urlscan.io logo urlscan.io
SecurityTrails logo

www.reuters.com Open in urlscan Pro
13.226.155.90  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-crimi...
Effective URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-crimi...
Submission: On August 12 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 62 IPs in 11 countries across 43 domains to perform 244 HTTP transactions. The main IP is 13.226.155.90, located in Seattle, United States and belongs to AMAZON-02, US. The main domain is www.reuters.com.
TLS certificate: Issued by Amazon on March 4th 2020. Valid for: a year.
This is the only time www.reuters.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 13.226.155.90 16509 (AMAZON-02)
11 13.226.155.30 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
2 2600:9000:218... 16509 (AMAZON-02)
1 2600:9000:218... 16509 (AMAZON-02)
5 13.226.155.87 16509 (AMAZON-02)
6 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
5 104.111.252.228 16625 (AKAMAI-AS)
1 2406:da00:ff0... 14618 (AMAZON-AES)
1 13.226.155.11 16509 (AMAZON-02)
1 13.226.145.149 16509 (AMAZON-02)
11 104.18.22.230 13335 (CLOUDFLAR...)
1 2a04:4e42:1b:... 54113 (FASTLY)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
3 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 52.72.36.5 14618 (AMAZON-AES)
1 3 104.111.238.139 16625 (AKAMAI-AS)
1 35.201.93.216 15169 (GOOGLE)
1 2600:1f18:624... 14618 (AMAZON-AES)
7 2.18.235.93 16625 (AKAMAI-AS)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 52.49.59.93 16509 (AMAZON-02)
4 67.221.239.62 27467 (RACKMY-ST...)
1 2a02:2638::1c 44788 (ASN-CRITE...)
1 66.81.204.228 40034 (CONFLUENC...)
5 23.62.140.165 16625 (AKAMAI-AS)
2 18.202.86.190 16509 (AMAZON-02)
5 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
13 216.58.212.130 15169 (GOOGLE)
2 34.218.0.69 16509 (AMAZON-02)
2 2a03:2880:f11... 32934 (FACEBOOK)
2 2 2a00:1450:400... 15169 (GOOGLE)
3 4 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
10 52.215.102.72 16509 (AMAZON-02)
1 13.226.155.37 16509 (AMAZON-02)
1 34.197.178.4 14618 (AMAZON-AES)
1 2600:9000:218... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
9 2a00:1450:400... 15169 (GOOGLE)
10 37.157.2.237 198622 (ADFORM)
19 2.18.235.40 16625 (AKAMAI-AS)
1 6 151.101.114.137 54113 (FASTLY)
3 13.226.155.85 16509 (AMAZON-02)
5 2a00:1450:400... 15169 (GOOGLE)
20 37.157.5.72 198622 (ADFORM)
2 3.10.133.216 16509 (AMAZON-02)
6 2600:9000:218... 16509 (AMAZON-02)
5 3.128.233.190 16509 (AMAZON-02)
20 104.244.39.20 7415 (ADSAFE-1)
2 2a00:1450:400... 15169 (GOOGLE)
2 2 80.74.154.241 21069 (ASN-METAN...)
2 46.231.207.224 21069 (ASN-METAN...)
1 13.226.155.49 16509 (AMAZON-02)
2 13.226.155.115 16509 (AMAZON-02)
1 2 72.251.249.14 29791 (VOXEL-DOT...)
1 13.248.131.92 16509 (AMAZON-02)
244 62
3    13.226.155.90 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-90.dus51.r.cloudfront.net
www.reuters.com
11    13.226.155.30 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-30.dus51.r.cloudfront.net
static.reuters.com
1    2a00:1450:4001:815::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2001:4de0:ac19::1:b:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)
code.jquery.com
2    2600:9000:2182:3c00:18:1fcd:34e:d2a1 (United States)

ASN16509 (AMAZON-02, US)
static.chartbeat.com
1    2600:9000:2182:6c00:1e:ef1b:aa40:93a1 (United States)

ASN16509 (AMAZON-02, US)
queso-cdn.prod.reuters.tv
5    13.226.155.87 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-87.dus51.r.cloudfront.net
s3.reutersmedia.net
s4.reutersmedia.net
6    2a00:1450:4001:814::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:4001:81f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.youtube.com
5    104.111.252.228 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-252-228.deploy.static.akamaitechnologies.com
c.evidon.com
1    2406:da00:ff00::36eb:b8ea (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
usasync01.admantx.com
1    13.226.155.11 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-11.dus51.r.cloudfront.net
cdn.adsafeprotected.com
1    13.226.145.149 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-145-149.dus51.r.cloudfront.net
cdn.segment.com
11    104.18.22.230 (United States)

ASN13335 (CLOUDFLARENET, US)
www.dianomi.com
1    2a04:4e42:1b::714 (Ascension Island)

