ms
8ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.d0f1ccda.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: sgEYGmeR8Py6tciS9o0uWaEb0DViiRFb
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 34
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"46fa5a7bc37a22544a908e4ad950309c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: hZvJEsC-9eb4SWB5mVpQYnOnbDUHPT3B67SRY3kU5sXvChbj_M_hSg==

GET
H2 200 22.6b9a301a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 32 KB
11 KB 13ms
8ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.6b9a301a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: DvJ7CLlBPxNj4KV_C1b2ZR1X9H2QpJXV
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"d8739a9fe9a3a42936f5cd86c8727494"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: iH_YKnyIWPCPB3BrUoe_fakG5laLwPNDsEvmw4AEZXQqJRGy1AsGVA==

GET
H2 200 19.6f85b843.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 17 KB
6 KB 17ms
13ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.6f85b843.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: TS.9ApOzy..rylGKiVPdLcCX5dJ9HsBw
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"e28ebc3391b56e8f01ea063dc089e9d3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ASpBMiluaN3bflg0l6xYzxdgPAgSy8Kugui6i5vVMN9C84JHR9ljAA==

GET
H2 200 41.b4fc4de2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 25 KB
8 KB 17ms
13ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 12:03:53 GMT
x-amz-version-id: BGQZXXMqkBTxMl_P3y2PvIfHU9WeYGWx
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 5580358
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 21
last-modified: Tue, 21 Nov 2023 16:21:42 GMT
server: istio-envoy
etag: W/"a2ace4f65aa7b34dedb884f6cfe9df8d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Ymnr4Pw0u5caYt5ZZLza8Z4GtPtk_GSLRnw0oJ2jvqgEqrwWG5D6tg==

GET
H2 200 20.8c21ea18.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 74 KB
23 KB 18ms
14ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: 4VyxTF9cOmpvyHPO7jaWSto1hTdtU.sl
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 45
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"6d77a76055d81227033363af2f18caf8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 7r6JXCWNskZyJV9qoVh9rZ4OoDRFg5sE8hVTVGupmqGdVQusimT7aQ==

GET
H2 200 26.04e7f30b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 66 KB
20 KB 19ms
15ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.04e7f30b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: cqsMaYjOHahH71A7EXhyHFywLOEay3sx
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 32
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"49ce5445ddcf5d24ef3badc4eb1a11dd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: UExM10iyOvR-12Et9jL9YTnD_2ZBK_NtbKCMxiDQcFb9f_Jb35ifQA==

GET
H2 200 14.e24a6190.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 91 KB
28 KB 20ms
16ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.e24a6190.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: iLluOjfpMSRsML8bOSqA9V8JfTEqMP9L
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"16d7ae86e21434a32157d3226ac9bb77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: TNEpwFu2f-UKjg80hBTkTfIN8ZJqM9cYbwRZeZmTpvWfgpQwtSljkw==

GET
H2 200 11.639238ba.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 23 KB
7 KB 22ms
18ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.639238ba.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: cZI1cI6WRHhkzkWa3N1Jh4ekBwSSYCCx
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"4049f38c00add1738dc4806148ff8829"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: PH1i7pPPqbfBKe5meioJpteSJAYti1AwTfaI4DSqvrUkiWbLz1PQyg==

GET
H2 200 18.9c1bd1fb.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 62 KB
20 KB 22ms
18ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: q8W9FNPLIM8OX5drRDX0sp4TnKuKPMbY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 21
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"02f09379c544befa413d22eb57ed41de"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: feU9swmyaMY0uuKoJ0FeSzxcxGfp5XiLAJv8LigNtGzlbYZKpYYejA==

GET
H2 200 49.f7274268.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 105 KB
34 KB 23ms
19ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/49.f7274268.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: sZGsqYJSO5RNt4iGri.m215HFs7tyyoY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"e268d36b98f0119a2bb1a15f69fd4ffe"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bfrV7_9msBGiZOxe_1UZ0t1ZpzVdvSnQ2i63uAYxIxI2YDnvhCXUKQ==

GET
H2 200 40.31ef8dbf.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 12 KB
4 KB 24ms
21ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 03:25:55 GMT
x-amz-version-id: d4Mpj6_OHbbARq4FSdDizJv80LDhJS9j
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4747436
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 37
last-modified: Wed, 06 Dec 2023 19:18:01 GMT
server: istio-envoy
etag: W/"b0793fa46e8c0ae1846b7be8a833da35"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: _DdioTI-bFY1ZgHzBQ5eg8OiOPgl6gePUIjzTAU6A2MJZ6Hj-v5tSA==

GET
H2 200 29.31d09948.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 13 KB
6 KB 24ms
21ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/29.31d09948.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 02:39:00 GMT
x-amz-version-id: sy2gXVIBAtxn_z6EcojE2GGUK5H4qzOW
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 5614251
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 21 Nov 2023 16:21:41 GMT
server: istio-envoy
etag: W/"455157cb49065fb85fed54901ddaeb0e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: U1sM1TB9EnOX2sxn3S18BWmX1iYNbqBTLHxQ2EF71PFK8NSFwWQcsg==

GET
H2 200 21.b8c41db9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 17 KB
7 KB 25ms
22ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 23 Dec 2023 12:22:13 GMT
x-amz-version-id: 9XBjxFxayKbabIF2yelSQk8jdbs.8_S0
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3332858
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"65e5c965272e021ae33ff8bc39565ef5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: PCiubBzqeziEOSyQZ_OENuKVvVto6jCrWaEBRCU_68H2PU1ufN_TQA==

GET
H2 200 8.ab226b4a.chunk.css
js.driftt.com/core/assets/css/ Frame 6B88 31 KB
4 KB 9ms
6ms Stylesheet
text/css 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/8.ab226b4a.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ff8f406b684c6674dbd3705d3f6d2cd10b5eedbc2c67a7773f235d69ef122d04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 21:38:16 GMT
x-amz-version-id: Iy50rWLvnka9klYMF5qa_8hsgho0e_uB
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 361895
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Fri, 26 Jan 2024 18:11:46 GMT
server: istio-envoy
etag: W/"1e97f00f07b87f701d0bf06259f954e4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3LJolhwWwG3wVrtPLmAz4ZqhRG36Nxu4vlImdPiluehfsFKglraR_g==

GET
H2 200 8.ce202881.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 82 KB
26 KB 25ms
22ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.ce202881.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

3337f36bd89c27dbe1dca4b71fb177d826b736950f2150aff6acce0180a86fc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: mQIEwfFQyClv1G1Ejf6MWBI5BBswFf_l
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20955
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 93
last-modified: Tue, 30 Jan 2024 16:30:58 GMT
server: istio-envoy
etag: W/"182944c0e758d6ff6a202ce976d91cc6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: qnHQFXUNvdON5BQt1-5npgn1MGFGXcQn93oNJ0JL6bZj7WBO7qOj5w==

GET
H2 200 16.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 6B88 24 B
695 B 10ms
7ms Stylesheet
text/css 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/16.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 10:04:47 GMT
x-amz-version-id: oL98YdzlpaGyxUOIAT2tnEGpxnQwpHij
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P6
age: 3081904
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 13
content-length: 24
last-modified: Tue, 19 Dec 2023 18:34:35 GMT
server: istio-envoy
etag: "0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ceS_JQL4bwMtn6Pe3FbbaBrqY2aHWHAzKeQ1PIr5C5gS8VtKjass5Q==

GET
H2 200 16.0a87dc8c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 93 KB
24 KB 26ms
23ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.0a87dc8c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b480bbc5834651fb48a482fb5711ea65de49e97a9491ca7e89cecf0bfb26ccd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: RsA2hpXwDntL3q66hRYGEyJFeaiGX5Be
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20955
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 45
last-modified: Tue, 30 Jan 2024 16:30:56 GMT
server: istio-envoy
etag: W/"4d556324f40b4d890d1ae22bdef7d679"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: _gvJ2TtLiWPmHmR5Okol5kiT5O6uYvmNoY8Q9FQGE3qBdWgp5ZHyJA==

GET
H2 200 24.6ae977d6.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 51 KB
14 KB 27ms
24ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.6ae977d6.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

897f811bb47f9745182b2780e58cad6fab6ca5dc0d8d17f4e12dfb4a394ccdd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: pwk0W6LeM0W74if5zX8v7mEqwhbFugIC
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20955
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Tue, 30 Jan 2024 16:30:56 GMT
server: istio-envoy
etag: W/"4e9807f6460a733b8095cd47679bf940"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: FFhKNVt1Bv1PT60s9IbHEWyubc1EW6oqPbzrvxZ6hBJT6va7Y6-G2w==

GET
H2 200 17.ecf0772e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 40 KB
13 KB 27ms
25ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.ecf0772e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

fd53afd3d83890806b14513ee8438283da141aad79a9d75391e3b9e0b6cdf829

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: EEglradmSKyrRiOpLg5EEPiAXqvHjqUY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20955
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 23
last-modified: Tue, 30 Jan 2024 16:30:56 GMT
server: istio-envoy
etag: W/"45cc623a137048a1f98e0fb0133b22ed"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: OHT8tolh8gljc2jGYnPHRlyDd1USl-9AvmaA9LtBPfHK4j1fk1ZwIA==

GET
H2 200 51.558be3c5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 23 KB
8 KB 24ms
10ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 04 Jan 2024 01:42:32 GMT
x-amz-version-id: jAn.UV4FUigTQ2pXuPEfcgJGaVkaFeLh
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 2334439
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Wed, 03 Jan 2024 21:36:01 GMT
server: istio-envoy
etag: W/"fa281fcbe4b2e35558d60fae3e316367"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Ka1wNzezysk5pvZo9nbvldpMCpPfWgWPt6_-2BxwyDZ-Yyckz5vKJg==

GET
H2 200 35.d0f1ccda.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 36 KB
10 KB 24ms
11ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.d0f1ccda.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: sgEYGmeR8Py6tciS9o0uWaEb0DViiRFb
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 34
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"46fa5a7bc37a22544a908e4ad950309c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 74RDq8NoSPt2qIAr1cQYnNFT_8pnPB_glV1mxUrsaxLgHXg7_iXeug==

GET
H2 200 22.6b9a301a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 32 KB
11 KB 25ms
11ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.6b9a301a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: DvJ7CLlBPxNj4KV_C1b2ZR1X9H2QpJXV
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"d8739a9fe9a3a42936f5cd86c8727494"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: otlsTlnSLca1VYypQ_uDSrGw-qn6OSRMbBXect2NW4hXXgZGJeCaIA==

GET
H2 200 19.6f85b843.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 17 KB
6 KB 25ms
12ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.6f85b843.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: TS.9ApOzy..rylGKiVPdLcCX5dJ9HsBw
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"e28ebc3391b56e8f01ea063dc089e9d3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: lxyshFdiReR0H0cHi-ncxsb9eLox1cm4Utm_PCjqBebIBtq6qAmdOQ==

GET
H2 200 41.b4fc4de2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 25 KB
8 KB 26ms
13ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 12:03:53 GMT
x-amz-version-id: BGQZXXMqkBTxMl_P3y2PvIfHU9WeYGWx
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 5580358
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 21
last-modified: Tue, 21 Nov 2023 16:21:42 GMT
server: istio-envoy
etag: W/"a2ace4f65aa7b34dedb884f6cfe9df8d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: E0BdvCyd7fhkvdXaksA2VuASzeEuVJ6ED1PRkGB5P_cJX2n8ISjP4g==

