urlscan.io logo urlscan.io
SecurityTrails logo

news.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42c8  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://app.go.sophos.com/e/er?s=1777052651&lid=27900&elqTrackId=5bc54dcc835240e9b930dc03ad926a2f&elq=8e9adae561c3419e99d9...
Effective URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Submission: On June 15 via manual from CA — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 32 IPs in 6 countries across 28 domains to perform 62 HTTP transactions. The main IP is 2a04:fa87:fffd::c000:42c8, located in Ireland and belongs to AUTOMATTIC, US. The main domain is news.sophos.com. The Cisco Umbrella rank of the primary domain is 646237.
TLS certificate: Issued by R3 on May 27th 2022. Valid for: 3 months.
This is the only time news.sophos.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 192.29.201.5 31898 (ORACLE-BM...)
1 1 192.29.202.14 31898 (ORACLE-BM...)
17 2a04:fa87:fff... 2635 (AUTOMATTIC)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 192.0.76.3 2635 (AUTOMATTIC)
1 3 2a00:1450:400... 15169 (GOOGLE)
1 96.16.149.96 16625 (AKAMAI-AS)
1 2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 4 2620:1ec:c11:... 8068 (MICROSOFT...)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 143.204.89.87 16509 (AMAZON-02)
1 199.232.188.157 54113 (FASTLY)
1 151.101.129.2 54113 (FASTLY)
4 3.224.78.34 14618 (AMAZON-AES)
1 143.204.94.161 16509 (AMAZON-02)
2 2a00:1288:80:... 203220 (YAHOO-DEB)
1 172.217.23.98 15169 (GOOGLE)
1 54.81.239.179 14618 (AMAZON-AES)
3 3 2620:1ec:22::14 8068 (MICROSOFT...)
1 13.107.43.14 8068 (MICROSOFT...)
1 104.244.42.69 13414 (TWITTER)
1 104.244.42.195 13414 (TWITTER)
1 212.82.100.181 34010 (YAHOO-IRD)
1 143.204.89.126 16509 (AMAZON-02)
2 2 52.50.60.18 16509 (AMAZON-02)
1 2 143.204.89.30 16509 (AMAZON-02)
1 35.244.174.68 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f11... 32934 (FACEBOOK)
1 2620:1ec:27::... 8075 (MICROSOFT...)
3 52.184.204.244 8075 (MICROSOFT...)
1 2 20.234.93.27 8075 (MICROSOFT...)
1 52.223.40.198 16509 (AMAZON-02)
62 32
1    192.29.201.5 (Amsterdam, Netherlands)

ASN31898 (ORACLE-BMC-31898, US)
app.go.sophos.com
1    192.29.202.14 (Amsterdam, Netherlands)

ASN31898 (ORACLE-BMC-31898, US)
s1777052651.t.eloqua.com
17    2a04:fa87:fffd::c000:42c8 (Ireland)

ASN2635 (AUTOMATTIC, US)
news.sophos.com
2    2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2606:4700::6810:5714 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
2    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
stats.wp.com
pixel.wp.com
3    2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    96.16.149.96 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a96-16-149-96.deploy.static.akamaitechnologies.com
img03.en25.com
2    2a00:1450:4001:803::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.nl
4    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
c.bing.com
2    2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    2a02:26f0:3500:16::215:14a0 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
1    143.204.89.87 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-89-87.fra50.r.cloudfront.net
scripts.demandbase.com
1    199.232.188.157 (Munich, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
1    151.101.129.2 (United States)

ASN54113 (FASTLY, US)
a.quora.com
4    3.224.78.34 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-224-78-34.compute-1.amazonaws.com
tags.srv.stackadapt.com
1    143.204.94.161 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-94-161.fra50.r.cloudfront.net
js.adsrvr.org
2    2a00:1288:80:807::1 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)
s.yimg.com
1    172.217.23.98 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f98.1e100.net
www.googleadservices.com
1    54.81.239.179 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-81-239-179.compute-1.amazonaws.com
q.quora.com
3    2620:1ec:22::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
1    13.107.43.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
1    104.244.42.69 (United States)

ASN13414 (TWITTER, US)
t.co
1    104.244.42.195 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
1    212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com
sp.analytics.yahoo.com
1    143.204.89.126 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-89-126.fra50.r.cloudfront.net
api.company-target.com
2    52.50.60.18 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-50-60-18.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
2    143.204.89.30 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-89-30.fra50.r.cloudfront.net
segments.company-target.com
1    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
id.rlcdn.com
1    2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
2    2a03:2880:f11c:8083:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    2620:1ec:27::cafe:1995 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.clarity.ms
3    52.184.204.244 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
n.clarity.ms
2    20.234.93.27 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.clarity.ms
1    52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
insight.adsrvr.org
Apex Domain
Subdomains		 Transfer
18 sophos.com
app.go.sophos.com — Cisco Umbrella Rank: 614130
news.sophos.com — Cisco Umbrella Rank: 646237
951 KB
6 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 595
n.clarity.ms — Cisco Umbrella Rank: 5740
c.clarity.ms — Cisco Umbrella Rank: 1161
26 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 370
www.linkedin.com — Cisco Umbrella Rank: 527
px4.ads.linkedin.com — Cisco Umbrella Rank: 5965
4 KB
4 stackadapt.com
tags.srv.stackadapt.com — Cisco Umbrella Rank: 3888
7 KB
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 389
c.bing.com — Cisco Umbrella Rank: 229
13 KB
4 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 125
googleads.g.doubleclick.net — Cisco Umbrella Rank: 55
19 KB
3 company-target.com
api.company-target.com — Cisco Umbrella Rank: 3519
segments.company-target.com — Cisco Umbrella Rank: 1357
2 KB
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 91
388 B
2 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 531
1019 B
2 yimg.com
s.yimg.com — Cisco Umbrella Rank: 382
7 KB
2 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1467
insight.adsrvr.org — Cisco Umbrella Rank: 660
5 KB
2 quora.com
a.quora.com — Cisco Umbrella Rank: 7949
q.quora.com — Cisco Umbrella Rank: 3201
15 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 158
110 KB
2 google.nl
www.google.nl — Cisco Umbrella Rank: 7713
565 B
2 google.com
www.google.com — Cisco Umbrella Rank: 9
641 B
2 wp.com
stats.wp.com — Cisco Umbrella Rank: 2946
pixel.wp.com — Cisco Umbrella Rank: 2681
3 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 96
93 KB
1 rlcdn.com
id.rlcdn.com — Cisco Umbrella Rank: 657
98 B
1 yahoo.com
sp.analytics.yahoo.com — Cisco Umbrella Rank: 787
631 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 554
354 B
1 t.co
t.co — Cisco Umbrella Rank: 466
337 B
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 133
15 KB
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 681
14 KB
1 demandbase.com
scripts.demandbase.com — Cisco Umbrella Rank: 6441
16 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 953
3 KB
1 en25.com
img03.en25.com — Cisco Umbrella Rank: 17030
3 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 444
9 KB
1 eloqua.com
s1777052651.t.eloqua.com — Cisco Umbrella Rank: 390890
775 B
62 28
Domain Requested by
17 news.sophos.com news.sophos.com
4 tags.srv.stackadapt.com news.sophos.com
tags.srv.stackadapt.com
3 n.clarity.ms www.clarity.ms
n.clarity.ms
3 bat.bing.com news.sophos.com
bat.bing.com
3 stats.g.doubleclick.net 1 redirects news.sophos.com
2 c.clarity.ms 1 redirects
2 www.facebook.com news.sophos.com
2 segments.company-target.com 1 redirects news.sophos.com
2 match.prod.bidr.io 2 redirects
2 px.ads.linkedin.com 2 redirects
2 s.yimg.com news.sophos.com
s.yimg.com
2 connect.facebook.net news.sophos.com
connect.facebook.net
2 www.google.nl news.sophos.com
2 www.google.com 1 redirects news.sophos.com
2 www.googletagmanager.com news.sophos.com
www.googletagmanager.com
1 insight.adsrvr.org js.adsrvr.org
1 c.bing.com 1 redirects
1 www.clarity.ms bat.bing.com
1 googleads.g.doubleclick.net www.googleadservices.com
1 id.rlcdn.com news.sophos.com
1 api.company-target.com scripts.demandbase.com
1 sp.analytics.yahoo.com news.sophos.com
1 analytics.twitter.com news.sophos.com
1 t.co news.sophos.com
1 px4.ads.linkedin.com news.sophos.com
1 www.linkedin.com 1 redirects
1 q.quora.com news.sophos.com
1 www.googleadservices.com www.googletagmanager.com
1 js.adsrvr.org www.googletagmanager.com
1 a.quora.com news.sophos.com
1 static.ads-twitter.com news.sophos.com
1 scripts.demandbase.com news.sophos.com
1 snap.licdn.com news.sophos.com
1 pixel.wp.com news.sophos.com
1 img03.en25.com news.sophos.com
1 stats.wp.com news.sophos.com
1 cdn.jsdelivr.net news.sophos.com
1 s1777052651.t.eloqua.com 1 redirects
1 app.go.sophos.com 1 redirects
62 39
Subject Issuer Validity Valid
news.sophos.com
R3		 2022-05-27 -
2022-08-25		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-05-25 -
2022-08-17		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-06-02 -
2023-06-01		 a year crt.sh
*.wp.com
Sectigo RSA Domain Validation Secure Server CA		 2022-06-11 -
2023-07-12		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-05-25 -
2022-08-17		 3 months crt.sh
*.en25.com
DigiCert SHA2 Secure Server CA		 2021-09-14 -
2022-09-14		 a year crt.sh
www.bing.com
Microsoft RSA TLS CA 01		 2022-06-10 -
2022-12-10		 6 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2022-03-25 -
2022-06-23		 3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2022-03-01 -
2023-03-01		 a year crt.sh
tag.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2021-10-18 -
2022-10-14		 a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-21 -
2022-07-26		 a year crt.sh
quora.com
R3		 2022-05-29 -
2022-08-27		 3 months crt.sh
*.srv.stackadapt.com
Amazon		 2021-11-09 -
2022-12-07		 a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2022-03-31 -
2023-05-02		 a year crt.sh
*.api.fantasysports.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2022-06-13 -
2022-08-03		 2 months crt.sh
www.googleadservices.com
GTS CA 1C3		 2022-05-25 -
2022-08-17		 3 months crt.sh
*.quora.com
R3		 2022-05-29 -
2022-08-27		 3 months crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh
real.sp.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2022-03-15 -
2022-09-07		 6 months crt.sh
api.demandbase.com
Go Daddy Secure Certificate Authority - G2		 2021-10-20 -
2022-09-26		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2022-02-03 -
2023-02-25		 a year crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1		 2022-02-27 -
2023-02-27		 a year crt.sh
*.google.com
GTS CA 1C3		 2022-05-25 -
2022-08-17		 3 months crt.sh
*.google.nl
GTS CA 1C3		 2022-05-25 -
2022-08-17		 3 months crt.sh
a.clarity.ms
Microsoft Azure TLS Issuing CA 02		 2022-06-07 -
2023-06-02		 a year crt.sh