ASN54113 (FASTLY, US)
mab.chartbeat.com
2    2606:4700:20::ac43:4af5 (United States)

ASN13335 (CLOUDFLARENET, US)
tru.am
3    2606:4700::6811:b6b1 (United States)

ASN13335 (CLOUDFLARENET, US)
experience.tinypass.com
cdn.tinypass.com
1    2a00:1450:4001:819::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
s.ytimg.com
2    2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    2606:4700::6811:4f6b (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
3    52.72.36.5 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-36-5.compute-1.amazonaws.com
l.betrad.com
3    104.111.238.139 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-238-139.deploy.static.akamaitechnologies.com
sb.scorecardresearch.com
1    35.201.93.216 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 216.93.201.35.bc.googleusercontent.com
gwiqcdn.globalwebindex.net
1    2600:1f18:624f:b000:1a0c:44be:c431:52fe (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
sope.prod.reuters.tv
7    2.18.235.93 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-93.deploy.static.akamaitechnologies.com
contextual.media.net
cslogger.media.net
1    2606:4700:20::681a:274 (United States)

ASN13335 (CLOUDFLARENET, US)
beacon.tru.am
1    52.49.59.93 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-59-93.eu-west-1.compute.amazonaws.com
dpm.demdex.net
4    67.221.239.62 (United States)

ASN27467 (RACKMY-STL-AS1, US)
PTR: 67-221-239-62.www.allegiancetech.com
siteintercept.allegiancetech.com
1    2a02:2638::1c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
gum.criteo.com
1    66.81.204.228 (Virgin Islands (British))

ASN40034 (CONFLUENCE-NETWORK-INC, VG)
s.mnet-ad.net
5    23.62.140.165 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-62-140-165.deploy.static.akamaitechnologies.com
cdneu-xch.media.net
2    18.202.86.190 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-202-86-190.eu-west-1.compute.amazonaws.com
reuters.demdex.net
5    2a00:1450:4001:81a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
3    2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.de
adservice.google.com
pagead2.googlesyndication.com
13    216.58.212.130 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f130.1e100.net
securepubads.g.doubleclick.net
googleads.g.doubleclick.net
pagead2.googlesyndication.com
2    34.218.0.69 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-218-0-69.us-west-2.compute.amazonaws.com
api.segment.io
2    2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
2    2a00:1450:400c:c00::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
4    2a00:1450:4001:81c::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    2a00:1450:4001:81a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
10    52.215.102.72 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-102-72.eu-west-1.compute.amazonaws.com
pixel.adsafeprotected.com
1    13.226.155.37 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-37.dus51.r.cloudfront.net
get.s-onetag.com
1    34.197.178.4 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-197-178-4.compute-1.amazonaws.com
ping.chartbeat.net
1    2600:9000:2182:d000:5:9a4c:9b00:93a1 (United States)

ASN16509 (AMAZON-02, US)
beacon.s-onetag.com
1    2a00:1450:4001:819::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
7cfdd55c1a0273065026975cff5e535f.safeframe.googlesyndication.com
9    2a00:1450:4001:818::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
10    37.157.2.237 (Denmark)

ASN198622 (ADFORM, DK)
track.adform.net
19    2.18.235.40 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com
z.moatads.com
px.moatads.com
reutersdfpcw319687550988.s.moatpixel.com
6    151.101.114.137 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
cd.connatix.com
cds.connatix.com
vid.connatix.com
img.connatix.com
3    13.226.155.85 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-85.dus51.r.cloudfront.net
dfp-gateway.s-onetag.com
5    2a00:1450:4001:802::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
cdn.ampproject.org
20    37.157.5.72 (Denmark)

ASN198622 (ADFORM, DK)
s1.adform.net
2    3.10.133.216 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-10-133-216.eu-west-2.compute.amazonaws.com
geo.moatads.com
6    2600:9000:2182:6e00:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
static.adsafeprotected.com
5    3.128.233.190 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-128-233-190.us-east-2.compute.amazonaws.com
capi.connatix.com
20    104.244.39.20 (United States)

ASN7415 (ADSAFE-1, US)
PTR: amidt.adsafeprotected.com
dt.adsafeprotected.com
2    2a00:1450:4001:806::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
s0.2mdn.net
2    80.74.154.241 (Switzerland)

ASN21069 (ASN-METANET Routing/peering issues: noc@metanet.ch, CH)
balancer.sitebarad.com
2    46.231.207.224 (Bellach, Switzerland)

ASN21069 (ASN-METANET Routing/peering issues: noc@metanet.ch, CH)
pipe08.sitebarad.com
1    13.226.155.49 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-49.dus51.r.cloudfront.net
onetag-geo.s-onetag.com
2    13.226.155.115 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-115.dus51.r.cloudfront.net
onetag-geo-grouping.s-onetag.com
2    72.251.249.14 (Amsterdam, Netherlands)