GET
H2 200 20.8c21ea18.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 74 KB
23 KB 26ms
13ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: 4VyxTF9cOmpvyHPO7jaWSto1hTdtU.sl
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 45
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"6d77a76055d81227033363af2f18caf8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6tqHG64Vs5z_Zk98hQT3_x-kIeJfMMu5U-ed2fbn-hMJi5v0bEq-pA==

GET
H2 200 26.04e7f30b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 66 KB
20 KB 26ms
14ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.04e7f30b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: cqsMaYjOHahH71A7EXhyHFywLOEay3sx
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 32
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"49ce5445ddcf5d24ef3badc4eb1a11dd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: UKMpoDp5w-7LUOgt-qZVdF5ffKh8WOcyNMgakYuRuZdaBSvMYr3KpQ==

GET
H2 200 14.e24a6190.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 91 KB
28 KB 28ms
16ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.e24a6190.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: iLluOjfpMSRsML8bOSqA9V8JfTEqMP9L
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"16d7ae86e21434a32157d3226ac9bb77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: GsMvHFtodU7Swwkx7-ZN-UhGtkA6B2Khdh9FTZsBN2lUS8Lop1spGA==

GET
H2 200 11.639238ba.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 23 KB
7 KB 31ms
18ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.639238ba.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: cZI1cI6WRHhkzkWa3N1Jh4ekBwSSYCCx
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"4049f38c00add1738dc4806148ff8829"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0uyGuOYcKlQQL1k2Z2PBOA_3awLC1hRDvvGmr4Hak5VSdTh36xKXVQ==

GET
H2 200 18.9c1bd1fb.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 62 KB
20 KB 31ms
19ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: q8W9FNPLIM8OX5drRDX0sp4TnKuKPMbY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 21
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"02f09379c544befa413d22eb57ed41de"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: eSmYWh1LjdjcC5DdUC5AciH8IrezwcOHt5U2ljwtz0TlKcg_m1ZU0g==

GET
H2 200 49.f7274268.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 105 KB
34 KB 32ms
20ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/49.f7274268.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:48 GMT
x-amz-version-id: sZGsqYJSO5RNt4iGri.m215HFs7tyyoY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071463
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"e268d36b98f0119a2bb1a15f69fd4ffe"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6umA9tsk6B3mcapA4kGEJPDeOChfnvRSn-TWojA87fcoZqBtMxBv2g==

GET
H2 200 40.31ef8dbf.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 12 KB
4 KB 33ms
21ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 07 Dec 2023 03:25:55 GMT
x-amz-version-id: d4Mpj6_OHbbARq4FSdDizJv80LDhJS9j
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 4747436
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 37
last-modified: Wed, 06 Dec 2023 19:18:01 GMT
server: istio-envoy
etag: W/"b0793fa46e8c0ae1846b7be8a833da35"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ASWbSZNfcY1T4xoL0uWJrhkVSgB0WaIIA4qzuJFWPs2Z1OQkykpU9w==

GET
H2 200 29.31d09948.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 13 KB
6 KB 33ms
21ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/29.31d09948.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 02:39:00 GMT
x-amz-version-id: sy2gXVIBAtxn_z6EcojE2GGUK5H4qzOW
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 5614251
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 21 Nov 2023 16:21:41 GMT
server: istio-envoy
etag: W/"455157cb49065fb85fed54901ddaeb0e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: jE4FeAtLC-9pZV9Jko6Z6ubganTLqQAq5qS5Nf5lGawBMz6FiW808g==

GET
H2 200 21.b8c41db9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 17 KB
7 KB 33ms
22ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sat, 23 Dec 2023 12:22:13 GMT
x-amz-version-id: 9XBjxFxayKbabIF2yelSQk8jdbs.8_S0
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3332858
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Tue, 19 Dec 2023 18:34:37 GMT
server: istio-envoy
etag: W/"65e5c965272e021ae33ff8bc39565ef5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: caYVwRnBnBhn5VLrH22iB8VjshyqwVYYTfvb_EK7FbMAILlP3Fo4Pw==

GET
H2 200 8.ab226b4a.chunk.css
js.driftt.com/core/assets/css/ Frame EEE9 31 KB
4 KB 20ms
9ms Stylesheet
text/css 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/8.ab226b4a.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ff8f406b684c6674dbd3705d3f6d2cd10b5eedbc2c67a7773f235d69ef122d04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Fri, 26 Jan 2024 21:38:16 GMT
x-amz-version-id: Iy50rWLvnka9klYMF5qa_8hsgho0e_uB
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 361895
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Fri, 26 Jan 2024 18:11:46 GMT
server: istio-envoy
etag: W/"1e97f00f07b87f701d0bf06259f954e4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3Nxr6igP1OzLWIeY6QrofXH4hJtT890N3eUnyBgQxnC4M_BcQQExww==

GET
H2 200 8.ce202881.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 82 KB
26 KB 33ms
22ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.ce202881.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

3337f36bd89c27dbe1dca4b71fb177d826b736950f2150aff6acce0180a86fc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: mQIEwfFQyClv1G1Ejf6MWBI5BBswFf_l
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20955
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 93
last-modified: Tue, 30 Jan 2024 16:30:58 GMT
server: istio-envoy
etag: W/"182944c0e758d6ff6a202ce976d91cc6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: sy6kiL23YdGamiO4JQwHfw6YE2QeQOaeJVLF3HOTklYHOhLoSe6nzQ==

GET
H2 200 16.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame EEE9 24 B
695 B 20ms
9ms Stylesheet
text/css 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/16.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 10:04:47 GMT
x-amz-version-id: oL98YdzlpaGyxUOIAT2tnEGpxnQwpHij
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P6
age: 3081904
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 13
content-length: 24
last-modified: Tue, 19 Dec 2023 18:34:35 GMT
server: istio-envoy
etag: "0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: o0nKe9K9NwS0NBBh-QMt9ws-mdrF5B_Jlnhye3I701DCsv82KUhcEg==

GET
H2 200 16.0a87dc8c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 93 KB
24 KB 34ms
23ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.0a87dc8c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b480bbc5834651fb48a482fb5711ea65de49e97a9491ca7e89cecf0bfb26ccd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: RsA2hpXwDntL3q66hRYGEyJFeaiGX5Be
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20955
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 45
last-modified: Tue, 30 Jan 2024 16:30:56 GMT
server: istio-envoy
etag: W/"4d556324f40b4d890d1ae22bdef7d679"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: xmWjlHddvPup_hPAd3GPIFLNiHKXosqsvGw9M_urHgUxQCU7C3Ij_A==

GET
H2 200 24.6ae977d6.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 51 KB
14 KB 35ms
24ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.6ae977d6.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

897f811bb47f9745182b2780e58cad6fab6ca5dc0d8d17f4e12dfb4a394ccdd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: pwk0W6LeM0W74if5zX8v7mEqwhbFugIC
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20955
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Tue, 30 Jan 2024 16:30:56 GMT
server: istio-envoy
etag: W/"4e9807f6460a733b8095cd47679bf940"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: xr6Hp1XedzIxFTCKqJ8nqZcgA7DnANUcq_tA_D7iwQZmWbsh7XdAXQ==

GET
H2 200 17.ecf0772e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 40 KB
13 KB 35ms
24ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.ecf0772e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

fd53afd3d83890806b14513ee8438283da141aad79a9d75391e3b9e0b6cdf829

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: EEglradmSKyrRiOpLg5EEPiAXqvHjqUY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20955
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 23
last-modified: Tue, 30 Jan 2024 16:30:56 GMT
server: istio-envoy
etag: W/"45cc623a137048a1f98e0fb0133b22ed"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: _rl5HUcp0u4-FVMigdOfLYeecvqKXMt-ysYS-UeaZqwvGzTtYp0TIw==

GET
H/1.1

200
OK

iframe Show response
d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/ Frame 50F4
Redirect Chain

https://insight.adsrvr.org/tags/0v1kpom/u9beit9/iframe
https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe

138 B
667 B

36ms
9ms

Document
text/html

13.225.83.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/14963/code/08773fb052a2034353e4744495485b88.js?conditionId0=4910939
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.83.200 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-83-200.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 93e2856e540b7faf4767d1291492324c43994be69562b8d1d9be07de8e2e40e4

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Age: 73801
Cache-Control: max-age=86400
Connection: keep-alive
Content-Length: 138
Content-Type: text/html
Date: Tue, 30 Jan 2024 05:39:51 GMT
ETag: "d45046dc61fcd53aaf217c2c9496ec77"
Last-Modified: Fri, 01 Oct 2021 23:43:18 GMT
Server: AmazonS3
Via: 1.1 e1e056e45a0f8d6bc22b223900511170.cloudfront.net (CloudFront)
X-Amz-Cf-Id: FGUgMnZ1olDa0O_j4lngUsNa010tHE2cHkxVUf0BA5hPfJmP9MKFOg==
X-Amz-Cf-Pop: FRA2-C2
X-Cache: Hit from cloudfront
x-amz-server-side-encryption: AES256

Redirect headers

content-length: 0
date: Wed, 31 Jan 2024 02:09:51 GMT
location: https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe

GET
H2 200 0.0b2ebd4a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 9 KB
3 KB 12ms
7ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:50 GMT
x-amz-version-id: wIYiMMOv59k7p4Fbql5xBCm9H7moGtf2
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071461
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
last-modified: Tue, 19 Dec 2023 18:34:36 GMT
server: istio-envoy
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: tJf2cQqe_W3rSCNOulx7Wg0kjuO9Fh4HTReBcfcTZ57jK88vCfCn1A==

GET
H2 200 27.01c2bea5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 35 KB
10 KB 12ms
8ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/27.01c2bea5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b13c9311dec3f49821d88065299e95cc1c4e6c26acc4b27b4ebdb380d40d8788

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:50 GMT
x-amz-version-id: wJpX75ashzf9GsU5gRx23gJZWdtNdgWz
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071460
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 33
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"04a233a42dcf8c50a83bfecea8ba552d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ta3NJffSZ3FwDerWrJaEPjhqNQo1M6BOEfRQ-ghZpnbJ1I7urgpD7Q==

GET
H2 200 28.b5e8f5e1.chunk.css
js.driftt.com/core/assets/css/ Frame 6B88 8 KB
2 KB 10ms
6ms Stylesheet
text/css 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/28.b5e8f5e1.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7849ba1748f8188749df28e9d59ca4e570a8495684353d8df4715fa70a81e787

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:50 GMT
x-amz-version-id: .fUlXnml9vNpf6zIEbVH9.TYckUJHxxL
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071461
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 27
last-modified: Tue, 19 Dec 2023 16:15:21 GMT
server: istio-envoy
etag: W/"e7107bc29ccb3c6d928f0f8f10a0f22d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: F-0VKGPJKCV74LiY0NKwBEbLTgNZGlBedOYobzb7gjC4oQhoVIOPQw==

GET
H2 200 28.07e1b068.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 15 KB
6 KB 12ms
8ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/28.07e1b068.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7d78bcb45e61155283355f98b205d9dc7b416aef6cfd5ae58c76d7633941a52b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: n2Ilv3EJ7xNfD3rdnMTYy30EaO4FuNsw
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20955
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Tue, 30 Jan 2024 16:30:57 GMT
server: istio-envoy
etag: W/"c5f153de3aa4a7014a810aa46b771779"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8P1nVG_mq3BM3aGKvfXFvG9nkpr4CT7SbknA6sPVuLwYp-xZ5jsuvw==

GET
H2 200 25.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame 6B88 365 B
1 KB 10ms
7ms Stylesheet
text/css 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/25.c695453b.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 12:03:54 GMT
x-amz-version-id: 0H7FjD7Jl9xIJbAVeMxI..hCPUWnSz0t
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P6
age: 5580357
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
content-length: 365
last-modified: Tue, 21 Nov 2023 16:21:39 GMT
server: istio-envoy
etag: "06b2963b029c0824382815165bfea73e"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8QJWVWwTEfT5nWroBOODfLNxsm4etWBAa_Kitn-9YbM28FucYF2lzw==