This page contains 2 frames:

Primary Page: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Frame ID: 662FC31DDC8BF66BB62E0EAC7CCC3F70
Requests: 61 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&upid=ql4fc2b&upv=1.1.0
Frame ID: 40CDC4AC225C3DE932C6D1EF502E26B1
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

The Active Adversary Playbook 2022 – Sophos News

Page URL History Show full URLs

  1. https://app.go.sophos.com/e/er?s=1777052651&lid=27900&elqTrackId=5bc54dcc835240e9b930dc03ad926a2f&elq=... HTTP 302
    https://s1777052651.t.eloqua.com/e/er?s=1777052651&lid=27900&elqTrackId=5bc54dcc835240e9b930dc03ad926a2f&elq=... HTTP 302
    https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <link rel="amphtml"
Overall confidence: 100%
Detected patterns
  • /alpine(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

62
Requests

94 %
HTTPS

39 %
IPv6

28
Domains

39
Subdomains

32
IPs

6
Countries

1312 kB
Transfer

2438 kB
Size

45
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://app.go.sophos.com/e/er?s=1777052651&lid=27900&elqTrackId=5bc54dcc835240e9b930dc03ad926a2f&elq=8e9adae561c3419e99d92bf3788b297e&elqaid=21535&elqat=1 HTTP 302
    https://s1777052651.t.eloqua.com/e/er?s=1777052651&lid=27900&elqTrackId=5bc54dcc835240e9b930dc03ad926a2f&elq=8e9adae561c3419e99d92bf3788b297e&elqaid=21535&elqat=1 HTTP 302
    https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 22
  • https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=456301056&utmhn=news.sophos.com&utme=8(4!CampaignID)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=The%20Active%20Adversary%20Playbook%202022%20%E2%80%93%20Sophos%20News&utmhid=1145364111&utmr=-&utmp=%2Fcorpblog%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&utmht=1655314922305&utmac=UA-737537-1&utmcc=__utma%3D1.1238801804.1655314922.1655314922.1655314922.1%3B%2B__utmz%3D1.1655314922.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1600056226&utmredir=3&utmu=q1CAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1238801804.1655314922&jid=1600056226&_v=5.7.2dc&z=456301056 HTTP 302
  • https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1238801804.1655314922&jid=1600056226&_v=5.7.2dc&z=456301056&slf_rd=1&random=1232456908
Request Chain 37
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1655314922399&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912 HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1655314922399%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-us%252F2022%252F06%252F07%252Factive-adversary-playbook-2022%252F%253Fcmp%253D146912%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1655314922399&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1655314922399&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&liSync=true&e_ipv6=AQJzxkxA8OH9GgAAAYFodT4cpMMOikX1sLQ9AcDNLHztLLCVnKNE9e6dzdpX-DyeO9GTs72ZTs9HK_d5aQ
Request Chain 45
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
  • https://segments.company-target.com/log?vendor=choca&user_id=AAGSi07FVDQAABPSjh67lw HTTP 303
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAGSi07FVDQAABPSjh67lw&verifyHash=cc46ea055ca1af2af27e28ef956c8c12264c8427
Request Chain 58
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?CtsSyncId=A5D92961DE164B859E8CE862BD126A80&RedC=c.clarity.ms&MXFR=382B553E30E86F92261944FA34E861D4 HTTP 302
  • https://c.clarity.ms/c.gif?CtsSyncId=A5D92961DE164B859E8CE862BD126A80&MUID=17A647B5081F6BD9371B5671092A6AD4

62 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/
Redirect Chain
  • https://app.go.sophos.com/e/er?s=1777052651&lid=27900&elqTrackId=5bc54dcc835240e9b930dc03ad926a2f&elq=8e9adae561c3419e99d92bf3788b297e&elqaid=21535&elqat=1
  • https://s1777052651.t.eloqua.com/e/er?s=1777052651&lid=27900&elqTrackId=5bc54dcc835240e9b930dc03ad926a2f&elq=8e9adae561c3419e99d92bf3788b297e&elqaid=21535&elqat=1
  • https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
90 KB
26 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx / WordPress VIP <https://wpvip.com>
Resource Hash
52aefd4188f6e5953c61d73e0a656e61fd46f4536284a743795dfc32e8e72f5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

accept-ranges
bytes
age
0
cache-control
max-age=300, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 15 Jun 2022 17:42:01 GMT
host-header
a9130478a60e5f9135f765b23f26593b
link
<https://news.sophos.com/wp-json/>; rel="https://api.w.org/" <https://news.sophos.com/wp-json/wp/v2/posts/84392>; rel="alternate"; type="application/json" <https://news.sophos.com/?p=84392>; rel=shortlink
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-cache
miss
x-hacker
If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by
WordPress VIP <https://wpvip.com>
x-rq
ams8 0 2 9980