ASN29791 (VOXEL-DOT-NET, US)
ap.lijit.com
1    13.248.131.92 (Seattle, United States)

ASN16509 (AMAZON-02, US)
metrics-collector.s-onetag.com
Apex Domain
Subdomains		 Transfer
37 adsafeprotected.com
cdn.adsafeprotected.com
pixel.adsafeprotected.com
static.adsafeprotected.com
dt.adsafeprotected.com
285 KB
30 adform.net
track.adform.net
s1.adform.net
351 KB
14 googlesyndication.com
7cfdd55c1a0273065026975cff5e535f.safeframe.googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
92 KB
14 reuters.com
www.reuters.com
static.reuters.com
616 KB
12 moatpixel.com
reutersdfpcw319687550988.s.moatpixel.com
3 KB
12 doubleclick.net
securepubads.g.doubleclick.net
stats.g.doubleclick.net
googleads.g.doubleclick.net
110 KB
12 media.net
contextual.media.net
cdneu-xch.media.net
cslogger.media.net
252 KB
11 connatix.com
cd.connatix.com
cds.connatix.com
capi.connatix.com
vid.connatix.com
img.connatix.com
233 KB
11 dianomi.com
www.dianomi.com
16 KB
9 moatads.com
z.moatads.com
geo.moatads.com
px.moatads.com
311 KB
9 s-onetag.com
get.s-onetag.com
beacon.s-onetag.com
dfp-gateway.s-onetag.com
onetag-geo.s-onetag.com
onetag-geo-grouping.s-onetag.com
metrics-collector.s-onetag.com
24 KB
6 google-analytics.com
www.google-analytics.com
78 KB
5 ampproject.org
cdn.ampproject.org
109 KB
5 google.com
adservice.google.com
www.google.com
1 KB
5 googletagservices.com
www.googletagservices.com
129 KB
5 evidon.com
c.evidon.com
28 KB
5 reutersmedia.net
s3.reutersmedia.net
s4.reutersmedia.net
87 KB
4 sitebarad.com
balancer.sitebarad.com
pipe08.sitebarad.com
2 MB
4 allegiancetech.com
siteintercept.allegiancetech.com
135 KB
3 google.de
adservice.google.de
www.google.de
1 KB
3 demdex.net
dpm.demdex.net
reuters.demdex.net
6 KB
3 scorecardresearch.com
sb.scorecardresearch.com
3 KB
3 betrad.com
l.betrad.com
360 B
3 tinypass.com
experience.tinypass.com
cdn.tinypass.com
124 KB
3 tru.am
tru.am
beacon.tru.am
13 KB
3 chartbeat.com
static.chartbeat.com
mab.chartbeat.com
32 KB
2 lijit.com
ap.lijit.com
1006 B
2 2mdn.net
s0.2mdn.net
96 KB
2 facebook.com
www.facebook.com
348 B
2 segment.io
api.segment.io
282 B
2 facebook.net
connect.facebook.net
167 KB
2 reuters.tv
queso-cdn.prod.reuters.tv
sope.prod.reuters.tv
26 KB
1 chartbeat.net
ping.chartbeat.net
168 B
1 mnet-ad.net
s.mnet-ad.net
356 B
1 criteo.com
gum.criteo.com
380 B
1 globalwebindex.net
gwiqcdn.globalwebindex.net
6 KB
1 cloudflare.com
cdnjs.cloudflare.com
3 KB
1 ytimg.com
s.ytimg.com
33 KB
1 segment.com
cdn.segment.com
96 KB
1 admantx.com
usasync01.admantx.com
663 B
1 youtube.com
www.youtube.com
1 KB
1 jquery.com
code.jquery.com
30 KB
1 googletagmanager.com
www.googletagmanager.com
91 KB
244 43
Domain Requested by
20 dt.adsafeprotected.com
20 s1.adform.net track.adform.net
s1.adform.net
www.reuters.com
12 reutersdfpcw319687550988.s.moatpixel.com
11 www.dianomi.com static.reuters.com
www.dianomi.com
www.reuters.com
11 static.reuters.com www.reuters.com
10 track.adform.net securepubads.g.doubleclick.net
s1.adform.net
10 pixel.adsafeprotected.com cdn.adsafeprotected.com
www.reuters.com
9 tpc.googlesyndication.com securepubads.g.doubleclick.net
www.reuters.com
tpc.googlesyndication.com
cdn.ampproject.org
9 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