GET
H2 200 25.1d3d9824.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 92 KB
25 KB 12ms
9ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/25.1d3d9824.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b6da2852778840c0456b598c5e78236c7e0e6f6e23129685865f5a0a5bd1d538

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: i_79AEKVXINSKZZ_F9q2iBkjxhhET31w
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20954
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 16
last-modified: Tue, 30 Jan 2024 16:30:57 GMT
server: istio-envoy
etag: W/"8f12545f0516bd02f772ca8e6d75b905"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: g4ZX_5KTMJ3i_Ys3mh8tmWQ9XwMUY3LItlwrjOdtQz9_Ab9aZKwV5w==

GET
H2 200 37.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame EEE9 3 KB
1 KB 7ms
7ms Stylesheet
text/css 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/37.11d2b6a7.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:50 GMT
x-amz-version-id: vMSWok01aLf.5yTCv4E3xAymy7kKeWUY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071461
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 43
last-modified: Tue, 19 Dec 2023 16:15:22 GMT
server: istio-envoy
etag: W/"87532c4db85f1429fa6d759bc3332f36"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 1eJC5tPob4UtS5iZIcE7ERBZqRVA6-6o6yr2r_LjCsZDpH8TLoQ8QA==

GET
H2 200 37.fba521ea.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 3 KB
2 KB 8ms
7ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/37.fba521ea.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b1700a9f05644621ffe3a13f59d5258261f170718eb8a6076e5fc55cd918afc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 17:24:59 GMT
x-amz-version-id: yjKQYZO7C1D0av2terpN.3WV3CPoW8Ab
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3660292
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"deb91ed165197613da3fac3d4f67edf9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: BMYMgTe97Ql9hqmvryI3hqjTiK6ZA3qoAJhO36q9eveXUIZdzURFew==

GET
H2 200 0.0b2ebd4a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 9 KB
3 KB 12ms
8ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:50 GMT
x-amz-version-id: wIYiMMOv59k7p4Fbql5xBCm9H7moGtf2
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071461
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
last-modified: Tue, 19 Dec 2023 18:34:36 GMT
server: istio-envoy
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: tQtPiqaFy4uW8m8F-23G9LiaKEkciTzVqfR2Czh-g9Oy4tgKQD56cw==

GET
H2 200 3.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame EEE9 7 KB
2 KB 11ms
6ms Stylesheet
text/css 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/3.07aa08a5.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 12:03:54 GMT
x-amz-version-id: Z3aGNvKDu1qrwflzzKzoomVmgF30.VOg
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 5580357
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Tue, 21 Nov 2023 16:21:39 GMT
server: istio-envoy
etag: W/"189aeffd571884559dababa22c66d75a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: MuLyom6Ou-uRVih0gvqwllfMTLbvIwI_Cf-Igj3yDJvyITAeleFNyg==

GET
H2 200 3.f50b964b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 54 KB
15 KB 13ms
8ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/3.f50b964b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:51 GMT
x-amz-version-id: gL82ppKirwR7fxxrhBV_OSoLEOxW5mhG
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071460
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Tue, 19 Dec 2023 18:34:38 GMT
server: istio-envoy
etag: W/"1ac37bf2b93050f29058b66a9ad43e10"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8100qtargnomGCrjUR4D4MWPS0QSGbJ11iqWHdyqVv5eO_qkbujWFQ==

GET
H2 200 1.12ba17b6.chunk.css
js.driftt.com/core/assets/css/ Frame EEE9 44 KB
7 KB 11ms
7ms Stylesheet
text/css 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/1.12ba17b6.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

58fdb03fac3e89e51525a5a45eb777395d1b499bf4483e96201b6becddbe516f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:51 GMT
x-amz-version-id: 1xzUgPbFb7aaeyDZtp6vQOQncX9.jojY
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071460
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 19 Dec 2023 16:15:21 GMT
server: istio-envoy
etag: W/"3b8ba82e1bac13ee29e9764a55620d99"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: tQAP5uMIrpxpVuh4xCAMbbINbxuBUi2JJbE5um0QqyGhdU1rW3nPng==

GET
H2 200 1.df455e72.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 54 KB
18 KB 13ms
9ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/1.df455e72.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e17ed6f660604edd30f3fb7d0d9f8ff81897a294451d7c5ad93b730ffcb6e5b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: ZCfp.eb0kjFOEX3IwDx2bmFD4SZaoyG4
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20955
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 30 Jan 2024 16:30:55 GMT
server: istio-envoy
etag: W/"905d835fcc30c0124bb904590c72e394"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: W4YrDmgpIWXu5rHlY78I6x5nrZ6c83fxlFJ-aouHXooipEz3xNrG7Q==

GET
H2 200 4.c6304c2e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 23 KB
10 KB 13ms
10ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/4.c6304c2e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

a55619fd27a0e1c6c940e668707a13ea02bc52953106260a570c28e5a300c070

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 19 Dec 2023 17:24:59 GMT
x-amz-version-id: bmPbjvWFoSkY1.hjaxiT.CojmYdamaBg
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3660292
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"672c1436035fd059b992723cdedd3472"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: niAHeMeRCXZjc5bc1Q8DJvDbNd36W1PXKhrMQJCzancW0EHw4DpA7A==

GET
H2 200 34.5fdd3e3b.chunk.css
js.driftt.com/core/assets/css/ Frame EEE9 16 KB
3 KB 11ms
7ms Stylesheet
text/css 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/34.5fdd3e3b.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

a03b854d10519fd5be9cdcbc78fad3927c1a3de9e84fa74353c8a19cc20d0501

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: IrMkVQs7lH.AehsQAbAKz1mDjOweAHHO
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20955
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 18
last-modified: Tue, 30 Jan 2024 16:30:54 GMT
server: istio-envoy
etag: W/"6f779260053e30787f84dfa7ba6743e5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zONxWyvqbWuJwcbnQ5yiHVjUdb4lhdgS7-kuN1zAng3w_a2bROaxRw==

GET
H2 200 34.a74cf682.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 13 KB
5 KB 14ms
10ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.a74cf682.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

a0ecd664d717fc9ad0a511a6379f291db344fd80bfe9058989c0f4d658d65e1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 30 Jan 2024 20:20:36 GMT
x-amz-version-id: 3riUQLKgKFzP8T6iTzopZY0msGOhRJyj
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 20954
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 33
last-modified: Tue, 30 Jan 2024 16:30:57 GMT
server: istio-envoy
etag: W/"a5ca20176509792eb61e2e83db9487a0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: gQJlwbUbEVzjnqiy7WyS3yrdVv6dLQ6E-V6qC8HUpq72dGMXKM7K5g==

POST
H2 200 v2 Show response
bootstrap.api.drift.com/widget_bootstrap/ping/ Frame 6B88 223 B
663 B 306ms
95ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap/ping/v2

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

ec8277351257eaab58a4e87c83920aba6c35d1fc232340055b6c9df730a97dc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: 41228b1116455b63
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 223

GET
H2 200 /
insight.adsrvr.org/track/pxl/ Frame 50F4 70 B
148 B 37ms
36ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://insight.adsrvr.org/track/pxl/?adv=0v1kpom&ct=0:u9beit9&fmt=3
Requested by: Host: d1eoo1tco6rr5e.cloudfront.net
URL: https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d1eoo1tco6rr5e.cloudfront.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
server: Kestrel
content-length: 70
content-type: image/gif

POST
H2 200 mput Show response
pipedream.wistia.com/ 2 B
329 B 279ms
278ms Fetch
text/plain 2600:9000:236e:5600:3:471f:5240:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pipedream.wistia.com/mput?topic=metrics
Requested by: Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:236e:5600:3:471f:5240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: envoy /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f4.cloudfront.net (CloudFront)
server: envoy
x-amz-cf-pop: FRA60-P1
x-cache: Miss from cloudfront
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: *
content-type: text/plain; charset=utf-8
x-envoy-upstream-service-time: 1
content-length: 2
x-amz-cf-id: 7Ct-2tqliWyjgUUugsXvrUVXGGEnr-p8AzQ7LP73Ujw43bDoTXhWZw==

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 196ms
194ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=059bf2ba2b88e39bb3200769d2e411fc&svisitor=null&visitor=a21fcf4f-cfdd-4ff0-8f30-88019c868e74&session=d5f38bae-5fa3-458a-8685-b391206d0783&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2031%20Jan%202024%2002%3A09%3A51%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2031%20Jan%202024%2002%3A09%3A50%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Abstract%20The%20Play%20ransomware%20group%20is%20one%20of%20the%20most%20successful%20ransomware%20syndicates%20today.%20All%20it%20takes%20is%20a%20quick%20peek%20with%20a%20disassembler%20to%20know%20why%20this%20group%20has%20become%20infamous.%20This%20is...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game%22%2C%22prod-cat%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&pageViewId=8b990d15-a0c9-42a5-849c-14f5a58fdb46&an_uid=0&webTagId=d24194f2-6101-4c07-b071-d2eb5d40f5e6&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 8ms
8ms Image
image/gif 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=697407376&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&ul=en-us&de=UTF-8&dt=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=RTP&ea=Organization&el=Perfect%20Privacy%20Payments%20Ltd&_u=aHBAgEABAAAAAGAEK~&jid=&gjid=&cid=649116550.1706666989&tid=UA-44168172-9&_gid=1195797681.1706666989&gtm=45He41t0n715SFWTHv72025662&cd6=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&cd7=&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cd1=Perfect%20Privacy%20Payments%20Ltd&z=1849294697

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 Jan 2024 18:56:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 25973
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 8ms
7ms Image
image/gif 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=697407376&t=event&ni=1&_s=3&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&ul=en-us&de=UTF-8&dt=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=RTP-Segments&ea=Gartner%20MQ%202020&el=Perfect%20Privacy%20Payments%20Ltd&_u=aHBAgEABAAAAAGAEK~&jid=&gjid=&cid=649116550.1706666989&tid=UA-44168172-9&_gid=1195797681.1706666989&gtm=45He41t0n715SFWTHv72025662&cd6=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&cd7=&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cd1=Perfect%20Privacy%20Payments%20Ltd&z=91035275

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 Jan 2024 18:56:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 25973
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 9ms
8ms Image
image/gif 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=697407376&t=event&ni=1&_s=4&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&ul=en-us&de=UTF-8&dt=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=RTP-Segments&ea=All%20visitors&el=Perfect%20Privacy%20Payments%20Ltd&_u=aHBAgEABAAAAAGAEK~&jid=&gjid=&cid=649116550.1706666989&tid=UA-44168172-9&_gid=1195797681.1706666989&gtm=45He41t0n715SFWTHv72025662&cd6=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&cd7=&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cd1=Perfect%20Privacy%20Payments%20Ltd&z=971591512

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 Jan 2024 18:56:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 25973
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 10ms
9ms Image
image/gif 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=697407376&t=event&ni=1&_s=5&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&ul=en-us&de=UTF-8&dt=Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=RTP-Segments&ea=Opt-In%20Campaign%20Audience&el=Perfect%20Privacy%20Payments%20Ltd&_u=aHBAgEABAAAAAGAEK~&jid=&gjid=&cid=649116550.1706666989&tid=UA-44168172-9&_gid=1195797681.1706666989&gtm=45He41t0n715SFWTHv72025662&cd6=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&cd7=&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cd1=Perfect%20Privacy%20Payments%20Ltd&z=663046423