Redirect headers

Cache-Control
no-store
Content-Length
200
Content-Type
text/html; charset=utf-8
Date
Wed, 15 Jun 2022 17:42:00 GMT
Expires
-1
Location
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
X-Robots-Tag
noindex, nofollow
X-Xss-Protection
1; mode=block
/
news.sophos.com/_static/ 		102 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://news.sophos.com/_static/??-eJyNj9EOwjAIRX/IDjW6N+O3dJRMlHZNYTH9e+vMku3NF5ILXC4H3tlxQpkDKaAqBFaDQSZ8OeGh+FJBrQp1kVPXFg6wdTwVIgX2JBQp2U5k8ZWKExo91v/sbbbVOxNOyZaI2WWZR04KSr7gA0i8GmMutP7/BSmtbRRcntTU/YgWEl3P3uPt1F8v577V4wc3dWL4
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
9125f042767f2d40744a6b3d4b4b668d8c3a5576a36c11d59211e649d9953a24
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
x-rq
ams8 0 2 9980
last-modified
Fri, 03 Jun 2022 13:07:30 GMT
server
nginx
age
74994
vary
Accept-Encoding
x-cache
hit
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-encoding
gzip
content-length
14708
/
news.sophos.com/_static/ 		139 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://news.sophos.com/_static/??/wp-content/themes/sophosnews-2017/style-2021.css,/wp-content/mu-plugins/jetpack-11.0/css/jetpack.css?m=1655257727
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
755fa48ed287c73834915e46d5c4f69b5c896921e4452bd8c1db667ce66f45f0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
x-rq
ams8 0 2 9980
last-modified
Wed, 15 Jun 2022 01:48:47 GMT
server
nginx
age
55071
vary
Accept-Encoding
x-cache
hit
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-encoding
gzip
content-length
25658
/
news.sophos.com/_static/ 		98 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://news.sophos.com/_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZebmaeXVayjj0+Rbm5melFiSSpUsX2uraGZqbGlsaWFiUUWAK+/IjA=
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
75839e3ea0cd949a33dc21dd8b0931f396829fea8e0e3148b576b1228f40e469
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
x-rq
ams8 0 2 9980
last-modified
Mon, 30 May 2022 19:44:08 GMT
server
nginx
age
78196
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-encoding
gzip
content-length
34312
sophos-news-banner-4-may-01-1.png
news.sophos.com/wp-content/uploads/2022/05/ 		283 KB
284 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://news.sophos.com/wp-content/uploads/2022/05/sophos-news-banner-4-may-01-1.png
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
fee1666a8c071d080bf2ba1f2251439544696171d45d545c1ac89cae3dc077b5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
x-rq
ams8 109 140 443
last-modified
Tue, 07 Jun 2022 11:29:07 GMT
server
nginx
etag
"212b904dfe526b42"
vary
Accept
x-cache
HIT
content-type
image/webp
cache-control
max-age=2592000
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
289924
expires
Wed, 07 Jun 2023 11:29:07 GMT
Category-Icon-Security-Operations@2x_r2.min_.png
news.sophos.com/wp-content/uploads/2021/06/ 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://news.sophos.com/wp-content/uploads/2021/06/Category-Icon-Security-Operations@2x_r2.min_.png
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b276efdcd262ee443ffb432b953eb94c8ae1e1624eee5f3409da02a48c5b768c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
x-rq
ams8 109 88 443
last-modified
Fri, 18 Jun 2021 15:00:03 GMT
server
nginx
etag
"3ae8b12b08d2fded"
strict-transport-security
max-age=31536000
x-cache
HIT
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
41607
expires
Sat, 17 Sep 2022 22:44:03 GMT
gtm.js
www.googletagmanager.com/ 		134 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e473a379c32edb65730c3d60f5da3946eebdecf83e875e0f58438e193058f579
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
content-encoding
br
vary
*
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
50879
x-xss-protection
0
pragma
no-cache
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 01 Jan 1990 00:00:00 GMT
wp-emoji-release.min.js
news.sophos.com/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://news.sophos.com/wp-includes/js/wp-emoji-release.min.js?ver=6.0
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
x-rq
ams8 0 2 9980
last-modified
Tue, 24 May 2022 20:46:42 GMT
server
nginx
age
1813324
etag
W/"628d4432-48b9"
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-encoding
gzip
content-length
5004
expires
Thu, 15 Jun 2023 17:42:02 GMT
john-shier.jpg
news.sophos.com/wp-content/uploads/2018/07/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://news.sophos.com/wp-content/uploads/2018/07/john-shier.jpg?w=360
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
974b4bba4529c45514b62149dfff53f27c6fec4e782acf0280ba04452fedbcd3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
x-rq
ams8 109 27 443
last-modified
Mon, 30 May 2022 15:44:16 GMT
server
nginx
etag
"4c905322800eeb40"
vary
Accept
x-cache
HIT
content-type
image/webp
cache-control
max-age=2592000
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
8190
expires
Tue, 30 May 2023 15:44:16 GMT
/
news.sophos.com/_static/ 		135 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://news.sophos.com/_static/??-eJyVjFEKwyAQBS9U1yoYv0rPIrIk2uqKu216/BpygQjva5h5em8qUhWsomXDgqyZ2kZccWdl78brzGNDoldC9bVgwQwAJ4DMN33pI1KfsPEnPfB1/0TwkfSer2IoLaS1ToctdKnYp7s1TCcHG9GzPMzinHXeW5//oLSgRw==
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a36c1b591e0a043aef36da97ac4da5a313386c35ad3c92eb558e13d0291f8eff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
x-rq
ams8 0 2 9980
last-modified
Wed, 15 Jun 2022 01:48:47 GMT
server
nginx
age
55071
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-encoding
gzip
content-length
38988
alpine.min.js
cdn.jsdelivr.net/gh/alpinejs/alpine@v2.8.1/dist/ 		26 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/alpinejs/alpine@v2.8.1/dist/alpine.min.js?ver=2.0.1
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
de9485aee0805fc555984a4286697dccb8a9762fa9240c6a47b4dd478d282e74
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
7460378
x-jsd-version
2.8.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra19139-FRA
timing-allow-origin
*
x-jsd-version-type
version
server
cloudflare
etag
W/"6964-M33llwtEtRbUwMPPG0SKpWL3vX8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SWxxylQBg4acIapvLMCkXZ7c0ypxJpAz2KP8Re4IjrOPFe%2FA04G1v7bSoIoVx%2Bl49MDfpS1NNz7abc0XjNOz6SS7buLwSPPiN198elhTCR728li5bpI0hmQJtOmIsK2QlPtWbBhVa%2F5nVYnh3DM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
cf-ray
71bd19978d3e91ef-FRA
comment-reply.min.js
news.sophos.com/wp-includes/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://news.sophos.com/wp-includes/js/comment-reply.min.js?m=1653939848g
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
x-rq
ams8 0 2 9980
last-modified
Mon, 30 May 2022 19:44:08 GMT
server
nginx
age
1374382
etag
W/"62951e88-ba5"
vary
Accept-Encoding
x-cache
hit
content-type
application/javascript
cache-control
max-age=31536000
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-encoding
gzip
content-length
1351
expires
Thu, 15 Jun 2023 17:42:02 GMT
e-202224.js
stats.wp.com/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/e-202224.js
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-nc
HIT ams
date
Wed, 15 Jun 2022 17:42:02 GMT
content-encoding
br
server
nginx
etag
W/"6197c5cf-3508"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Sun, 04 Jun 2023 23:32:48 GMT
SophosSans-Light.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Light.woff2
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/_static/??/wp-content/themes/sophosnews-2017/style-2021.css,/wp-content/mu-plugins/jetpack-11.0/css/jetpack.css?m=1655257727
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://news.sophos.com/_static/??/wp-content/themes/sophosnews-2017/style-2021.css,/wp-content/mu-plugins/jetpack-11.0/css/jetpack.css?m=1655257727
Origin
https://news.sophos.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
content-encoding
gzip
vary
X-Mobile-Class
age
0
x-cache
miss
content-length
25344
x-rq
ams8 0 2 9980
last-modified
Wed, 15 Jun 2022 01:48:47 GMT
server
nginx
etag
W/"62a93a7f-62e4"
strict-transport-security
max-age=31536000
access-control-allow-methods
GET, HEAD
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
expires
Thu, 15 Jun 2023 17:42:02 GMT
SophosSans-Medium.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Medium.woff2
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/_static/??/wp-content/themes/sophosnews-2017/style-2021.css,/wp-content/mu-plugins/jetpack-11.0/css/jetpack.css?m=1655257727
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://news.sophos.com/_static/??/wp-content/themes/sophosnews-2017/style-2021.css,/wp-content/mu-plugins/jetpack-11.0/css/jetpack.css?m=1655257727
Origin
https://news.sophos.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
content-encoding
gzip
vary
X-Mobile-Class
age
0
x-cache
miss
x-rq
ams8 0 2 9980
last-modified
Wed, 15 Jun 2022 01:48:47 GMT
server
nginx
etag
W/"62a93a7f-67a4"
strict-transport-security
max-age=31536000
access-control-allow-methods
GET, HEAD
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
expires
Thu, 15 Jun 2023 17:42:02 GMT
SophosSans-Semibold.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Semibold.woff2
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/_static/??/wp-content/themes/sophosnews-2017/style-2021.css,/wp-content/mu-plugins/jetpack-11.0/css/jetpack.css?m=1655257727
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f927844e8c953560f5a67112c5dfaab926df93df57f3d8cd062028f1ca80b530
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://news.sophos.com/_static/??/wp-content/themes/sophosnews-2017/style-2021.css,/wp-content/mu-plugins/jetpack-11.0/css/jetpack.css?m=1655257727
Origin
https://news.sophos.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
content-encoding
gzip
vary
X-Mobile-Class
age
0
x-cache
miss
content-length
26692
x-rq
ams8 0 2 9980
last-modified
Wed, 15 Jun 2022 01:48:47 GMT
server
nginx
etag
W/"62a93a7f-6828"
strict-transport-security
max-age=31536000
access-control-allow-methods
GET, HEAD
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
expires
Thu, 15 Jun 2023 17:42:02 GMT
aa-full-dashboard-anatomy-of-active-attacks-2022.png
news.sophos.com/wp-content/uploads/2022/06/ 		102 KB
102 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://news.sophos.com/wp-content/uploads/2022/06/aa-full-dashboard-anatomy-of-active-attacks-2022.png
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
c8ce6448e0dd18867f4db4ba91b9df83ba82a77b007606a3a561a8eb8a4336dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
x-rq
ams8 109 84 443
last-modified
Tue, 07 Jun 2022 11:29:07 GMT
server
nginx
etag
"a8e783db316e1984"
vary
Accept
x-cache
HIT
content-type
image/webp
cache-control
max-age=2592000
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
104768
expires
Wed, 07 Jun 2023 11:29:07 GMT
sophos-ransomware-web-banner-1200x628px-option-2.png
news.sophos.com/wp-content/uploads/2021/05/ 		166 KB
166 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://news.sophos.com/wp-content/uploads/2021/05/sophos-ransomware-web-banner-1200x628px-option-2.png?w=640
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d93cea00230540bc488dbe3afab54b37f88bd1b65aeb9bb576edaa7b8d0b4035
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
x-rq
ams8 109 139 443
last-modified
Tue, 24 May 2022 14:41:50 GMT
server
nginx
etag
"2275ec51bd886a14"
vary
Accept
x-cache
HIT
content-type
image/webp
cache-control
max-age=2592000
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
170202
expires
Wed, 24 May 2023 14:41:50 GMT
sophos-edr-news-blog-image-838x440px@2x.png
news.sophos.com/wp-content/uploads/2021/05/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://news.sophos.com/wp-content/uploads/2021/05/sophos-edr-news-blog-image-838x440px@2x.png?w=640
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1fa648f58cc0b3ce7d4574578aeb59038d1b5ddc00de3f568655be62a1d5c0ec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
x-rq
ams8 109 30 443
last-modified
Thu, 19 May 2022 14:57:09 GMT
server
nginx
etag
"54d7f4d83afaeaef"
vary
Accept
x-cache
HIT
content-type
image/webp
cache-control
max-age=2592000
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
21526
expires
Fri, 19 May 2023 14:57:09 GMT
sophos-xdr.png
news.sophos.com/wp-content/uploads/2021/05/ 		107 KB
107 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://news.sophos.com/wp-content/uploads/2021/05/sophos-xdr.png?w=640
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
56c4c9c31e9c4febdaaed356a15c9566084977d2a7a86842b14e9af3a71f9baa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
x-rq
ams8 109 140 443
last-modified
Tue, 10 May 2022 07:46:54 GMT
server
nginx
etag
"766f1aaa61418d0c"
vary
Accept
x-cache
HIT
content-type
image/webp
cache-control
max-age=2592000
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
109794
expires
Wed, 10 May 2023 07:46:54 GMT
dc.js
stats.g.doubleclick.net/ 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/dc.js
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/_static/??-eJyVjFEKwyAQBS9U1yoYv0rPIrIk2uqKu216/BpygQjva5h5em8qUhWsomXDgqyZ2kZccWdl78brzGNDoldC9bVgwQwAJ4DMN33pI1KfsPEnPfB1/0TwkfSer2IoLaS1ToctdKnYp7s1TCcHG9GzPMzinHXeW5//oLSgRw==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
7035
date
Wed, 15 Jun 2022 15:44:47 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17093
expires
Wed, 15 Jun 2022 17:44:47 GMT
elqCfg.min.js
img03.en25.com/i/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://img03.en25.com/i/elqCfg.min.js
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/_static/??-eJyVjFEKwyAQBS9U1yoYv0rPIrIk2uqKu216/BpygQjva5h5em8qUhWsomXDgqyZ2kZccWdl78brzGNDoldC9bVgwQwAJ4DMN33pI1KfsPEnPfB1/0TwkfSer2IoLaS1ToctdKnYp7s1TCcHG9GzPMzinHXeW5//oLSgRw==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
96.16.149.96 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a96-16-149-96.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Connection
keep-alive
Content-Length
2183
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Fri, 01 Apr 2022 14:38:56 GMT
Date
Wed, 15 Jun 2022 17:42:02 GMT
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
no-store
ETag
"d69c9437d645d81:0"
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Expires
Wed, 15 Jun 2022 17:42:02 GMT
g.gif
pixel.wp.com/ 		50 B
93 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=ext&j=1%3A11.0&blog=166161023&post=84392&tz=-4&srv=news.sophos.com&hp=vip&host=news.sophos.com&ref=&fcp=4321&rand=0.45014233302699447
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