www.reuters.com
6 static.adsafeprotected.com pixel.adsafeprotected.com
www.reuters.com
6 contextual.media.net static.reuters.com
contextual.media.net
www.reuters.com
6 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
www.reuters.com
5 capi.connatix.com cds.connatix.com
5 cdn.ampproject.org securepubads.g.doubleclick.net
5 www.googletagservices.com contextual.media.net
securepubads.g.doubleclick.net
5 cdneu-xch.media.net www.reuters.com
5 c.evidon.com static.reuters.com
c.evidon.com
4 px.moatads.com
4 pagead2.googlesyndication.com securepubads.g.doubleclick.net
4 www.google.com 3 redirects www.reuters.com
4 siteintercept.allegiancetech.com www.googletagmanager.com
www.reuters.com
4 s3.reutersmedia.net www.reuters.com
3 dfp-gateway.s-onetag.com get.s-onetag.com
3 cds.connatix.com www.reuters.com
cds.connatix.com
3 z.moatads.com securepubads.g.doubleclick.net
3 sb.scorecardresearch.com 1 redirects www.reuters.com
3 l.betrad.com www.reuters.com
3 www.reuters.com static.reuters.com
www.googletagmanager.com
2 ap.lijit.com 1 redirects
2 onetag-geo-grouping.s-onetag.com beacon.s-onetag.com
2 pipe08.sitebarad.com www.reuters.com
2 balancer.sitebarad.com 2 redirects
2 s0.2mdn.net s1.adform.net
2 geo.moatads.com z.moatads.com
2 www.google.de www.reuters.com
2 stats.g.doubleclick.net 2 redirects
2 www.facebook.com www.reuters.com
connect.facebook.net
2 api.segment.io cdn.segment.com
2 reuters.demdex.net www.reuters.com
2 connect.facebook.net cdn.segment.com
connect.facebook.net
2 experience.tinypass.com www.reuters.com
cdn.tinypass.com
2 tru.am www.googletagmanager.com
tru.am
2 static.chartbeat.com www.reuters.com
1 metrics-collector.s-onetag.com beacon.s-onetag.com
1 onetag-geo.s-onetag.com beacon.s-onetag.com
1 img.connatix.com
1 vid.connatix.com cds.connatix.com
1 googleads.g.doubleclick.net
1 cd.connatix.com 1 redirects
1 7cfdd55c1a0273065026975cff5e535f.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 beacon.s-onetag.com get.s-onetag.com
1 ping.chartbeat.net
1 get.s-onetag.com www.googletagmanager.com
1 adservice.google.com www.googletagservices.com
1 adservice.google.de www.googletagservices.com
1 cslogger.media.net www.reuters.com
1 s.mnet-ad.net www.reuters.com
1 gum.criteo.com contextual.media.net
1 dpm.demdex.net www.reuters.com
1 beacon.tru.am tru.am
1 sope.prod.reuters.tv static.reuters.com
1 gwiqcdn.globalwebindex.net www.reuters.com
1 cdnjs.cloudflare.com www.dianomi.com
1 cdn.tinypass.com experience.tinypass.com
1 s.ytimg.com www.youtube.com
1 mab.chartbeat.com static.chartbeat.com
1 cdn.segment.com www.reuters.com
1 cdn.adsafeprotected.com static.reuters.com
1 usasync01.admantx.com static.reuters.com
1 www.youtube.com www.reuters.com
1 s4.reutersmedia.net www.reuters.com
1 queso-cdn.prod.reuters.tv www.reuters.com
1 code.jquery.com www.reuters.com
1 www.googletagmanager.com www.reuters.com
244 74
Subject Issuer Validity Valid
www.reuters.com
Amazon		 2020-03-04 -
2021-04-04		 a year crt.sh
static.reuters.com
Amazon		 2019-11-25 -
2020-12-25		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-07-15 -
2020-10-07		 3 months crt.sh
jquery.org
COMODO RSA Domain Validation Secure Server CA		 2018-10-17 -
2020-10-16		 2 years crt.sh