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 Jan 2024 18:56:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 25973
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 allIntegrations.js Show response
fast.wistia.com/assets/external/ 23 KB
6 KB 7ms
6ms Script
text/javascript 2a04:4e42:400::644
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fast.wistia.com/assets/external/allIntegrations.js

Requested by

Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/E-v1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::644 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

272c0bc199c58b5cf983ea4cd3acd11106c32762bf548f1b2c7e6648808f7f9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer
Origin: https://www.cyberark.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
content-encoding: br
via: 1.1 varnish, 1.1 varnish
strict-transport-security: max-age=0
age: 237
x-amz-server-side-encryption: AES256
x-cache: HIT, HIT
content-length: 5770
x-served-by: cache-iad-kcgs7200101-IAD, cache-fra-eddf8230043-FRA
x-browser-version: 120
last-modified: Tue, 30 Jan 2024 21:04:45 GMT
server: AmazonS3
x-timer: S1706666992.572089,VS0,VE0
etag: "0a93da4a1c1b71ea6b0666d2e6ac329b"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=3600
x-browser: chrome
asset-version: 0c1863c09d8b681818d2eec147310f2ec40ee2ef
x-ecma-v: modern
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 73, 3

POST
H2 200 v3 Show response
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 6B88 25 B
88 B 114ms
109ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v3

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: 26c8128003c5a43c
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 14
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25

POST
H2 200 widget_bootstrap Show response
bootstrap.api.drift.com/ Frame 6B88 25 KB
9 KB 981ms
978ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

bbe27e257ac5411e6d7da3b15b6a2f799f12c586d590a2496f48cdb20069b8ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
server: istio-envoy
requestid: 176daaa0761af37
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 887
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
195 B 182ms
181ms XHR
text/plain 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: *
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 31 Jan 2024 02:09:51 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 77535880F85C4C57BE9D466C3CB0BAB2 Ref B: FRAEDGE1215 Ref C: 2024-01-31T02:09:51Z
linkedin-action: 1
vary: Origin
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
access-control-allow-origin: https://www.cyberark.com
x-li-proto: http/2
access-control-allow-credentials: true
x-li-uuid: AAYQNF/NiKLPtuAL1PhEig==

POST
H2 200 mon Show response
obs.segreencolumn.com/ 0
39 B 142ms
141ms XHR
application/json 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.segreencolumn.com/mon
Requested by: Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://www.cyberark.com
date: Wed, 31 Jan 2024 02:09:52 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 197ms
197ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=059bf2ba2b88e39bb3200769d2e411fc&svisitor=null&visitor=a21fcf4f-cfdd-4ff0-8f30-88019c868e74&session=d5f38bae-5fa3-458a-8685-b391206d0783&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2031%20Jan%202024%2002%3A09%3A52%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2031%20Jan%202024%2002%3A09%3A51%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%223006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Abstract%20The%20Play%20ransomware%20group%20is%20one%20of%20the%20most%20successful%20ransomware%20syndicates%20today.%20All%20it%20takes%20is%20a%20quick%20peek%20with%20a%20disassembler%20to%20know%20why%20this%20group%20has%20become%20infamous.%20This%20is...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game%22%2C%22prod-cat%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&pageViewId=8b990d15-a0c9-42a5-849c-14f5a58fdb46&an_uid=0&webTagId=d24194f2-6101-4c07-b071-d2eb5d40f5e6&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:52 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 mon Show response
obs.segreencolumn.com/ 0
16 B 141ms
141ms XHR
application/json 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.segreencolumn.com/mon
Requested by: Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://www.cyberark.com
date: Wed, 31 Jan 2024 02:09:52 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

POST
H2 200 track Show response
event.api.drift.com/ Frame 6B88 625 B
685 B 93ms
92ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

dbae32a3db84b864f7c1d83ced2687304ccb6d66da8fd109ccdffe5be20e549f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIyMDg1Nzg1NTY1MiIsImNsaWVudElkIjoiZjZ6dWl6ZHloeHJtN3IiLCJ1c2VySWRUeXBlIjoiTEVBRCIsInNjb3BlIjoibGVhZCIsImlzcyI6IjE0NDEwMzMiLCJleHAiOjE3MzgyODkzOTIsImlhdCI6MTcwNjY2Njk5Mn0.PlcDdzQ-C7OmXiBWMbmzgm2gSYlnycVexwZ3Vf4PnuMHq7zta1CIqaQdk1B8_RjesJ-SiC356s4Y2N9jmVNL8Q
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 31 Jan 2024 02:09:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: a319d9ad9738a82e
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 625

OPTIONS
H2 200 track
event.api.drift.com/ Frame 0
0 94ms
93ms Preflight
text/plain 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://js.driftt.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-max-age: 1209600
allow: POST,OPTIONS
content-length: 13
content-type: text/plain
date: Wed, 31 Jan 2024 02:09:53 GMT
requestid: driftcb97fe3483e9bd06da850da54a1
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 0

POST
H2 200 evaluate_with_log Show response
targeting.api.drift.com/targeting/ Frame 6B88 2 KB
565 B 93ms
93ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/targeting/evaluate_with_log

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

3cd396ea4ae38a7b1abcf13936a75c655218f074d40155813698d30386fa3168

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIyMDg1Nzg1NTY1MiIsImNsaWVudElkIjoiZjZ6dWl6ZHloeHJtN3IiLCJ1c2VySWRUeXBlIjoiTEVBRCIsInNjb3BlIjoibGVhZCIsImlzcyI6IjE0NDEwMzMiLCJleHAiOjE3MzgyODkzOTIsImlhdCI6MTcwNjY2Njk5Mn0.PlcDdzQ-C7OmXiBWMbmzgm2gSYlnycVexwZ3Vf4PnuMHq7zta1CIqaQdk1B8_RjesJ-SiC356s4Y2N9jmVNL8Q
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 31 Jan 2024 02:09:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
server: istio-envoy
requestid: 2ad99e48c6d037cf
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 504

OPTIONS
H2 200 evaluate_with_log
targeting.api.drift.com/targeting/ Frame 0
0 94ms
93ms Preflight
text/plain 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/targeting/evaluate_with_log

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://js.driftt.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-max-age: 1209600
allow: POST,OPTIONS
content-length: 13
content-type: text/plain
date: Wed, 31 Jan 2024 02:09:53 GMT
requestid: drift77fb11f4d2c97909a6980919a86
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1

OPTIONS
H2 200 widget
targeting.api.drift.com/impressions/ Frame 0
0 95ms
94ms Preflight
text/plain 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/impressions/widget

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://js.driftt.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-max-age: 1209600
allow: POST,OPTIONS
content-length: 13
content-type: text/plain
date: Wed, 31 Jan 2024 02:09:53 GMT
requestid: drift9155b594452a3af5312d0270663
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
x-envoy-upstream-service-time: 1

POST
H2 204 widget Show response
targeting.api.drift.com/impressions/ Frame 6B88 0
37 B 103ms
103ms XHR
text/plain 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/impressions/widget

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIyMDg1Nzg1NTY1MiIsImNsaWVudElkIjoiZjZ6dWl6ZHloeHJtN3IiLCJ1c2VySWRUeXBlIjoiTEVBRCIsInNjb3BlIjoibGVhZCIsImlzcyI6IjE0NDEwMzMiLCJleHAiOjE3MzgyODkzOTIsImlhdCI6MTcwNjY2Njk5Mn0.PlcDdzQ-C7OmXiBWMbmzgm2gSYlnycVexwZ3Vf4PnuMHq7zta1CIqaQdk1B8_RjesJ-SiC356s4Y2N9jmVNL8Q
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 31 Jan 2024 02:09:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: 23aaa4891c8106d8
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-credentials: true
x-envoy-upstream-service-time: 10
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version

GET
H2 200 57.28dde8ce.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 6B88 19 KB
7 KB 7ms
6ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/57.28dde8ce.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

594d3ade307f6f48a5ef5143228b9da7c4e78589177ac70e91d31fe75ea83d60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=f7c9e38f-795e-4cf7-a57f-16f9dcdb5a8b&sessionStarted=1706666990.962&campaignRefreshToken=95ba786e-cf70-4732-ba15-9d3643b78bda&hideController=false&pageLoadStartTime=1706666987953&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:57 GMT
x-amz-version-id: XHP6tuTt0XPbaCUlteXXcdE79sSnoC_g
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071456
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"3c4cd13822c0069a68e9f9c8240f5ba9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 48uSu-YCEG9DmELg9lkouL274H_eVUfTvy6P6h4GuwyAjRZf9AevsQ==

GET
H2 200 57.28dde8ce.chunk.js Show response
js.driftt.com/core/assets/js/ Frame EEE9 19 KB
7 KB 7ms
6ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/57.28dde8ce.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.be089384.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

594d3ade307f6f48a5ef5143228b9da7c4e78589177ac70e91d31fe75ea83d60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1706666987953
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:58:57 GMT
x-amz-version-id: XHP6tuTt0XPbaCUlteXXcdE79sSnoC_g
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P6
age: 3071456
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
last-modified: Tue, 19 Dec 2023 16:15:24 GMT
server: istio-envoy
etag: W/"3c4cd13822c0069a68e9f9c8240f5ba9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: QVeST87L9fTmB-wxO0gVXr2e2tdqv1ucbW76hPCt8SyQ8130fRrNUA==

GET
H2 200 https%3A%2F%2Fdriftt.imgix.net%2Fhttps%253A%252F%252Fs3.amazonaws.com%252Fcustomer-api-avatars-prod%252F2080453%252F690aee1490e624290ef724079be9437f96dgrydefrdk%3Ffit%3Dmax%26fm%3Dpng%26h%3D200%26w...
driftt.imgix.net/ Frame 6B88 3 KB
3 KB 35ms
9ms Image
image/png 2a04:4e42:8d::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://driftt.imgix.net/https%3A%2F%2Fdriftt.imgix.net%2Fhttps%253A%252F%252Fs3.amazonaws.com%252Fcustomer-api-avatars-prod%252F2080453%252F690aee1490e624290ef724079be9437f96dgrydefrdk%3Ffit%3Dmax%26fm%3Dpng%26h%3D200%26w%3D200%26s%3D8cbb812869cae3ac0e8d1e341ba68a27?fit=max&fm=png&h=200&w=200&s=3749d7ac8855db31e7dff64475c4bb37

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:8d::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

196697739a7e27c152b6bfb1f999ea07ff14eb538a607348e549477d946d155b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:53 GMT
x-content-type-options: nosniff
age: 1876707
x-cache: HIT, HIT
x-imgix-id: f5accd4fc0c45e1ec22496893bba1c5caf50a840
cross-origin-resource-policy: cross-origin
content-length: 2619
x-served-by: cache-sjc10047-SJC, cache-fra-eddf8230076-FRA
x-imgix-render-farm: 01.140328
last-modified: Tue, 09 Jan 2024 08:51:25 GMT
server: imgix
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=315360000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 186ms
186ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=059bf2ba2b88e39bb3200769d2e411fc&svisitor=null&visitor=a21fcf4f-cfdd-4ff0-8f30-88019c868e74&session=d5f38bae-5fa3-458a-8685-b391206d0783&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2031%20Jan%202024%2002%3A09%3A53%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2031%20Jan%202024%2002%3A09%3A52%20GMT%22%2C%22timeSpent%22%3A%221014%22%2C%22totalTimeSpent%22%3A%224020%22%7D&isIframe=false&m=%7B%22description%22%3A%22Abstract%20The%20Play%20ransomware%20group%20is%20one%20of%20the%20most%20successful%20ransomware%20syndicates%20today.%20All%20it%20takes%20is%20a%20quick%20peek%20with%20a%20disassembler%20to%20know%20why%20this%20group%20has%20become%20infamous.%20This%20is...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game%22%2C%22prod-cat%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&pageViewId=8b990d15-a0c9-42a5-849c-14f5a58fdb46&an_uid=0&webTagId=d24194f2-6101-4c07-b071-d2eb5d40f5e6&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:53 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Tue, 05 Oct 2021 22:17:52 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "615ccf10-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 3.ee35dea2.chunk.js Show response
js.driftt.com/conductor/assets/ 158 B
853 B 8ms
7ms Script
application/javascript 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/conductor/assets/3.ee35dea2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1706667000000/ey22i6m9p82y.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