access-control-allow-origin
*
date
Wed, 15 Jun 2022 17:42:02 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
ga-audiences
www.google.nl/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=456301056&utmhn=news.sophos.com&utme=8(4!CampaignID)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje...
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1238801804.1655314922&jid=1600056226&_v=5.7.2dc&z=456301056
  • https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1238801804.1655314922&jid=1600056226&_v=5.7.2dc&z=456301056&slf_rd=1&random=1232456908
42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1238801804.1655314922&jid=1600056226&_v=5.7.2dc&z=456301056&slf_rd=1&random=1232456908
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 15 Jun 2022 17:42:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 15 Jun 2022 17:42:02 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/html; charset=UTF-8
location
https://www.google.nl/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=1238801804.1655314922&jid=1600056226&_v=5.7.2dc&z=456301056&slf_rd=1&random=1232456908
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
__utm.gif
stats.g.doubleclick.net/r/ 		35 B
111 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1680966358&utmhn=news.sophos.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=The%20Active%20Adversary%20Playbook%202022%20%E2%80%93%20Sophos%20News&utmhid=1145364111&utmr=-&utmp=%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&utmht=1655314922308&utmac=UA-737537-53&utmcc=__utma%3D204943247.1614435301.1655314922.1655314922.1655314922.1%3B%2B__utmz%3D204943247.1655314922.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1779214120&utmredir=3&utmmt=1&utmu=q1CgAAAAAAAAAAAAAAAAAAgE~
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Wed, 15 Jun 2022 17:42:02 GMT
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		108 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-743773256
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
68c696553c269653dd61ded1734c45d70e1122d2b338a090070a6109c8f8ec59
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43310
x-xss-protection
0
last-modified
Wed, 15 Jun 2022 16:55:47 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 15 Jun 2022 17:42:02 GMT
bat.js
bat.bing.com/ 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e2db6493cc4a606dd658a7859c64d725083e1c463b38005a761bab49d9cf27d5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
last-modified
Mon, 13 Jun 2022 22:16:41 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B1C0260CEFE243978A487B8028D01A6C Ref B: AMSEDGE1012 Ref C: 2022-06-15T17:42:02Z
etag
"80ead641737fd81:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
date
Wed, 15 Jun 2022 17:42:02 GMT
accept-ranges
bytes
content-length
11353
fbevents.js
connect.facebook.net/en_US/ 		100 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
3d79854e01d0c79408c548889dcfddd23e4ef10f11c698c831b570573ee13b97
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
26344
x-xss-protection
0
pragma
public
x-fb-debug
e6QBU3oqfvZknaxWuwVUDFka4Y5ttqQif9Jl7cw+Mcy3xC3efLv0mXS1LvPd0b4EpT6nqm+6IqOC/ItWJY1SgQ==
x-fb-trip-id
686109401
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Wed, 15 Jun 2022 17:42:02 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Wed, 15 Jun 2022 17:42:02 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Apr 2022 23:25:22 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=51657
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3085
WuEFNglz.min.js
scripts.demandbase.com/ 		61 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://scripts.demandbase.com/WuEFNglz.min.js
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-87.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
821c1dba392245eac9a9d8709348b2e3dc9245eaeb40233a2f0d608060df20e0
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-amz-version-id
LCueR8U3D7lJgwCfemj1Slg2LluSXKrc
content-encoding
gzip
etag
W/"b068f44152e87ccb66f40491a735aad0"
age
1869
x-cache
Hit from cloudfront
vary
Accept-Encoding
last-modified
Thu, 17 Jun 2021 19:46:43 GMT
server
AmazonS3
date
Wed, 15 Jun 2022 17:11:46 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
via
1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
0RDRYUTCEgftSdWmxlIwHAqdSnUmbPwUkbFS2cWRjfD8kCe7c-QsEA==
uwt.js
static.ads-twitter.com/ 		49 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
05448e9440e5f8a66395d7d66a9bfcb9614a80e4e181f6347cd742ec36725ca6