*.chartbeat.com
Thawte RSA CA 2018		 2020-06-01 -
2021-06-02		 a year crt.sh
*.prod.reuters.tv
Amazon		 2019-12-31 -
2021-01-31		 a year crt.sh
*.google.com
GTS CA 1O1		 2020-07-15 -
2020-10-07		 3 months crt.sh
*.evidon.com
DigiCert Secure Site ECC CA-1		 2020-04-29 -
2021-07-29		 a year crt.sh
*.admantx.com
SSL.com RSA SSL subCA		 2019-03-29 -
2021-06-25		 2 years crt.sh
*.adsafeprotected.com
COMODO RSA Domain Validation Secure Server CA		 2018-08-20 -
2020-09-17		 2 years crt.sh
*.segment.com
DigiCert SHA2 Secure Server CA		 2020-06-12 -
2021-07-27		 a year crt.sh
dianomi.com
Cloudflare Inc ECC CA-3		 2020-07-02 -
2021-07-02		 a year crt.sh
f6.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2020-06-13 -
2021-04-24		 10 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-07-20 -
2021-07-20		 a year crt.sh
ssl802628.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2020-05-20 -
2020-11-26		 6 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-07-21 -
2020-10-12		 3 months crt.sh
cdnjs.cloudflare.com
DigiCert ECC Secure Server CA		 2020-08-12 -
2022-08-17		 2 years crt.sh
l.betrad.com
Go Daddy Secure Certificate Authority - G2		 2019-04-25 -
2021-06-24		 2 years crt.sh
sb.scorecardresearch.com
DigiCert Secure Site ECC CA-1		 2020-07-17 -
2021-06-02		 a year crt.sh
*.globalwebindex.net
RapidSSL RSA CA 2018		 2017-12-13 -
2020-12-19		 3 years crt.sh
*.media.net
DigiCert SHA2 Secure Server CA		 2020-02-25 -
2021-05-26		 a year crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA		 2018-01-09 -
2021-02-12		 3 years crt.sh
*.allegiancetech.com
Go Daddy Secure Certificate Authority - G2		 2019-01-08 -
2021-03-07		 2 years crt.sh
*.criteo.com
DigiCert ECC Secure Server CA		 2020-06-22 -
2020-09-20		 3 months crt.sh
*.mnet-ad.net
Sectigo RSA Domain Validation Secure Server CA		 2020-04-06 -
2021-04-14		 a year crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2020-07-15 -
2020-10-07		 3 months crt.sh
*.google.de
GTS CA 1O1		 2020-07-15 -
2020-10-07		 3 months crt.sh
www.google.de
GTS CA 1O1		 2020-07-15 -
2020-10-07		 3 months crt.sh
fw.adsafeprotected.com
Amazon		 2020-03-14 -
2021-04-14		 a year crt.sh
*.s-onetag.com
Amazon		 2020-03-03 -
2021-04-03		 a year crt.sh
*.chartbeat.net
Thawte RSA CA 2018		 2019-12-16 -
2020-12-30		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1O1		 2020-07-15 -
2020-10-07		 3 months crt.sh
track.adform.net
DigiCert SHA2 Secure Server CA		 2019-09-16 -
2021-09-20		 2 years crt.sh
moatads.com
DigiCert SHA2 Secure Server CA		 2020-01-17 -
2021-03-17		 a year crt.sh
*.connatix.com
Go Daddy Secure Certificate Authority - G2		 2019-09-05 -
2020-10-19		 a year crt.sh
misc-sni.google.com
GTS CA 1O1		 2020-07-15 -
2020-10-07		 3 months crt.sh
www.google.com
GTS CA 1O1		 2020-07-15 -
2020-10-07		 3 months crt.sh
*.moatads.com
DigiCert SHA2 Secure Server CA		 2019-03-12 -
2021-06-10		 2 years crt.sh
static.adsafeprotected.com
Amazon		 2019-11-01 -
2020-12-01		 a year crt.sh
*.doubleclick.net
GTS CA 1O1		 2020-07-15 -
2020-10-07		 3 months crt.sh
pipe08.appenzell.net
Let's Encrypt Authority X3		 2020-07-01 -
2020-09-29		 3 months crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2020-03-11 -
2021-05-10		 a year crt.sh