3005a54fc57fc2d8c70cc41e4ca7fcaaed7514b03f28581082c454e6a2d11f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Sun, 23 Jul 2023 23:38:44 GMT
x-amz-version-id: pMohofQYEF1dohPHFcPmV3oeRzVr6CuK
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P6
age: 16511469
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 22
content-length: 158
last-modified: Fri, 21 Jul 2023 20:53:14 GMT
server: istio-envoy
etag: "e6714addd36102488fb27a980401fd36"
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: anqlLNhlPWAnjgWNRbEh4Rpvo3IIHF3KWC21_zf3ttyoWkJzrwELUQ==

GET
H2 206 notification.5f7c6014.mp3
js.driftt.com/conductor/assets/media/ 8 KB
8 KB 8ms
8ms Media
audio/mpeg 18.245.86.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/conductor/assets/media/notification.5f7c6014.mp3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.86.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-86-87.fra60.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bf06f41bb3a1429115fa2dcfbee9986234d6d319da3597648e4e980340d52027

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Range: bytes=0-

Response headers

date: Wed, 20 Sep 2023 11:20:11 GMT
x-amz-version-id: AJ3ftWhvW2h954Q3Lc0BJKBcX87AS953
via: 1.1 e3f7f612cf7d05edb500a43ad2f70e96.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: FRA60-P6
age: 11458182
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
Content-Range: bytes 0-7754/7755
x-envoy-upstream-service-time: 16
Content-Length: 7755
last-modified: Mon, 18 Sep 2023 19:58:12 GMT
server: istio-envoy
etag: "5f7c6014cf73831f91963a668b71fbb9"
access-control-allow-methods: GET, POST, OPTIONS
content-type: audio/mpeg
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: klTvOGfGNFT71G0qKosfL1pYtWc85Cicwei3DwOuHetLIV5KPeyEqg==

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 188ms
188ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=059bf2ba2b88e39bb3200769d2e411fc&svisitor=null&visitor=a21fcf4f-cfdd-4ff0-8f30-88019c868e74&session=d5f38bae-5fa3-458a-8685-b391206d0783&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2031%20Jan%202024%2002%3A09%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2031%20Jan%202024%2002%3A09%3A53%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225021%22%7D&isIframe=false&m=%7B%22description%22%3A%22Abstract%20The%20Play%20ransomware%20group%20is%20one%20of%20the%20most%20successful%20ransomware%20syndicates%20today.%20All%20it%20takes%20is%20a%20quick%20peek%20with%20a%20disassembler%20to%20know%20why%20this%20group%20has%20become%20infamous.%20This%20is...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game%22%2C%22prod-cat%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&pageViewId=8b990d15-a0c9-42a5-849c-14f5a58fdb46&an_uid=0&webTagId=d24194f2-6101-4c07-b071-d2eb5d40f5e6&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:54 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 mon Show response
obs.segreencolumn.com/ 0
39 B 96ms
96ms XHR
application/json 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://obs.segreencolumn.com/mon
Requested by: Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: https://www.cyberark.com
date: Wed, 31 Jan 2024 02:09:54 GMT
access-control-allow-credentials: true
content-length: 0
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
content-type: application/json

POST
H2 200 bulk Show response
metrics.api.drift.com/monitoring/metrics/event3/ Frame 6B88 25 B
111 B 113ms
112ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/event3/bulk

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 31 Jan 2024 02:09:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: c39536d4211c48a
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 21
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 182ms
181ms Image
image/gif 2.17.100.184
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=059bf2ba2b88e39bb3200769d2e411fc&svisitor=null&visitor=a21fcf4f-cfdd-4ff0-8f30-88019c868e74&session=d5f38bae-5fa3-458a-8685-b391206d0783&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2031%20Jan%202024%2002%3A09%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2031%20Jan%202024%2002%3A09%3A54%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226022%22%7D&isIframe=false&m=%7B%22description%22%3A%22Abstract%20The%20Play%20ransomware%20group%20is%20one%20of%20the%20most%20successful%20ransomware%20syndicates%20today.%20All%20it%20takes%20is%20a%20quick%20peek%20with%20a%20disassembler%20to%20know%20why%20this%20group%20has%20become%20infamous.%20This%20is...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Ransomware%E2%80%99s%20PLAYing%20a%20Broken%20Game%22%2C%22prod-cat%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game&pageViewId=8b990d15-a0c9-42a5-849c-14f5a58fdb46&an_uid=0&webTagId=d24194f2-6101-4c07-b071-d2eb5d40f5e6&v=1.1.14

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-100-184.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/ransomwares-playing-a-broken-game
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 02:09:55 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