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
content-encoding
gzip
last-modified
Wed, 08 Jun 2022 20:03:49 GMT
etag
"90b3a450b1a5741eca2aac717f3ebbc2+gzip+gzip"
vary
Accept-Encoding,Host
x-tw-cdn
FT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache
x-cache
HIT, HIT
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
13714
x-served-by
cache-iad-kiad7000130-IAD, cache-muc13957-MUC
qevents.js
a.quora.com/ 		40 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.quora.com/qevents.js
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a15bef5551f730c8269a1cba57c370099d559defd996193c80a477c411081ca2

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-amz-version-id
vyBstMTGyA6m5sV66zq8xsypUg.tAOk.
content-encoding
gzip
etag
"47078e63380c6b0cbbfb6d8508b25ee7"
age
5039
x-cache
HIT, HIT
content-length
14031
x-amz-id-2
Mt5ixruyZQMuz2hyMbp/KTbIH5giRHNsfo1OkmpT5XkJbFR2kZYpxLrrBKhfsMq5S8uY+UYjOac=
x-served-by
cache-iad-kiad7000165-IAD, cache-ams21059-AMS
last-modified
Fri, 18 Mar 2022 00:16:52 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
atime:1647562609/ctime:1647562609/gid:150037/gname:ezhang/md5:47078e63380c6b0cbbfb6d8508b25ee7/mode:33204/mtime:1647562609/uid:150037/uname:ezhang
x-timer
S1655314922.368039,VS0,VE0
date
Wed, 15 Jun 2022 17:42:02 GMT
vary
Accept-Encoding
x-amz-request-id
TA3D3A2BNPW868DS
via
1.1 varnish, 1.1 varnish
cache-control
max-age=7200
accept-ranges
bytes
content-type
text/plain
x-cache-hits
1, 493
events.js
tags.srv.stackadapt.com/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.srv.stackadapt.com/events.js
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.224.78.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-224-78-34.compute-1.amazonaws.com
Software
/
Resource Hash
430042a5a793bdad82730678ddf2b2d7bba63da5f12d456aa3ad1ae97ea0ca58

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 15 Jun 2022 17:42:02 GMT
Content-Encoding
gzip
Cache-Control
max-age=5
Content-Length
5398
Connection
keep-alive
Content-Type
text/javascript
up_loader.1.1.0.js
js.adsrvr.org/ 		4 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
143.204.94.161 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-94-161.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Wed, 15 Jun 2022 04:18:15 GMT
Via
1.1 32c8da10203574baccb74b8f771a7ffa.cloudfront.net (CloudFront)
Last-Modified
Thu, 24 Sep 2020 15:15:34 GMT
Server
AmazonS3
Age
48228
ETag
"98d98b3499058b76d58073cf8ede2f10"
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Connection
keep-alive
X-Amz-Cf-Pop
FRA50-C1
Accept-Ranges
bytes
Content-Length
4593
X-Amz-Cf-Id
XP_WsdUHc9V2jMg6X0kMtpZaYAK0SHGvCSbOWC5nP71klMrLkA9tAg==
ytc.js
s.yimg.com/wi/ 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/wi/ytc.js
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:37:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
301
x-amz-server-side-encryption
AES256
vary
Origin, Accept-Encoding
x-amz-request-id
STKS3WDNDSGM25BQ
x-amz-id-2
DaMCfdZ/8XCPFNTVs3dZSvGU3QaYRCwuXA5W/VcAtf2p9HN7JqFj4gKT2CV+QgrLBox35nIbrH4=
referrer-policy
no-referrer-when-downgrade
x-amz-expiration
expiry-date="Thu, 20 Jul 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified
Tue, 14 Jun 2022 12:21:31 GMT
server
ATS
etag
"6a624022b5d271dcefb070b0b6670abc-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
x-amz-version-id
.QD3nDfK79S8_ikLSJXTL23Tdis9tg0C
x-xss-protection
1; mode=block
cache-control
public,max-age=3600
accept-ranges
bytes
content-type
application/javascript
conversion_async.js
www.googleadservices.com/pagead/ 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-743773256
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f98.1e100.net
Software
cafe /
Resource Hash
33272713d84ffdaab3a61030b3c4cecca56a0f00485bd02767a96e61bc45452d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15000
x-xss-protection
0
server
cafe
etag
6069194915506431635
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Wed, 15 Jun 2022 17:42:02 GMT
pixel
q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/ 		43 B
421 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/pixel?j=1&u=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&tag=ViewContent&ts=1655314922387
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.81.239.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-81-239-179.compute-1.amazonaws.com
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Wed, 15 Jun 2022 17:42:02 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
X-Q-Stat
,df82581ffaa73cefae72ecfeb7e108fa,10.0.0.119,28838,95.211.95.248,,38357750240,1,1655314922.740,0.001,,.,0,0,0.000,0.000,-,0,0,197,121,60,10,34729,,,,,,-,
Content-Type
image/gif
10150886.json
s.yimg.com/wi/config/ 		46 B
683 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/wi/config/10150886.json
Requested by
Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
b2a1b0d77cb3505f23f6ca96316687b95376336a00822166c18c2808ced160eb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:28:54 GMT
x-content-type-options
nosniff
age
789
x-amz-server-side-encryption
AES256
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id
HQMW1V4BYPSZRAZT
x-amz-id-2
f+uGUx5aDamxXBh9qDuxZAMd7bdsrDW2Xhf/W1n58jC8azcPO7TS1NYYFyN7alMnx9zvXhYv8Qo=
accept-ranges
bytes
referrer-policy
no-referrer-when-downgrade
x-amz-expiration
expiry-date="Fri, 20 Jan 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified
Wed, 15 Dec 2021 05:54:05 GMT
server
ATS
etag
"3769bd8c10be070cf8c85c08517a8fdc"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=15552000
access-control-allow-methods
GET
x-amz-version-id
VO4i6Xctkzo3gjHc0HLprUqd6v7sNIpd
access-control-allow-origin
*
x-xss-protection
1; mode=block
content-length
46
content-type
application/octet-stream
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1655314922399&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1655314922399%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1655314922399&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&liSync=true
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1655314922399&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&liSync=tr...
0
482 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1655314922399&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&liSync=true&e_ipv6=AQJzxkxA8OH9GgAAAYFodT4cpMMOikX1sLQ9AcDNLHztLLCVnKNE9e6dzdpX-DyeO9GTs72ZTs9HK_d5aQ
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Server
13.107.43.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: BAB346510BF54DC6923F646E89DEBCC9 Ref B: VIEEDGE1415 Ref C: 2022-06-15T17:42:03Z
linkedin-action
1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
content-type
application/javascript
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
x-li-uuid
AAXhgAn+5Ku0z6BmNbl0Iw==
x-li-fabric
prod-lor1