This page contains 20 frames:

Primary Page: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Frame ID: 70CD75C2BA1CAF5A1A27B1E654E31056
Requests: 163 HTTP requests in this frame

Frame: https://www.dianomi.com/smartads.epl?id=4728&num_ads=5&shuffle=0&cf=545.4.Reuters%20Feed&url=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Frame ID: A719C14FE7771DB3102D981C0E98E9EE
Requests: 1 HTTP requests in this frame

Frame: https://www.dianomi.com/recirculation.epl?id=98&cf=545.4.Reuters%20Feed
Frame ID: 7C9C42748CF12B9B707528AA13544A0D
Requests: 1 HTTP requests in this frame

Frame: https://www.dianomi.com/recirculation.epl?id=99&start=6&cf=545.4.Reuters%20Feed
Frame ID: 04F05F68C48E3719C6837053B9C0ADDB
Requests: 1 HTTP requests in this frame

Frame: https://reuters.demdex.net/dest5.html?d_nsid=0
Frame ID: 3407FF18349E0B8282FE2A27E9AE5539
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8CUF1VN4G&prvid=3%2C23%2C28%2C29%2C33%2C38%2C41%2C51%2C54%2C56%2C59%2C69%2C72%2C74%2C76%2C77%2C80%2C82%2C84%2C97%2C106%2C108%2C109%2C113%2C117%2C118%2C122%2C126%2C138%2C139%2C141%2C145%2C147%2C159%2C172%2C173%2C174%2C175%2C178%2C182%2C184%2C188%2C193%2C201%2C203%2C208%2C214%2C222%2C225%2C226%2C3004%2C3007%2C3008%2C3010%2C3012%2C3014%2C3015%2C3017&rtime=782&https=1&usp_status=0&usp_consent=1
Frame ID: 36B00B92D49333CF931794DAC9B0EF09
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvwp1G4HVbjk2QMoFnzsLxMmY6BkAP37VdbOoBAHsMkQYItUVAYWd3CitivMZ5QbajDmk6M-MujWzYv01WV3y6EVRiNZV2DJXZrmzqvhNwhrg1s1G1UxR14_dSVTk3vifmFogQSxZQ1TyebPy-NqAn2oGb-jlr2mcu-rH9HdEa3pIj4pHDXHxowecqCwx90fgP7gc9WOLG1aVXZZ_33ERMFfQYjIBXMpyCqLZ-gZdMtLN0Ge6b9EUsLMEONKNfRE8aO2gdofybjiOGTp5Luhp3RwF3cvnjDqSkZWJ-LPSKsZQ&sig=Cg0ArKJSzP9UkEBcHoh3EAE&urlfix=1&adurl=
Frame ID: B407277EE8AE1576ED9149D5C9EB63EC
Requests: 13 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuKfvz4BpJcMw8JxT1ac-SqZUoQWABHnAa0nLEjQxNuih2rRuSqmvHcd22xpxiYvT9mqZG7nFxeHaN_nOQv10QGylfPoPTJgP2Si-Dm_kRPpV9gPRtQd9bsK7lXWiGo1n_DeDCGJr0AEqhx2dQEyO-0ZJnE859FiMe8RdFil2Xn6uHGkblWqO2Hk185yKNTrKXgf2kYaOKPx4asQvQNY11UOjgQb6Y4vXUvHZAPaY5GbldpRNxkavBAKYbdEEWI50722lGwXk58xdwtTqpbaqspEpsTd99C3EyerKI4EVvgPg&sig=Cg0ArKJSzFCO-2qqsivIEAE&urlfix=1&adurl=
Frame ID: 531BAE6B105AE5E15CCCE6804EE723CC
Requests: 13 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvX7A3FIwFLbChE_2-pA0491tc2tGl_JOQJ3yGCMVOV0qZAWKtVS-DCnMFqq7ca24zd4KzdJjwBSxzSyy4o-7eZHHhwG_FeIfO8eb8kktJOHznJzEsDFcZF2QodWa4Io4BltMDUXe2mICQM2XvgjnM_zvAFqw0KWLRqnuFihwcOJ8TJxk9bnxx7AKMiBzF2S50H-RV4wlngKVw1rmuspR7UkQYM1pAqOyARDQkQONfJwVfLyEIxc2oSKuyqhLazs8Iw1G8f2XkuTOYrsd1leqbD9kNz5IRxHReeE84U&sig=Cg0ArKJSzGniPlBoj1kMEAE&urlfix=1&adurl=
Frame ID: 8844516719E53DD6F6A58905DF87F71E
Requests: 7 HTTP requests in this frame

Frame: https://cds.connatix.com/p/44385/connatix.player.dc.js
Frame ID: 40AE57EAAA8A23EDB7DB7868AA8B4E16
Requests: 7 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012007302351000/amp4ads-v0.js
Frame ID: 6B324436EABCCE242CDC819453E04D0E
Requests: 15 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=10764&campId=1100x420&pubId=20159232&chanId=247866432&placementId=4806613891&pubCreative=138288736159&pubOrder=453477432&cb=339954935&custom=connatix&custom2=20000&custom3=0&adsafe_par&impId=
Frame ID: 3BCACE82DA031135777E5B68F5B07387
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: 294E91DE80B07F1185BF2BCFFA4CA3F5
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.4.114.js
Frame ID: 2E586845AF70A434FB0E8952143E71B5
Requests: 1 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=10764&campId=300x600&pubId=4822186048&chanId=247866432&placementId=5400724040&pubCreative=138315342570&pubOrder=2708662048&cb=803177988&custom=mpu&custom2=400&custom3=0&adsafe_par&impId=20dbd5c0-dce9-11ea-bb13-024bf4a6d028
Frame ID: D34D7110C378765EAC3CC174CCD4F514
Requests: 2 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=10764&campId=970x250&pubId=4822186048&chanId=247866432&placementId=5400723065&pubCreative=138315308411&pubOrder=2708662048&cb=340024628&custom=leaderboard&custom2=&custom3=0&adsafe_par&impId=20dbd5f3-dce9-11ea-ab9f-02c390e9b11a
Frame ID: B892406905C5A2D5FB351770814EE4A7
Requests: 2 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.4.114.js
Frame ID: E41793C7B9F940B32B94B6DA4D01A2F0
Requests: 1 HTTP requests in this frame