212 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

81 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.cyberark.com/	1969-12-31 23:59:59	Name: _MGZ_ Value: op0p8e5o2nmgked0novrd1vnrg
www.cyberark.com/	1970-01-21 02:50:02	Name: pdf_event Value: WyJbe1widXVpZFwiOjI0MjY3NDI1OTR9LDMxNTM2MDAwXSIsImEwZTUyMmZlZDkwOGZhNDhjYzI5YWE4NmIzYmNmMzIyIl0%3D
.cyberark.com/	1970-01-20 18:04:28	Name: __cf_bm Value: mScUhjGAlKfMHIbkJQCJ97M0XD_Zxm9Jrm4Lmt1p4Ss-1706666987-1-AerjHyGVwsSIqwFJt+yUWXiLP+YF9RNp4n4W1i3/fo+LW36sezoUeyB+xIJtRvik9M4dMuc85IQck10yW+LyAfk=
.www.cyberark.com/	1970-01-21 02:50:02	Name: _ufav Value: 8108e0a57dad4c1fabdb601b63a6ed51
.www.cyberark.com/	1970-01-20 18:04:30	Name: _ufas Value: 7991993f026c4e27887d8a23c711d214
.cyberark.com/	1969-12-31 23:59:59	Name: at_check Value: true
.cyberark.com/	1970-01-20 20:14:02	Name: _gcl_au Value: 1.1.1992125960.1706666988
www.cyberark.com/	1970-01-20 18:04:28	Name: ufentry Value: 20240130.213948
.demdex.net/	1970-01-20 22:23:38	Name: demdex Value: 29536971682366275851737429685191035098
.cyberark.com/	1970-01-20 20:15:50	Name: _cq_duid Value: 1.1706666988.tzQBQN1kVVf08y1p
.cyberark.com/	1969-12-31 23:59:59	Name: _cq_suid Value: 1.1706666988.7OpGjhjFIbto6RkH
.cyberark.com/	1969-12-31 23:59:59	Name: AMCVS_9AB97041603F3EDB0A495C66%40AdobeOrg Value: 1
.cyberark.com/	1970-01-20 18:04:28	Name: TAsessionID Value: 885d63d8-9876-499d-8967-d6737b91d5c6\|NEW
.cyberark.com/	1969-12-31 23:59:59	Name: notice_behavior Value: expressed,eu
.cyberark.com/	1970-01-20 20:14:02	Name: _rdt_uuid Value: 1706666988736.ce75cd82-b6ad-40b1-9bf7-fcecbb93b577
.everesttech.net/	1970-01-21 02:50:02	Name: everest_g_v2 Value: g_surferid~Zbmr7AAAAN0jwANe
.cyberark.com/	1970-01-21 03:40:26	Name: _ga Value: GA1.2.649116550.1706666989
.cyberark.com/	1970-01-20 18:05:53	Name: _gid Value: GA1.2.1195797681.1706666989
.cyberark.com/	1970-01-20 18:04:27	Name: _dc_gtm_UA-44168172-9 Value: 1
.dpm.demdex.net/	1970-01-20 22:23:38	Name: dpm Value: 29536971682366275851737429685191035098
.cyberark.com/	1970-01-21 03:40:26	Name: mbox Value: session#64b61cd44bef410f83edc62961441729#1706668849\|PC#64b61cd44bef410f83edc62961441729.37_0#1769911789
.cyberark.com/	1970-01-21 03:40:26	Name: AMCV_9AB97041603F3EDB0A495C66%40AdobeOrg Value: 179643557%7CMCIDTS%7C19754%7CMCMID%7C24522342195950103481362658830194909047%7CMCAAMLH-1707271788%7C6%7CMCAAMB-1707271788%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1706674188s%7CNONE%7CMCSYNCSOP%7C411-19761%7CvVersion%7C5.5.0
.cyberark.com/	1970-01-21 03:40:26	Name: _mkto_trk Value: id:316-CZP-275&token:_mch-cyberark.com-1706666988924-93023
.cyberark.com/	1970-01-21 03:40:26	Name: trwv.uid Value: cyberarksoftware-1706666989153-b81e0208%3A1
.cyberark.com/	1970-01-20 18:04:28	Name: trwsa.sid Value: cyberarksoftware-1706666989155-3d2bc845%3A1
.cyberark.com/	1970-01-21 02:50:02	Name: cf_clearance Value: _kG0bvptbKcEPODKV72SNDWfBrJwxSA6zM2FnTLqqac-1706666989-1-Ac3aFV8veVb1wYiLp7ZtFASvsJGyZrcadWf8CivmLzJaTpn+FAIif1noCh4smUREu4yhWojTZjh4bxrj+jxfQpM=
obs.segreencolumn.com/	1970-01-21 02:08:17	Name: cg_uuid Value: abd94f750940114baaec72bae1141689
.adnxs.com/	1970-01-21 03:40:26	Name: receive-cookie-deprecation Value: 1
www.cyberark.com/	1970-01-21 03:40:26	Name: _gd_visitor Value: a21fcf4f-cfdd-4ff0-8f30-88019c868e74
www.cyberark.com/	1970-01-20 18:04:41	Name: _gd_session Value: d5f38bae-5fa3-458a-8685-b391206d0783
www.cyberark.com/	1970-01-20 18:14:31	Name: _an_uid Value: 0
.doubleclick.net/	1970-01-21 03:26:02	Name: IDE Value: AHWqTUlYA9s2QYPjvWqTEyCSOdcM_uyHe_ZCPVRJsvWtnj9379vpOTevC_44Lj6W
.6sc.co/	1970-01-21 03:40:26	Name: 6suuid Value: b4641102bc660100edabb9658702000095c95c00
.simpli.fi/	1970-01-21 02:51:29	Name: suid Value: DB4DF4F3ABA5459F8F03CDAFD3B376F8
tags.srv.stackadapt.com/	1970-01-21 02:50:02	Name: sa-user-id Value: s%3A0-c20b79d3-8b16-55e2-51ca-93c52ac8c5f4.Wj94abwqhGhIXBoledkDrcVwKDL1CJFTsIebEFEYYKY
.srv.stackadapt.com/	1970-01-21 02:50:02	Name: sa-user-id Value: s%3A0-c20b79d3-8b16-55e2-51ca-93c52ac8c5f4.Wj94abwqhGhIXBoledkDrcVwKDL1CJFTsIebEFEYYKY
tags.srv.stackadapt.com/	1970-01-21 02:50:02	Name: sa-user-id-v2 Value: s%3Awgt504sWVeJRypPFKsjF9FFfBSU.FWZXYv3ZnNZGHMdIEaDafTCUhtwdSqb5SO1xy9sZedM
.srv.stackadapt.com/	1970-01-21 02:50:02	Name: sa-user-id-v2 Value: s%3Awgt504sWVeJRypPFKsjF9FFfBSU.FWZXYv3ZnNZGHMdIEaDafTCUhtwdSqb5SO1xy9sZedM
tags.srv.stackadapt.com/	1970-01-21 02:50:02	Name: sa-user-id-v3 Value: s%3AAQAKIHdD5aik2sMuu9MUMiKohGwkzzWhkJfMui96JqsVistBEHwYBCDu1-atBjABOgQ7vvenQgQzZlXE.%2BWzbUo0qPrsWM3agz%2F6YikXGXH1u12eucLz4%2BsGY4FA
.srv.stackadapt.com/	1970-01-21 02:50:02	Name: sa-user-id-v3 Value: s%3AAQAKIHdD5aik2sMuu9MUMiKohGwkzzWhkJfMui96JqsVistBEHwYBCDu1-atBjABOgQ7vvenQgQzZlXE.%2BWzbUo0qPrsWM3agz%2F6YikXGXH1u12eucLz4%2BsGY4FA
.doubleclick.net/	1970-01-20 22:23:38	Name: receive-cookie-deprecation Value: 1
.bidr.io/	1970-01-21 03:32:56	Name: bito Value: AABArE7Lc1gAC09TSMIssw
.bidr.io/	1970-01-21 03:32:56	Name: bitoIsSecure Value: ok
www.cyberark.com/	1970-01-21 02:50:02	Name: sa-user-id Value: s%253A0-c20b79d3-8b16-55e2-51ca-93c52ac8c5f4.Wj94abwqhGhIXBoledkDrcVwKDL1CJFTsIebEFEYYKY
www.cyberark.com/	1970-01-21 02:50:02	Name: sa-user-id-v2 Value: s%253Awgt504sWVeJRypPFKsjF9FFfBSU.FWZXYv3ZnNZGHMdIEaDafTCUhtwdSqb5SO1xy9sZedM
www.cyberark.com/	1970-01-21 02:50:02	Name: sa-user-id-v3 Value: s%253AAQAKIHdD5aik2sMuu9MUMiKohGwkzzWhkJfMui96JqsVistBEHwYBCDu1-atBjABOgQ7vvenQgQzZlXE.%252BWzbUo0qPrsWM3agz%252F6YikXGXH1u12eucLz4%252BsGY4FA
.simpli.fi/	1970-01-20 18:14:31	Name: uid_syncd_secure Value: true
.cyberark.com/	1970-01-20 20:14:02	Name: _fbp Value: fb.1.1706666990821.959004997
.cyberark.com/	1970-01-20 18:04:28	Name: gpv_c51 Value: https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fransomwares-playing-a-broken-game
.cyberark.com/	1970-01-20 18:47:38	Name: s_nr30 Value: 1706666990934-New
.cyberark.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.linkedin.com/	1970-01-20 20:14:02	Name: li_sugr Value: 4c6b59df-78e1-4c12-94dc-959e9588028a
.linkedin.com/	1970-01-21 02:50:02	Name: bcookie Value: "v=2&af20aeaa-e381-47c7-813a-c4699645e2eb"
.linkedin.com/	1970-01-20 18:05:53	Name: lidc Value: "b=OGST01:s=O:r=O:a=O:p=O:g=3164:u=1:x=1:i=1706666990:t=1706753390:v=2:sig=AQEYRYrOksDY9eTzQu-zmYOQtXf77IwP"
www.cyberark.com/	1970-01-20 18:04:28	Name: drift_campaign_refresh Value: 95ba786e-cf70-4732-ba15-9d3643b78bda
.adnxs.com/	1970-01-20 20:14:02	Name: XANDR_PANID Value: d4A-ly3-C60URrF2Ebpn2UCuHLD8zqtI56V8JTJP7yzKSUFJGs1U13sjNKOz3mdzaRT2Mwk6Y87W0p_Gm6OXzLTGuqv9BWuuwIuIGaE1GVI.
.adnxs.com/	1970-01-20 20:14:02	Name: uuid2 Value: 8859484256121659821
.tapad.com/	1970-01-20 19:30:50	Name: TapAd_TS Value: 1706666990973
.tapad.com/	1970-01-20 19:30:50	Name: TapAd_DID Value: 4bf5e5d9-4b1d-4ad3-b115-863de17d0302
.1rx.io/	1970-01-21 02:50:02	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-0d113d1f-1e82-4f5c-876f-f80dd81e529d-003%22%7D
.agkn.com/	1970-01-21 02:50:02	Name: ab Value: 0001%3A1RyAgMn1MUwhLZEPA5Rw9%2BO3ODnlvUzh
.adnxs.com/	1970-01-20 20:14:02	Name: anj Value: dTM7k!M4.FE:2jUF']wIg2E>@wVtuk!]tbPl1N!7On*M$=BWXme8Y!Bh1PJhiJC.fiet^VcyDB_iIX^dfp8GrgxPDjtp2)s/X%W#.wL4W1Qw2<:5Avg
.tapad.com/	1970-01-20 19:30:50	Name: TapAd_3WAY_SYNCS Value:
.pro-market.net/	1970-01-20 22:23:38	Name: anProfile Value: "1kpw4ekhxb3e1+1+1f=1+1g=1+1j=41+rs=s+rt=2A0104A0002B00000000000000000009+s2=(s83soe)+vm=24-DB4DF4F3ABA5459F8F03CDAFD3B376F8"
.pro-market.net/	1970-01-20 18:47:38	Name: anHistory Value: "1kpw4ekhxb3e1+2+!#7')!B#'_c"
.agkn.com/	1970-01-21 02:50:02	Name: u Value: C\|0AAAAAAAALUxobwAAAAAA
.yahoo.com/	1970-01-21 02:50:24	Name: A3 Value: d=AQABBO-ruWUCEE_n3cbaI9k6PpFttRXgqNkFEgEBAQH9umXDZeAPyiMA_eMAAA&S=AQAAAlI1C-eX5hhm3WdZwMkH3QE
.targeting.unrulymedia.com/	1970-01-21 02:50:02	Name: _rxuuid Value: %7B%22rx_uuid%22%3A%22RX-0d113d1f-1e82-4f5c-876f-f80dd81e529d-003%22%7D
.exelator.com/	1970-01-20 20:57:14	Name: EE Value: "b87c1e022afe1141d222724f7cfd681c"
.exelator.com/	1970-01-20 20:57:14	Name: ud Value: "eJxrXxzq6XKLQSHJwjzZMNXAyCgxLdXQ0MQwxcjIyNzIJM08OS3FzMIweXFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDIYEl%252BUWb6IhfXxUUpaQyLSopPBR9btwQAnWcqnA%253D%253D"
.linkedin.com/	1970-01-20 18:47:38	Name: UserMatchHistory Value: AQKtbTY9f9BbwgAAAY1dR53UppwWmqJL85JkGLi7aprCf3Pwddu_J6zqBYkPnD9ALgVIfbBM-jJ68w
.linkedin.com/	1970-01-20 18:47:38	Name: AnalyticsSyncHistory Value: AQJO46RLm_FtggAAAY1dR53UO10QNNXWK23aYqPfRknDUHzndOoo2F3AP-tLLl9Kx4YXtPt-wDWS1NtEP49kkQ
.bluekai.com/	1970-01-20 22:26:31	Name: bku Value: blx99mIgrVUuOXLT
.bluekai.com/	1970-01-20 22:26:31	Name: bkpa Value: KJy9nyexd02pSUHknp/8mE1hwtkAwDHYBWHsBWRpxDJOBExNmDRTHM9px6HOHAxpxM1lBART9y9FiyF2
.bfmio.com/	1970-01-21 02:50:02	Name: __141_cid Value: DB4DF4F3ABA5459F8F03CDAFD3B376F8
.bfmio.com/	1970-01-21 02:50:02	Name: __io_cid Value: acdf87908a2007891a73ea8504698545131e1b7a
.www.linkedin.com/	1970-01-21 02:50:02	Name: bscookie Value: "v=1&202401310209512cd3442a-21ed-413c-8d1f-efc309e80e58AQHu6pbX5sPy8YjftoYAUPg_p75PJ_8K"
.linkedin.com/	1970-01-20 22:23:38	Name: li_gc Value: MTswOzE3MDY2NjY5OTE7MjswMjFtL7kuvo5X9X5dW7H59QAy22I9PvNQcG1kAQfBXPMdQw==
.cyberark.com/	1970-01-21 03:40:26	Name: _ga_XTLTD7RKN5 Value: GS1.2.1706666989.1.0.1706666991.58.0.0
www.cyberark.com/	1970-01-21 03:40:26	Name: drift_aid Value: f7fee210-90e2-4f6d-8b29-d9e3fa832499
www.cyberark.com/	1970-01-21 03:40:26	Name: driftt_aid Value: f7fee210-90e2-4f6d-8b29-d9e3fa832499

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.bundle.js Message: Specifying 'overflow: visible' on img, video and canvas tags may cause them to produce visual content outside of the element bounds. See https://github.com/WICG/view-transitions/blob/main/debugging_overflow_on_images.md for details.
worker	verbose	URL: blob:https://www.cyberark.com/dc615cd3-441f-473d-9d58-8af26037f1dc(Line 1) Message: Error
other	warning	URL: https://connect.facebook.net/signals/config/286320195733404?v=2.9.143&r=stable&domain=www.cyberark.com&hme=1e96626f56fb37feabdb16bd09d3dbece570479b2ec677eec7364c762eaf296e&ex_m=62%2C104%2C92%2C96%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C146%2C149%2C160%2C156%2C157%2C159%2C25%2C89%2C45%2C68%2C158%2C141%2C144%2C153%2C154%2C161%2C113%2C13%2C43%2C165%2C164%2C115%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C93%2C95%2C31%2C94%2C26%2C22%2C142%2C145%2C122%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C91%2C38%2C70%2C60%2C97%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C98(Line 105) Message: Unrecognized feature: 'attribution-reporting'.
network	error	URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=DB4DF4F3ABA5459F8F03CDAFD3B376F8 Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://idsync.rlcdn.com/419566.gif?partner_uid=DB4DF4F3ABA5459F8F03CDAFD3B376F8 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=DB4DF4F3ABA5459F8F03CDAFD3B376F8 Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://www.cyberark.com/
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