Redirect headers

date
Wed, 15 Jun 2022 17:42:03 GMT
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 5EA286141C2641A182B76DBC78DF2C25 Ref B: VIEEDGE1310 Ref C: 2022-06-15T17:42:02Z
linkedin-action
1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric
prod-lor1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1655314922399&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&liSync=true&e_ipv6=AQJzxkxA8OH9GgAAAYFodT4cpMMOikX1sLQ9AcDNLHztLLCVnKNE9e6dzdpX-DyeO9GTs72ZTs9HK_d5aQ
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
x-li-uuid
AAXhgAn6VUWHLkh+Ulm2aQ==
4015302.js
bat.bing.com/p/action/ 		218 B
492 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/4015302.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ARR/3.0
Resource Hash
56972b0b14489f2809cd0cc25bdc00577cb8898b17cc33a827c3a6cc97ec3679
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 74940C1B09B34A058B89CCD7D0235E61 Ref B: AMSEDGE1012 Ref C: 2022-06-15T17:42:02Z
x-powered-by
ARR/3.0
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
private,max-age=60
date
Wed, 15 Jun 2022 17:42:02 GMT
content-length
299
0
bat.bing.com/action/ 		0
175 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=4015302&Ver=2&mid=be5c8b21-09a9-433d-a218-57e3fcce60e8&sid=76ec5ad0ecd211ecaa3743d39cc3b7c0&vid=76ec97f0ecd211ec8a5dddc71da35f6a&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=The%20Active%20Adversary%20Playbook%202022%20%E2%80%93%20Sophos%20News&p=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&r=&lt=4422&evt=pageLoad&msclkid=N&sv=1&rn=626818
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: AFC417E26F6E4BEAA2E893024682E26C Ref B: AMSEDGE1012 Ref C: 2022-06-15T17:42:02Z
date
Wed, 15 Jun 2022 17:42:02 GMT
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
334990480506518
connect.facebook.net/signals/config/ 		290 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/334990480506518?v=2.9.62&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
ff4e54f2d57334df8f621640587ce394703c9c88134d510853fc6174c309e7c4
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
84975
x-xss-protection
0
pragma
public
x-fb-debug
OI+KUSI9Q0DzsJfL8y+V+br82pxvDvcDqkcwkSNjSi0YHuksDc9cNWRaZNQjRCysgxUpCijVx9YP5jYskGaBfw==
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Wed, 15 Jun 2022 17:42:02 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
adsct
t.co/i/ 		43 B
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=c671565d-9509-461a-89cd-77932e82ed82&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&p_id=Twitter&p_user_id=0&pl_id=4fa010e7-7999-42b7-9b12-b6d1ed06336b&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4apa&type=javascript&version=2.3.20
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.69 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-response-time
105
date
Wed, 15 Jun 2022 17:42:01 GMT
server
tsa_o
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
365ee1d64ef7954841aaaa9b358d517aeb411544614a52c172a5b55d7e295846
content-length
43
adsct
analytics.twitter.com/i/ 		43 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=c671565d-9509-461a-89cd-77932e82ed82&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&p_id=Twitter&p_user_id=0&pl_id=4fa010e7-7999-42b7-9b12-b6d1ed06336b&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4apa&type=javascript&version=2.3.20
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-response-time
109
date
Wed, 15 Jun 2022 17:42:02 GMT
server
tsa_o
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
077958912770eb8e46287393e75b7c15eb2b188ab93e5252e4ff51b715d5f86a
content-length
43
sp.pl
sp.analytics.yahoo.com/ 		43 B
631 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Wed%2C%2015%20Jun%202022%2017%3A42%3A02%20GMT&n=0&b=The%20Active%20Adversary%20Playbook%202022%20%E2%80%93%20Sophos%20News&.yp=10150886&f=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&enc=UTF-8&yv=1.13.0&tagmgr=gtm
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
spdc.pbp.vip.ir2.yahoo.com
Software
ATS /
Resource Hash
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 15 Jun 2022 17:42:02 GMT
x-content-type-options
nosniff
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
cache-control
no-cache, private, must-revalidate
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security
max-age=31536000
accept-ranges
bytes
content-length
43
referrer-policy
strict-origin-when-cross-origin
expires
Wed, 15 Jun 2022 17:42:02 GMT
ip.json
api.company-target.com/api/v2/ 		453 B
944 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&page_title=The%20Active%20Adversary%20Playbook%202022%20%E2%80%93%20Sophos%20News&src=tag&key=f2514e2223f271de300b1908c2c90c911bed78d7
Requested by
Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/WuEFNglz.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-126.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
8c3cb99d09d80ed513743fc808e01c7c1a5b80e4b0fd06c20949610ab576ff8a

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
identification-source
CENTRAL
vary
Accept-Encoding, Origin
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
request-id
282a24c9-c2f7-43e5-815b-c041a83348ac
content-encoding
gzip
pragma
no-cache
access-control-allow-origin
https://news.sophos.com
server
nginx
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 1b73451818d2dd47a574604c0b84f692.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
tZqRlf3Wqfebx2qqOJdszKkfLriXL3nbppTlxS9q1ADE85-LC3Yrng==
expires
Tue, 14 Jun 2022 17:42:02 GMT
validateCookie
segments.company-target.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
  • https://segments.company-target.com/log?vendor=choca&user_id=AAGSi07FVDQAABPSjh67lw
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAGSi07FVDQAABPSjh67lw&verifyHash=cc46ea055ca1af2af27e28ef956c8c12264c8427
26 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAGSi07FVDQAABPSjh67lw&verifyHash=cc46ea055ca1af2af27e28ef956c8c12264c8427
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
HTTP/1.1
Server
143.204.89.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-30.fra50.r.cloudfront.net
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Wed, 15 Jun 2022 17:42:03 GMT
Via
1.1 bee9d99ac2913ec4167e166e6bdb691e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA50-C1
Vary
Origin
X-Cache
Miss from cloudfront
Content-Type
image/gif
Transfer-Encoding
chunked
Connection
keep-alive
trace-id
e6e982f6eb54cf55
X-Amz-Cf-Id
m-TpRP47R3cexx8esw4L-mWzKnEhLRShs6eVhhRulRsMyr0-gjGyAQ==

Redirect headers

Date
Wed, 15 Jun 2022 17:42:02 GMT
Via
1.1 bee9d99ac2913ec4167e166e6bdb691e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA50-C1
Vary
Origin
X-Cache
Miss from cloudfront
Location
/validateCookie?vendor=choca&user_id=AAGSi07FVDQAABPSjh67lw&verifyHash=cc46ea055ca1af2af27e28ef956c8c12264c8427
Connection
keep-alive
trace-id
f96e3d6273907375
Content-Length
0
X-Amz-Cf-Id
TSAwaEsYzzlQV2CmtbOYEe_4InJB_F-S45CcEbyHG67hUW94thI8dQ==
464526.gif
id.rlcdn.com/ 		0
98 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/464526.gif
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/?random=1655314922514&cv=9&fst=1655314922514&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa6d0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&tiba=The%20Active%20Adversary%20Playbook%202022%20%E2%80%93%20Sophos%20News&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9fc19758fcdabe621dd11d14bebb6b17460f629e7243963b48a1168aecac603c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 15 Jun 2022 17:42:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1100
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
297 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=334990480506518&ev=PageView&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&rl=&if=false&ts=1655314922546&sw=1600&sh=1200&v=2.9.62&r=stable&ec=0&o=30&fbp=fb.1.1655314922545.1126335986&it=1655314922420&coo=false&rqm=GET
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
44
expires
Wed, 15 Jun 2022 17:42:02 GMT
4015302
www.clarity.ms/tag/uet/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/tag/uet/4015302
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/p/action/4015302.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:27::cafe:1995 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
7e5c5876f45b312b7eedafeba0de12c9719697b66a920d75fc9d652152ee1bf7

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
x-powered-by
ASP.NET
x-azure-ref
06hmqYgAAAADcDtnTBwauR59wxaS/eSAVUEFSMDJFREdFMDYyMQA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
x-cache
CONFIG_NOCACHE
content-type
application/x-javascript
expires
-1
cache-control
no-cache, no-store
request-context
appId=cid-v1:e97341f6-8fff-46a6-9229-fbbfe0892c78
/
www.google.com/pagead/1p-user-list/743773256/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/743773256/?random=1655314922514&cv=9&fst=1655312400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa6d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&tiba=The%20Active%20Adversary%20Playbook%202022%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=2439257125&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 15 Jun 2022 17:42:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.nl/pagead/1p-user-list/743773256/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.nl/pagead/1p-user-list/743773256/?random=1655314922514&cv=9&fst=1655312400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa6d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&tiba=The%20Active%20Adversary%20Playbook%202022%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=2439257125&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 15 Jun 2022 17:42:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sa.css
tags.srv.stackadapt.com/ 		65 B
292 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://tags.srv.stackadapt.com/sa.css
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.224.78.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-224-78-34.compute-1.amazonaws.com
Software
/
Resource Hash
4d8474d2e663f8527a8fac10d712deb20f17cf3fff1b5138c2a5d919e4cc11be