Frame: https://s1.adform.net/Banners/Elements/Files/6268/8259368/8259368.js?ADFassetID=8259368&bv=513
Frame ID: 5D8E44E8DAD20BA2FA284621C96AC463
Requests: 12 HTTP requests in this frame

Frame: https://s1.adform.net/Banners/Elements/Files/6268/8259383/8259383.js?ADFassetID=8259383&bv=513
Frame ID: CB85B727B1537F9AED837EFB0FCBF9EB
Requests: 10 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.4.114.js
Frame ID: 71AC072E65DE7B8CE4CF65D7782FE77B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

244
Requests

100 %
HTTPS

44 %
IPv6

43
Domains

74
Subdomains

62
IPs

11
Countries

5694 kB
Transfer

12539 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 65
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035630&ns__t=1597270441901&ns_c=UTF-8&cv=3.5&c8=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals%20-%20Reuters&c7=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035630&ns__t=1597270441901&ns_c=UTF-8&cv=3.5&c8=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals%20-%20Reuters&c7=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&c9=&cs_ak_ss=1
Request Chain 84
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j83&tid=UA-24152976-22&cid=385117900.1597270441&jid=511696037&gjid=2111920225&_gid=1221958855.1597270441&_u=aGDAiEAjR~&z=1487152758 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=385117900.1597270441&jid=511696037&_v=j83&z=1487152758 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=385117900.1597270441&jid=511696037&_v=j83&z=1487152758&slf_rd=1&random=3735091254
Request Chain 102
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j83&tid=UA-24152976-22&cid=385117900.1597270441&jid=89411162&gjid=1037336812&_gid=1221958855.1597270441&_u=aHDAiEAjR~&z=602098230 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=385117900.1597270441&jid=89411162&_v=j83&z=602098230 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=385117900.1597270441&jid=89411162&_v=j83&z=602098230&slf_rd=1&random=1711448837
Request Chain 122
  • https://cd.connatix.com/connatix.player.js HTTP 302
  • https://cds.connatix.com/p/44385/connatix.player.dc.js
Request Chain 144
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si
Request Chain 203
  • https://balancer.sitebarad.com/riverhost/Julius%20Baer/0042%20Smart%20Advertising/04_Video_Low_1x/vF300x600_JB_SmartAdvertising_Financial_en/vF300x600_Financial.mp4 HTTP 301
  • https://pipe08.sitebarad.com/riverhost/Julius%20Baer/0042%20Smart%20Advertising/04_Video_Low_1x/vF300x600_JB_SmartAdvertising_Financial_en/vF300x600_Financial.mp4
Request Chain 207
  • https://balancer.sitebarad.com/riverhost/Julius%20Baer/0042%20Smart%20Advertising/04_Video_Low_1x/vF970x250_JB_SmartAdvertising_Financial_en/vF970x250_Financial.mp4 HTTP 301
  • https://pipe08.sitebarad.com/riverhost/Julius%20Baer/0042%20Smart%20Advertising/04_Video_Low_1x/vF970x250_JB_SmartAdvertising_Financial_en/vF970x250_Financial.mp4
Request Chain 252
  • https://ap.lijit.com/readerinfo/v2 HTTP 307
  • https://ap.lijit.com/readerinfo/v2?sovrn_retry=true

244 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
www.reuters.com/article/us-cyber-cwt-ransom/ 		227 KB
58 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.90 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-90.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
124de9480f0ecb6fb87f250a4a270bc8b44c68fec2b1d198ef1f4954c8fb7b2e

Request headers

:method
GET
:authority
www.reuters.com
:scheme
https
:path
/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
content-type
text/html;charset=UTF-8
access-control-allow-headers
Access-Control-Allow-Origin,charset
access-control-allow-origin
http://admin.reuters.com
browser-expires
Wed, 12 Aug 2020 22:14:00 GMT
channel-name
RCOMUS_Cyberrisk
content-encoding
gzip
date
Wed, 12 Aug 2020 22:14:00 GMT
expires
Wed, 12 Aug 2020 22:29:00 GMT
last-updateda
Fri, 31 Jul 2020 15:03:18 GMT
server
nginx
vary
Accept-Encoding
x-cache
Miss from cloudfront
via
1.1 d0be2eec997f966c9c7eb03ae2f75c30.cloudfront.net (CloudFront)
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
x5oubAbN2uTRwlUs9NbMCzEyiL1-OiMsvQ600JP3-IGW9qtrlCkpFQ==
article.bundle.css
static.reuters.com/resources_v2/react/cookie-reset-b74/ 		149 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.reuters.com/resources_v2/react/cookie-reset-b74/article.bundle.css
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-30.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
6e198633e8651d2d219b18b644b77c8fac327d010d3d792be5d741f5bed10ff7