316-czp-275.mktoresp.com
9920016.fls.doubleclick.net
aa.agkn.com
adservice.google.com
alb.reddit.com
assets.adobedtm.com
b.6sc.co
bcp.crwdcntrl.net
bootstrap.api.drift.com
c.6sc.co
cdnjs.cloudflare.com
ce.lijit.com
cihost.uberflip.com
cm.everesttech.net
cm.g.doubleclick.net
cms.analytics.yahoo.com
cnv.event.prod.bidr.io
connect.facebook.net
consent-pref.trustarc.com
consent-st.trustarc.com
consent.trustarc.com
content.cdntwrk.com
conversions-config.reddit.com
cyberark.demdex.net
cyberark.sc.omtrdc.net
cyberark.tt.omtrdc.net
d.agkn.com
d1eoo1tco6rr5e.cloudfront.net
distillery.wistia.com
dpm.demdex.net
driftt.imgix.net
eb2.3lift.com
embed-cloudfront.wistia.com
embed-ssl.wistia.com
event.api.drift.com
fast.wistia.com
fei.pro-market.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i.simpli.fi
ib.adnxs.com
idsync.rlcdn.com
in.ml314.com
insight.adsrvr.org
ipv6.6sc.co
j.6sc.co
js.driftt.com
loadm.exelator.com
metrics.api.drift.com
ml314.com
munchkin.marketo.net
nexus.ensighten.com
ob.segreencolumn.com
obs.segreencolumn.com
pipedream.wistia.com
pixel.rubiconproject.com
pixel.tapad.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
rtp-static.marketo.com
s.ad.smaato.net
secure.adnxs.com
simplifi.partners.tremorhub.com
sjrtp6-cdn.marketo.com
sjrtp6.marketo.com
snap.licdn.com
stags.bluekai.com
stats.g.doubleclick.net
sync.1rx.io
sync.bfmio.com
sync.intentiq.com
sync.targeting.unrulymedia.com
tag.simpli.fi
tags.srv.stackadapt.com
targeting.api.drift.com
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
www.cyberark.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
104.122.39.154
104.16.15.87
13.107.42.14
13.225.78.35
13.225.83.200
13.248.245.213
142.250.181.226
142.250.181.230
143.204.98.35
15.197.193.217
151.101.1.140
18.245.86.6
18.245.86.87
184.31.85.59
185.89.210.82
192.28.146.116
192.28.147.68
2.17.100.184
2001:4860:4802:32::36
216.58.206.34
2600:1901:0:8eee::
2600:1f18:612b:4280:c452:8a8b:24f9:dc81
2600:1f18:e8a:cd10:3bb7:12f:ec6a:dc8a
2600:9000:206f:e600:2:8f43:5780:93a1
2600:9000:211e:5a00:1e:c86:4140:93a1
2600:9000:211e:b400:1b:5138:8a40:93a1
2600:9000:211e:fe00:1e:c86:4140:93a1
2600:9000:2156:9a00:12:53a8:95c0:93a1
2600:9000:236e:5600:3:471f:5240:93a1
2600:9000:2490:400:18:15b9:5a80:93a1
2606:4700::6811:180e
2620:1ec:21::14
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::2008
2a00:1450:4001:81c::2004
2a00:1450:4001:827::200e
2a00:1450:4001:828::2003
2a00:1450:4001:829::2002
2a00:1450:4001:829::200a
2a00:1450:4001:830::2003
2a00:1450:400c:c0b::9a
2a02:26f0:480:23::1726:629c
2a02:26f0:480:980::1e80
2a02:26f0:480:f::213:7edd
2a03:2880:f083:9:face:b00c:0:3
2a03:2880:f177:185:face:b00c:0:25de
2a04:4e42:400::644
2a04:4e42:600::396
2a04:4e42:8d::720
3.122.71.237
3.71.149.231
3.77.28.166
34.111.113.62
34.111.234.236
34.98.64.218
35.204.158.49
35.204.89.238
35.244.174.68
46.228.174.117
50.16.7.188
52.209.137.59
52.210.45.0
52.212.233.39
52.222.214.69
52.222.236.129
52.54.120.189
52.58.65.170
54.161.243.53
54.78.254.47
63.140.62.27
66.235.152.225
69.173.144.139
92.123.17.8
99.80.224.8
99.80.4.3
99.86.4.13
02091aa39549dbde668309a0c7e6f03bd384e437bd761b7a3b26b8b926a16067
027ca73659dab51fe9987fd4d19b9eedd940202da076fec561dab2b297dfa820
042035f678e7f9dc023e5591b5e1a265fcf1540f7232e955efa255b329ec24cf
04e545b5be20845b92830f58259a279ea253b40de581740bfe0b95c18dc9e4c8
08330120c6d9d4407fd599bae49187289878c557ed68e58d0e091fd5e1ac6c7f
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0c06a244d9282c17ecb2ae5d1d3f3ca3a103b0207904cb31af0b86c5e5073b00
109ca7e634fbb0f86039dbc8e7c61e891170326321f7e4be3ba29c9caa364ccc
11831be78f4141b18b1ff045a65cf7703f8181a822699cde5f2319dc392c5f67
11dfb20b20673222042301dcd78e577249c31bf357b58ebf97a4c7ecb241beeb
12a2f409f03bad041a44d07d99ca2ba49f1d198da96c688343d545acfe9a36a5
14f24d7498818913eeda69e8037aa1a2aa7f2e1d31a8ddde6ec03baffda80d9a
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
196697739a7e27c152b6bfb1f999ea07ff14eb538a607348e549477d946d155b
1b1422bb0eba3d8b28017120e33bfbc49b21847f2fdedc5acc2d7273396637d6
1ba3a74eb74823f80c522391734fdeafebfbd2f284167568ad17e7d44b1618e3
1ca3d3ed4102816e2de0d015a3a1b442991f093419dbc8638c946989d289ce54
1d36681a89fc34572e53868ae68a5ee003d545a5a724caa76ca2707d2c3b723b
1e20c277f9215eea696595f6dbb57825b4a7f87cddfec2f565379bf742252ecb
1f150486021d4182821249f13273a7a87862756e2b021e3d19121aaae6a2e09d
1fb7ee27fdfb34869f89aa51d9af1cf86ecc6800ab591ec3ca78f155742200b2
20762aa0fe40492f41569768f84afe1a8a50f2ed1b54861f966ba12fe8aab763
22f8377b75e8bf91649227ee7fa17265058b0e6aad499609a50180d7cfa362c5
234f5e6b36c41a209c87e64949d11927b6360603b94ce3511c53df5bac0f4c26
23f95a90d6e6ba09a92bd4eae99823b0a6b0137a9abe10e3c050c062fb15efe4
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
272c0bc199c58b5cf983ea4cd3acd11106c32762bf548f1b2c7e6648808f7f9d
2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2ccd80e8d18c5487a17486887b1fb9e6b39d10aa2442f0ac754fc8d2792eb2cb
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
2f5f9d511700318e988d3ef843afc49224162c8bb2435db7b9dc3590f525306f
3005a54fc57fc2d8c70cc41e4ca7fcaaed7514b03f28581082c454e6a2d11f3b
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
329eba5224a490e972374a62dd94c61794c440471cc2d40a13a73d6586d7394d
3337f36bd89c27dbe1dca4b71fb177d826b736950f2150aff6acce0180a86fc5
33679051037335d4feb2347865be5976837c7076c799674062d46285a7d00dce
339b2b60e94b6dc169fd9e5b68ac16b1ca08ef6a4968e98a0f43c2add405e79a
35f273e01e70db780ae423347dffecfc27cc348ba4abbd6099331559a7c5cd31
365c4e4e15bb05abb8135ba921b7ff58c93459e1b8eda9e1835c13ba7ecec1b4
3927bde3719197a23a7d4e791123e5d0a13648789d66e6fd67cc31c84b964cfe
3c25dd38b7a4c67ac1844d3fe2a66b04241a624409142c27274c679335d1365f
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3cd396ea4ae38a7b1abcf13936a75c655218f074d40155813698d30386fa3168
3decbe1c69b0f91d975610f54b2615be61a887c20f8ade1049be9743168198aa
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
418cd513eedba428ed1de803a768ba7f89ad95211264ed386511779082b64a9c
428b3c9619b58c9ea969aa74e73d5f196f92ea31968dabac58d13ae593687075
453c78760d17ea7145d18997521ee8e9262d5215ff3e1e0eec900f4628df4773
45aca110620ac12009925cac1e38aa4e71426a2b83ee7f356010069b45539d56
45fc084d4788e26e26855549406938f7d5be45e6a9d8469681d4026f6b7e2f6c
481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f
4891ae2b0a7fd1bd7180806843221e6d89a9d08d2bd1ea14adcf42cd74176a6b
49bdaf43b043fdd5e79f321a889502b341e83fb3d71caa9ec286369bcb205373
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e02fda4bdfbdf9df0e3523b8b2b385afbd007a3f8318e0e640f8d0a0da100be
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5091bbe138e04f9f2176182d823e6a7cb8a30237acd606e8896d04f0fc04820f
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
52d87460560d706c4aa2b62216ad84345b4292322c818c69fd55bb234afd4c83
552f36235edc79f9c9bf1fe929c9713108fae2302f65349e57d0f3c9dd32eff0
5567c5a47f8bbd27707bd2cffdb1679c292a07ccf09a8578e1b9eba7ab481cf3
55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5894a3649b213cf5b2d673b6e7a871815fd1d120fa68a463592f27db14eae323
58fdb03fac3e89e51525a5a45eb777395d1b499bf4483e96201b6becddbe516f
594d3ade307f6f48a5ef5143228b9da7c4e78589177ac70e91d31fe75ea83d60
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1
5a478e51589e707487742d84d8e3fa5cbe095d5e0060e2080ae6a8b019c9d171
5cbd2c4ce1325baae0fa325bdd95a25a925b094d7e88fc6fcebb834a6906c5b4
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
5e240679c3215c840cf754104fe7291c77f2f52ad551c95e8c8364d0124938ec
5e81401d2a127d7754b03d63b9cf7f3bf22355faa2a0a5f8232f42e4a2de29eb
60f515991307abd345708ae3d50ff9a7751c68c208e2586d992c3c6ff729d6b0
6118f929bfb52cbe76ebddf83812e8d5ec05052e8e7caea362b15246f1b10c2e
619ddc1d756bc60de4717303471873db6bbc6da6106ad99231472aecdb6c3040
621bafd8b2419f30d42474df7bb292286548afd73dcc9689f5c3719f7b191ef8
62738b62849a46842f34013b8528886f10c8d0e1c9aec47d636e05d631e2f60e
634358d77171f485bb1738fce1bf1e715e2cd0a94b2c4f3d5c6dafccd0d1031a
63f285c8e4892a07161fd53d4f726105db1631400ae791a7db4aa33e91278125
66c708b80cab108a2fde84cac9677c07435537bc9d06085ccd1ac80cb93513b4
6718cd8faf856f181f860473746fe497344c5f6e01360a65309d7f91640eb53d
67e2f25233ffe02ea0a70301e7440e6371d8943ca3f759b1d128b590e7e9419b
6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
69dd333c29a4b5e4af6ba9979f292b4d48639a55d21b5a9c518c0338644aedcf
6a3ed8cee1f3e321efead56af44dc4392527febf7910f50083caa12e86027ad5
6c3be82a5e536cb0991aa349d0d9de1c2639425d9c252f5a4336091ddaca8f33
6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca
6d43cbfb3475ea98f326b23502fbff79982c29c93ddc700233aca7db3dea0716
6df07acc4226892a09f5d94cfb28cd6f560b073f5fb5e4060fede31cba893989
6e6098f9e4e64f667bc006876813632d5ac79ac56e5284a95c9c821870907cad
7157511697db744d384a5a2a8646af23f3c90560abf93bb240fdd690b29a898a
720f86921badb8a5eac35a3d3c69a85ce08694d881bbd8fdfe7c102b9a8bf691
740bb313221bda5543b6fbe0bce3dd276cc70c4fd9aa0bae9d46b149406becf5