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 15 Jun 2022 17:42:02 GMT
Cache-Control
only-if-cached, no-transform, private, max-age=7776000
Connection
keep-alive
Content-Length
65
Content-Type
text/css
sa.jpeg
tags.srv.stackadapt.com/ 		0
881 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.224.78.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-224-78-34.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 15 Jun 2022 17:42:03 GMT
Cache-Control
only-if-cached, no-transform, private, max-age=7776000
Connection
keep-alive
Content-Length
651
Content-Type
image/jpeg
clarity.js
n.clarity.ms/s/0.6.34/ 		53 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://n.clarity.ms/s/0.6.34/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/4015302
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.184.204.244 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:02 GMT
content-encoding
br
etag
"1d87e8642decc54"
last-modified
Sun, 12 Jun 2022 18:00:12 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public,max-age=86400
accept-ranges
bytes
request-context
appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2
/
www.facebook.com/tr/ 		44 B
91 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=334990480506518&ev=Microdata&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&rl=&if=false&ts=1655314923049&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22The%20Active%20Adversary%20Playbook%202022%20%E2%80%93%20Sophos%20News%22%7D&cd[OpenGraph]=%7B%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22The%20Active%20Adversary%20Playbook%202022%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%22%2C%22og%3Adescription%22%3A%22Cyberattacker%20behaviors%2C%20tactics%20and%20tools%20seen%20on%20the%20frontline%20of%20incident%20response%20during%202021%22%2C%22article%3Apublished_time%22%3A%222022-06-07T11%3A02%3A43%2B00%3A00%22%2C%22article%3Amodified_time%22%3A%222022-06-07T11%3A02%3A43%2B00%3A00%22%2C%22og%3Asite_name%22%3A%22Sophos%20News%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fwp-content%2Fuploads%2F2022%2F05%2Fsophos-news-banner-4-may-01-1.png%3Fw%3D640%22%2C%22og%3Aimage%3Asecure_url%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fwp-content%2Fuploads%2F2022%2F05%2Fsophos-news-banner-4-may-01-1.png%3Fw%3D640%22%2C%22og%3Aimage%3Awidth%22%3A%22640%22%2C%22og%3Aimage%3Aheight%22%3A%22335%22%2C%22og%3Aimage%3Aalt%22%3A%22%22%2C%22og%3Alocale%22%3A%22en_US%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.62&r=stable&ec=1&o=30&fbp=fb.1.1655314922545.1126335986&it=1655314922420&coo=false&es=automatic&tm=3&rqm=GET
Requested by
Host: news.sophos.com
URL: https://news.sophos.com/en-us/2022/06/07/active-adversary-playbook-2022/?cmp=146912
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Wed, 15 Jun 2022 17:42:03 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority
u=3,i
expires
Wed, 15 Jun 2022 17:42:03 GMT
saq_pxl
tags.srv.stackadapt.com/ 		94 B
397 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=uxMvfKEouJZfJzsjwRVn_Q&is_js=true&landing_url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&t=The%20Active%20Adversary%20Playbook%202022%20%E2%80%93%20Sophos%20News&tip=HDClWaDbnVgzK6s0yBwATMD0_uyrqcQeLR8F3o7KF1s&host=https://news.sophos.com&sa_conv_data_css_value=%20%220-704af28f-587f-429c-51b6-e3ae5e4b91f1%22&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd93e307855cd134f1463a6e0fbf9a9e1af5fd35ff8&sa-user-id-v2=s%253A0-704af28f-587f-429c-51b6-e3ae5e4b91f1%2524ip%252495.211.95.248.VPm1T38LiD6Kwe7jsQGhfB%252BkjY9o7x72LYHZVcaBRcM&sa-user-id=s%253A0-704af28f-587f-429c-51b6-e3ae5e4b91f1.1CXCThllcCOHXlOm9YJqcbX6jXBKR3zaAocs0ivr8Jk
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.224.78.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-224-78-34.compute-1.amazonaws.com
Software
/
Resource Hash
078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date
Wed, 15 Jun 2022 17:42:03 GMT
Access-Control-Allow-Methods
GET
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://news.sophos.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
94
collect
n.clarity.ms/ 		0
70 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://n.clarity.ms/collect
Requested by
Host: n.clarity.ms
URL: https://n.clarity.ms/s/0.6.34/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.184.204.244 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://news.sophos.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

access-control-allow-origin
https://news.sophos.com
date
Wed, 15 Jun 2022 17:42:02 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?CtsSyncId=A5D92961DE164B859E8CE862BD126A80&RedC=c.clarity.ms&MXFR=382B553E30E86F92261944FA34E861D4
  • https://c.clarity.ms/c.gif?CtsSyncId=A5D92961DE164B859E8CE862BD126A80&MUID=17A647B5081F6BD9371B5671092A6AD4
42 B
367 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.clarity.ms/c.gif?CtsSyncId=A5D92961DE164B859E8CE862BD126A80&MUID=17A647B5081F6BD9371B5671092A6AD4
Protocol
H2
Server
20.234.93.27 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://news.sophos.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 15 Jun 2022 17:42:03 GMT
last-modified
Fri, 20 May 2022 21:53:17 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
etag
"17a28a3946cd81:0"
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42

Redirect headers

pragma
no-cache
date
Wed, 15 Jun 2022 17:42:03 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 364A98B579584E1E895EB2ED96465D07 Ref B: AMSEDGE1012 Ref C: 2022-06-15T17:42:03Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c.clarity.ms/c.gif?CtsSyncId=A5D92961DE164B859E8CE862BD126A80&MUID=17A647B5081F6BD9371B5671092A6AD4
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
up
insight.adsrvr.org/track/ Frame 40CD 		0
182 B 		Document
General
Check archive.org
Download Go to
Full URL
https://insight.adsrvr.org/track/up?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2022%2F06%2F07%2Factive-adversary-playbook-2022%2F%3Fcmp%3D146912&upid=ql4fc2b&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://news.sophos.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

cache-control
private,no-cache, must-revalidate
content-type
text/html
date
Wed, 15 Jun 2022 17:42:03 GMT
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma
no-cache
x-aspnet-version
4.0.30319
collect
n.clarity.ms/ 		0
48 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://n.clarity.ms/collect
Requested by
Host: n.clarity.ms
URL: https://n.clarity.ms/s/0.6.34/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.184.204.244 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://news.sophos.com/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

access-control-allow-origin
https://news.sophos.com
date
Wed, 15 Jun 2022 17:42:03 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2

Verdicts & Comments Add Verdict or Comment

72 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation object| dataLayer object| _wpemojiSettings undefined| $ function| jQuery object| PG8Data object| PG8 object| Sophos function| Cookies object| Stickyfill function| Spinner function| Tether function| Drop object| _gaq object| twemoji object| wp object| Alpine object| addComment object| _stq function| st_go function| linktracker_init object| wpcom function| postscribe object| google_tag_manager_external object| google_tag_manager object| _gat object| gaGlobal object| google_tag_data object| uetq function| fbq function| _fbq string| _linkedin_partner_id object| _linkedin_data_partner_ids function| twq function| qp function| saq function| _saq object| dotq object| _elqQ object| _elq function| gtag object| qevents object| YAHOO function| lintrk boolean| _already_called_lintrk function| ttd_dom_ready function| TTDUniversalPixelApi function| UET function| UET_init function| UET_push object| ueto_ba516f5a8a object| regeneratorRuntime object| twttr function| __extends object| Demandbase object| __db function| DBSegment function| ga function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO function| clarity object| res object| saCookies string| current_window_url_param

45 Cookies

Domain/Path Name / Value
.eloqua.com/ Name: ELOQUA
Value: GUID=20C6F87F6BCA4F5BBCB84488AA471C71
.eloqua.com/ Name: ELQSTATUS
Value: OK
.sophos.com/ Name: CampaignID
Value: 146912
.sophos.com/ Name: __utma
Value: 1.1238801804.1655314922.1655314922.1655314922.1
.sophos.com/ Name: __utmc
Value: 1
.sophos.com/ Name: __utmz
Value: 1.1655314922.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.sophos.com/ Name: __utmt
Value: 1
.sophos.com/ Name: __utmb
Value: 1.1.10.1655314922
.news.sophos.com/ Name: __utma
Value: 204943247.1614435301.1655314922.1655314922.1655314922.1
.news.sophos.com/ Name: __utmc
Value: 204943247
.news.sophos.com/ Name: __utmz
Value: 204943247.1655314922.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.news.sophos.com/ Name: __utmt_news
Value: 1
.news.sophos.com/ Name: __utmb
Value: 204943247.1.10.1655314922
.sophos.com/ Name: _gcl_au
Value: 1.1.1234095247.1655314922
.bing.com/ Name: MUID
Value: 17A647B5081F6BD9371B5671092A6AD4
.sophos.com/ Name: _uetsid
Value: 76ec5ad0ecd211ecaa3743d39cc3b7c0
.sophos.com/ Name: _uetvid
Value: 76ec97f0ecd211ec8a5dddc71da35f6a
.sophos.com/ Name: _fbp
Value: fb.1.1655314922545.1126335986
.yahoo.com/ Name: A3
Value: d=AQABBOoZqmICEKF0CVsbhjk428lodVwe7rQFEgEBAQFrq2KzYgAAAAAA_eMAAA&S=AQAAAlt8ts6F34Mamm3oOGmNb0k
.t.co/ Name: muc_ads
Value: 18a193de-8536-43e7-b161-fc0d75ac3e18
.twitter.com/ Name: personalization_id
Value: "v1_6DsKcgxPM/a1iFB1YU4xtQ=="
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.bidr.io/ Name: bito
Value: AAGSi07FVDQAABPSjh67lw
.bidr.io/ Name: bitoIsSecure
Value: ok
.linkedin.com/ Name: UserMatchHistory
Value: AQID_DSjuNHrQAAAAYFodTxhDcFgAf8llsbaOzTsWJGUZJIKi3ZrBwGBRe5RAfQ_EO5ys8L9o16DRw
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQKNcOyij2kXIAAAAYFodTxhN2Adpi1g0Jsd2dxO0YezLg6cnNXWubgqn05L-biPV2aza-aUMJK71HbP_stTWQ
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&d3fe5a8a-d843-4e54-8a54-01fba90cfed6"
.linkedin.com/ Name: lidc
Value: "b=OGST09:s=O:r=O:a=O:p=O:g=2277:u=1:x=1:i=1655314922:t=1655401322:v=2:sig=AQEHRwQ6mo4eLX2KsA7PbS5v6fJ01TXg"
tags.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-704af28f-587f-429c-51b6-e3ae5e4b91f1.1CXCThllcCOHXlOm9YJqcbX6jXBKR3zaAocs0ivr8Jk
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AcEryj1h_QpxRtuOuXkuR8V_TX_g.mvXTK9amQp9Gz70zstmwwEx0ftfsQlN1A73f5u9k338
news.sophos.com/ Name: sa-user-id
Value: s%253A0-704af28f-587f-429c-51b6-e3ae5e4b91f1.1CXCThllcCOHXlOm9YJqcbX6jXBKR3zaAocs0ivr8Jk
news.sophos.com/ Name: sa-user-id-v2
Value: s%253A0-704af28f-587f-429c-51b6-e3ae5e4b91f1%2524ip%252495.211.95.248.VPm1T38LiD6Kwe7jsQGhfB%252BkjY9o7x72LYHZVcaBRcM
www.clarity.ms/ Name: CLID
Value: fefa2a89d1304327a28e67c7d6af1de9.20220615.20230615
.company-target.com/ Name: tuuid
Value: 76a0044e-9a2e-4e6d-b77d-88445a2460e1
.company-target.com/ Name: tuuid_lu
Value: 1655314922
.linkedin.com/ Name: lang
Value: v=2&lang=nl-nl
.www.linkedin.com/ Name: bscookie
Value: "v=1&202206151742024bd0f02c-5cb7-4948-8db8-197dad531248AQFnepOx9WZPeaHHVbeR2MyqlMeoFHdt"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NTUzMTQ5MjI7MjswMjH3hjiYZJVw4wSaK0X06x+kDG2EvHMGYzObkfrnfpixlQ==
.sophos.com/ Name: _clck
Value: 1oqai88|1|f2c|0
.c.bing.com/ Name: SRM_B
Value: 17A647B5081F6BD9371B5671092A6AD4
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 17A647B5081F6BD9371B5671092A6AD4
.c.clarity.ms/ Name: ANONCHK
Value: 0
.sophos.com/ Name: _clsk
Value: uy1y5r|1655314923612|1|1|n.clarity.ms/collect

1 Console Messages

Source Level URL
Text
network error URL: https://id.rlcdn.com/464526.gif
Message:
Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.quora.com
analytics.twitter.com
api.company-target.com
app.go.sophos.com
bat.bing.com
c.bing.com
c.clarity.ms
cdn.jsdelivr.net
connect.facebook.net
googleads.g.doubleclick.net
id.rlcdn.com
img03.en25.com
insight.adsrvr.org
js.adsrvr.org
match.prod.bidr.io
n.clarity.ms
news.sophos.com
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
s.yimg.com
s1777052651.t.eloqua.com
scripts.demandbase.com
segments.company-target.com
snap.licdn.com
sp.analytics.yahoo.com
static.ads-twitter.com
stats.g.doubleclick.net
stats.wp.com
t.co
tags.srv.stackadapt.com
www.clarity.ms
www.facebook.com
www.google.com
www.google.nl
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
104.244.42.195
104.244.42.69
13.107.43.14
143.204.89.126
143.204.89.30
143.204.89.87
143.204.94.161
151.101.129.2
172.217.23.98
192.0.76.3
192.29.201.5
192.29.202.14
199.232.188.157
20.234.93.27
212.82.100.181
2606:4700::6810:5714
2620:1ec:22::14
2620:1ec:27::cafe:1995
2620:1ec:c11::200
2a00:1288:80:807::1
2a00:1450:4001:803::2004
2a00:1450:4001:809::2008
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::2002
2a00:1450:400c:c00::9b
2a02:26f0:3500:16::215:14a0
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
2a04:fa87:fffd::c000:42c8
3.224.78.34
35.244.174.68
52.184.204.244
52.223.40.198
52.50.60.18
54.81.239.179
96.16.149.96
05448e9440e5f8a66395d7d66a9bfcb9614a80e4e181f6347cd742ec36725ca6
078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
1fa648f58cc0b3ce7d4574578aeb59038d1b5ddc00de3f568655be62a1d5c0ec
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
33272713d84ffdaab3a61030b3c4cecca56a0f00485bd02767a96e61bc45452d
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3d79854e01d0c79408c548889dcfddd23e4ef10f11c698c831b570573ee13b97
430042a5a793bdad82730678ddf2b2d7bba63da5f12d456aa3ad1ae97ea0ca58
4d8474d2e663f8527a8fac10d712deb20f17cf3fff1b5138c2a5d919e4cc11be
52aefd4188f6e5953c61d73e0a656e61fd46f4536284a743795dfc32e8e72f5a
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
56972b0b14489f2809cd0cc25bdc00577cb8898b17cc33a827c3a6cc97ec3679
56c4c9c31e9c4febdaaed356a15c9566084977d2a7a86842b14e9af3a71f9baa
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
68c696553c269653dd61ded1734c45d70e1122d2b338a090070a6109c8f8ec59
755fa48ed287c73834915e46d5c4f69b5c896921e4452bd8c1db667ce66f45f0
75839e3ea0cd949a33dc21dd8b0931f396829fea8e0e3148b576b1228f40e469
7e5c5876f45b312b7eedafeba0de12c9719697b66a920d75fc9d652152ee1bf7
821c1dba392245eac9a9d8709348b2e3dc9245eaeb40233a2f0d608060df20e0
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8c3cb99d09d80ed513743fc808e01c7c1a5b80e4b0fd06c20949610ab576ff8a
9125f042767f2d40744a6b3d4b4b668d8c3a5576a36c11d59211e649d9953a24
974b4bba4529c45514b62149dfff53f27c6fec4e782acf0280ba04452fedbcd3
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9fc19758fcdabe621dd11d14bebb6b17460f629e7243963b48a1168aecac603c
a15bef5551f730c8269a1cba57c370099d559defd996193c80a477c411081ca2
a36c1b591e0a043aef36da97ac4da5a313386c35ad3c92eb558e13d0291f8eff
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b276efdcd262ee443ffb432b953eb94c8ae1e1624eee5f3409da02a48c5b768c
b2a1b0d77cb3505f23f6ca96316687b95376336a00822166c18c2808ced160eb
c8ce6448e0dd18867f4db4ba91b9df83ba82a77b007606a3a561a8eb8a4336dd
ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa
d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe
d93cea00230540bc488dbe3afab54b37f88bd1b65aeb9bb576edaa7b8d0b4035
de9485aee0805fc555984a4286697dccb8a9762fa9240c6a47b4dd478d282e74
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
e2db6493cc4a606dd658a7859c64d725083e1c463b38005a761bab49d9cf27d5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e473a379c32edb65730c3d60f5da3946eebdecf83e875e0f58438e193058f579
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631
f927844e8c953560f5a67112c5dfaab926df93df57f3d8cd062028f1ca80b530
fee1666a8c071d080bf2ba1f2251439544696171d45d545c1ac89cae3dc077b5
ff4e54f2d57334df8f621640587ce394703c9c88134d510853fc6174c309e7c4