74919b0f053c18d9f2d32ea8082862f05c1305f78bdaa933ea09a65607b0759e
74935268619be1f087ce67765abd72f80107125f23b346f7615cc9e6a19d4595
7633cd7887e2046b023bdbd496e3d087f5c38e823b267e17244c474e00b6c1c1
7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b
778347605ae980421f7a0b819bb5eed18658e24f873f7d77eb1e481e1166e7cd
7849ba1748f8188749df28e9d59ca4e570a8495684353d8df4715fa70a81e787
78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa
7b0e7a4bdf115afb8e8c5b9b671b0dc4441236f8cf56906d146b7d46a0ee14a8
7be1b3df507b34b7d05c60510836564455b0f85be0871e96e48201e4947d4cfd
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7c28cfd451fc7eb20c03103195db3a5ac12be83eaf3d876821af8648db2691d7
7d78bcb45e61155283355f98b205d9dc7b416aef6cfd5ae58c76d7633941a52b
7ef8a267de455c3a72237bf7db0c97c97e35e52452ff9ece15876d0d60f9c0e9
7f682ef3fa82a2d4c331a0595aecf32fdbfd76a2d1c4b14710c519920303b1df
8078cebf9ab8ba5c0802536ed68317072ca51f1cb5293db16d63f923aad2e011
8242e73795aa5b9757183fc6b9969c3e9a898f2e8f1e4d224d2bf9c982054e73
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
8642675885c3a57a6673d673550ef1b5cb983e7b8232e00cf7d804cbe6a1f034
864c44b8b866936ec27dcee84017dbc8ff988248461b1246fbe13f0615a43741
86ccdb948d25950b2b56fa681d1d87e712e5549719d476f355b240fd802f27b5
86e8b37fa004ddf5f2a20b33ffec6905866feb64aae71c065524e17fd5687f38
8891a160f8a2afb81de5259f9f68e5af3782348ea2927ad9e969bc88c7d39984
88b4bd1c3c8e9af6516b562e9679955ff48479ee6a5771e97ef425d1c5425e1f
89275a1c66640733265b5be89864b6daefef1cc3f275566dd8fd29bd66601a83
897f811bb47f9745182b2780e58cad6fab6ca5dc0d8d17f4e12dfb4a394ccdd1
8aab45b2e3226eb83ceed37f3f622529d0a6ca0a82d8dd9a4d1fb8e46ba84f83
8bcb1671142844b9c10b5247053d513b9110ad9e3ad7ec0b751d42c977611f83
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8dd7a7eeccaaffd8a75ac8a2420ae500376d9f7f652dd8545deebd399bb96cfa
8df3fad21ac78f5382a5993803be1dea1ba725a0fb55d23eef360d3b7a407964
8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae
9021d8e270fe8789573c83781201ae6654fb9453631271456ca0a6cbff2a7fee
91b7152c2708e116677591b018f23ed2910c747e932f8985b704f1884d807990
91c4a6c4295f8889e8b04339a4a2c2e86d5eef71ba808164e641d0d8a6435004
93e2856e540b7faf4767d1291492324c43994be69562b8d1d9be07de8e2e40e4
94e3cdd5f056065d29360bb92657b5d0e6ce640a685585e12520c3e27f3d1ba9
94fa9986e84282779b163982fac7dde36adcabd7ae376b82ce764edfccc59894
952366b677cb051dfd4b892f04df0437d34570634196a971cfc4a95f3b563302
952f35790a58d6c58cd01db0b7994f8b1e3f2d4328f8dd2ed423c01579d403c6
95317aa6431ef9b6b7d41a92c40a9fa04a1480d01bf66c7ffef3a808e6fad87c
967db37138f1ed6222ca79897757975e45c87e73d6fccd0ac6785f3eb45090d5
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9e70999bd0ed2afbb2967ca63898c752fc3e66ba8a86a4ac341723be85bb7319
9f565b4cdf200b503b4c09d2e4644a1fbec24230e60b873ab7e09ae969a6fc1b
a03b854d10519fd5be9cdcbc78fad3927c1a3de9e84fa74353c8a19cc20d0501
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0ecd664d717fc9ad0a511a6379f291db344fd80bfe9058989c0f4d658d65e1c
a117f36dba1eb2100f340bb68f3cc4d4c04d50d8a1d61c36a5d0a682aed9d362
a249bcffb2d8e92a3bdff919def43b14841803ad93b80ffa864db1090e007594
a55619fd27a0e1c6c940e668707a13ea02bc52953106260a570c28e5a300c070
a5d5440531634243b964eb7c0402577b778dd37c79e8bd00e968a74a1a5ee8d0
a654dbffdb656aacce15df139a6d2701ccae809fe7baab1ec042714bb6336eb9
a78759ea185fd0fa42ca9be1fc5bca4d3167a2836dc6c85e479a19dbf57fe2c2
a9e1fe762e98db2f81933cfaf6078e9beb45b479de25a6a7ee288b08a0ea807d
aa65b2577c91e2a417e095cd4f53f3c6990e7d6fd7d4bc8088467b187f0a9bfa
aa7648e4c28aadc70b11a874b9fa4423e79f88d8bf87bd22cb956aa8fedad29f
abb15ddd1f878f101678d02f04e67f7727b66932d2b0cfae83e2aa5522f3e90c
abca0004f2960ea162b161a82240a139fce6012733a76f3859febb9bed38b420
ad48841a67a5fe1429379e173147275e4e87794f01df53c9ec53257ebd3b1042
add45a468bcd64e33645f15b1870b5813d1ff1fe97c59cb4bcd9e98fa09c66fe
afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1
b0388a2387283b8457b08aadd7fdcca2702ba989863981b18e673a1394e74c4f
b06ee181a056d674f14dc07a3cf5eaf2b4f85aa65def46ee9c33cffda18573bb
b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a
b13c9311dec3f49821d88065299e95cc1c4e6c26acc4b27b4ebdb380d40d8788
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1700a9f05644621ffe3a13f59d5258261f170718eb8a6076e5fc55cd918afc7
b30331795881ff744d78b4dd58ff581d6d10f2bb4fce96ea7c18e01f79a17c62
b31e3c4c8f964c4459df4ffebac0b6594b1cbf9df690e5c7045e25ea9d06c5a4
b43f1b911f9ba7809a0ad756563aa9d500c8f13018f689923dded00c29d0e1b5
b480bbc5834651fb48a482fb5711ea65de49e97a9491ca7e89cecf0bfb26ccd1
b5474d3ed408366dcebededf5c987f44b43b389137272c282c6c972852a14fc0
b62a7cb7330e30caac7fbca43afcfd4f18e2fffd1fa372cab93c625f3d2f3f1a
b6da2852778840c0456b598c5e78236c7e0e6f6e23129685865f5a0a5bd1d538
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
b96b944dbdb9c2afcdecae184e3bdc4717c30dc4f5d4624cfd1727461d6569fa
b98e0f76f97857fce1b3fbd8e9ed5775988e85fffd71dcc2422f8d012378ea34
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb37fafaa4238ac3ff4133b841f54bde67b67063679de27cee551baf2696da3c
bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b
bbe27e257ac5411e6d7da3b15b6a2f799f12c586d590a2496f48cdb20069b8ee
bce8ce0d0f68ceecff66a7d2a6c3dd78fce20c7595f4239a69909d7c5e2c363a
bf06f41bb3a1429115fa2dcfbee9986234d6d319da3597648e4e980340d52027
bf6806d8c92e228249230195772afe2e68791d52763b782be9aa2855fab3b641
c1cd0852f3077f1b059e16529d8de16acb490990d6cb796dd74873de0bfd8a91
c2861aa3df08bb8f1c303f91bcc8c8e8d9838b00afef972c32f2f42e4f64cd39
c48e0d3f95034cda3ba46d64e2a0b9b588b9d567fa498c1ac7887a6ddd40b7a7
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
c6134e6ac14d17d2359f910de71889d3e82743aef08773c93901a12acf72f393
ce04010f81026943ad5db47aaac761f4ac4103774c970056ec95316d1fd5eaca
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf586f008acee3c57d9cd2e03d04c0ee3c9f804ced4b1c210d1e32a74a1e9c10
cf71d755c2a7a19f401bce0018d981f8cc4a08dae5301a8fd78b78cb8a8881d2
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42
d3851af1bf48f6e0903b5d66e5d64141a559aa05a2da8c76b502dda2b6473933
d4761d421bbf2f059126b9ce4f5e0a9f7bc83b046a58162780a2b9c3ab8c9a56
d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf
d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296
d848c15dad5edf002d378962f1f92effea1479fe5bf2570ac95edb9318dfc070
d99d2429e8e90014f3b5cb16a9bc0a773d0ddfb3d384c6e6b7f706236ae4848f
dbae32a3db84b864f7c1d83ced2687304ccb6d66da8fd109ccdffe5be20e549f
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
dfeecee70ce9544105ce0e0919a4cd09cf6e239cd588b991d8809b99e9873d40
dff6fc5dcca6679a17f0219d59fd19797b87b52adc6a12cb5ec641b8722398b0
e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d
e17ed6f660604edd30f3fb7d0d9f8ff81897a294451d7c5ad93b730ffcb6e5b9
e2de2046e0b566acced02881ab6a7719eb3e1c615ac82cb22d50f664026d8c1d
e2f6edeb43684c52476fafa30df1d715dd0721691ec4ddd736c3245c4db4d844
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11
e80cfc6df2f882813f88dcf1175bc0c47e13c0cd8517bc240a65ee6cc758b0f2
e8e7fd76994e9fe7f19af8a2234efc259debc6e67de4ae8bf2f0e7471132bd02
eb18e0f900e94a80c5651502a21a454e97ecb22d662bcf0e9ff7e86737c511b8
eb7cfd3d959b2e09c170f532e29f8b825f9bc770b2279fde58e595617753e244
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
ec8277351257eaab58a4e87c83920aba6c35d1fc232340055b6c9df730a97dc1
ecceaab7dbf1f1fe1d9065a03b9b9e0f1b54e1f73b7db1c76a91fb2444dc67de
edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b
eec8fb654765dfbba9b783382bfc8ecda7db21a2e24ffde27d19624ae2287d9e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f10bb7a28b21582f2d86a4715c62135e4940bf6149322102a331c982782cda1f
f1ba71d3bf034aeceecb8895e71a44f4806dbb5bcc44e46fd8fc461a774eb880
f6305ad97ebc710e618453ab70661972a83d3349a3f31754007f33daffc12f3f
f8a01ce1f0b884745f17415c8a29fc513ad070438b31b18e17c59b597c5a0473
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
f9aded115091d50d47d7754707791323361dc3b0845d6cdfbd79b5b6f511c362
fa419d389bf4bc139c32766832915eaab6bd0a1348d06b139c35a20d059a44a9
fd53afd3d83890806b14513ee8438283da141aad79a9d75391e3b9e0b6cdf829
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe2d7250cc0730dc655721c5fa4bf5236dcabdf57f8593e8fe2096a42c0c8baf
fe68ada9a3d8295f355417eee75328dc8b09a238e2a2cf2dcbb738d4e5ddc511
ff8f406b684c6674dbd3705d3f6d2cd10b5eedbc2c67a7773f235d69ef122d04

www.cyberark.com Open in urlscan Pro 104.16.15.87 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

319 Requests

91 %HTTPS

39 %IPv6

58 Domains

89 Subdomains

72 IPs

7 Countries

5898 kBTransfer

13692 kBSize

81 Cookies

47 Outgoing links

Redirected requests

319 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.cyberark.com Open in urlscan Pro
104.16.15.87 Public Scan

Screenshot
Live screenshot

Full Image

319
Requests

91 %
HTTPS

39 %
IPv6

58
Domains

89
Subdomains

72
IPs

7
Countries

5898 kB
Transfer

13692 kB
Size

81
Cookies

319 HTTP transactions
2 data transactions