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 21:11:33 GMT
content-encoding
gzip
age
3759
x-cache
Hit from cloudfront
status
200
content-length
16066
last-modified
Thu, 06 Aug 2020 21:01:29 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
via
1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
cache-control
max-age=7200
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
x-amz-cf-id
qT-5hfcc8x8MdRyiqY-3UZ6KBYgesil8bufr-0kQzLw8ylWHQpx3Dw==
expires
Wed, 12 Aug 2020 23:11:21 GMT
common.bundle.css
static.reuters.com/resources_v2/react/cookie-reset-b74/ 		480 KB
279 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.css
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-30.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
631b052c0fac425fdea5a7a644d5e3554283675424c4c95003960e8fa96f6060

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:08:51 GMT
content-encoding
gzip
last-modified
Thu, 06 Aug 2020 21:01:34 GMT
server
nginx
age
309
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
status
200
cache-control
max-age=7200
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
x-amz-cf-id
rC6ponGj3hOFnuDX2u9tDB5oOmR_CP5an2lf1C_wCWwLkpGDl8UY6A==
via
1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
expires
Thu, 13 Aug 2020 00:08:51 GMT
gtm.js
www.googletagmanager.com/ 		314 KB
91 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-W9SLGS
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
05570487bb3f6249f82ffaaf817889dc909225f80ae76d6f0e6c864465b8304f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:00 GMT
content-encoding
br
vary
Accept-Encoding
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
93256
x-xss-protection
0
last-modified
Wed, 12 Aug 2020 21:52:18 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 12 Aug 2020 22:14:00 GMT
jquery-3.4.1.min.js
code.jquery.com/ 		86 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.4.1.min.js
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Origin
https://www.reuters.com

Response headers

date
Wed, 12 Aug 2020 22:14:00 GMT
content-encoding
gzip
last-modified
Wed, 01 May 2019 21:14:27 GMT
server
nginx
status
200
etag
W/"5cca0c33-15851"
vary
Accept-Encoding
x-hw
1597270440.dop160.fr8.t,1597270440.cds292.fr8.hn,1597270440.cds236.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30638
chartbeat_mab.js
static.chartbeat.com/js/ 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.chartbeat.com/js/chartbeat_mab.js
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2182:3c00:18:1fcd:34e:d2a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
c1acfa727754dab58bedc79995a642e235c6fde6449824c4fba4318fc060c91c

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 21:02:33 GMT
content-encoding
gzip
last-modified
Wed, 14 Aug 2019 01:44:12 GMT
server
nginx
age
4287
etag
W/"5d53676c-4a99"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=7200
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
6AOc4vAOwG69PySnZ4ukP6qZvnFIqUFcC3EzxJ9pX_tUaTaHOegVuQ==
via
1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
expires
Wed, 12 Aug 2020 23:02:33 GMT
embedder.bundle.js
queso-cdn.prod.reuters.tv/new/assets/ 		50 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://queso-cdn.prod.reuters.tv/new/assets/embedder.bundle.js
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2182:6c00:1e:ef1b:aa40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
b530d2f33467c65e254999ed904332bc40a5aa25c750229790295f6742938b6f

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:13:44 GMT
content-encoding
gzip
x-origin
i-0570fd7e0d298821a.queso.prod.us.reuters.tv
age
16
x-cache
Hit from cloudfront
status
200
access-control-allow-origin
*
last-modified
Tue, 10 Dec 2019 21:26:03 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5df00d6b-c6f0"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
via
1.1 c51e3be89c14e3f859ea898f7e36eced.cloudfront.net (CloudFront)
x-amz-cf-pop
DUS51-C1
access-control-allow-headers
connection, range, accept-encoding, user-agent, referer, content-type
x-amz-cf-id
g25mQmyUToucH60dyrHTl0h5rF2aWAYZJiu9ock3uTjt6NQUfJj2tg==
3aae9fd5da3557fba61d6444cb943643.png
static.reuters.com/resources_v2/react/cookie-reset-b74/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.reuters.com/resources_v2/react/cookie-reset-b74/3aae9fd5da3557fba61d6444cb943643.png
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-30.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
6346ee09058d555984eb04aac881775c926b5d9d4f73ca91493f7cb708ed90df

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 21:09:23 GMT
content-encoding
gzip
age
3904
x-cache
Hit from cloudfront
status
200
content-length
1539
last-modified
Thu, 06 Aug 2020 21:01:24 GMT
server
nginx
vary
Accept-Encoding
content-type
image/png
via
1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
x-amz-cf-id
Uag0bxN2k-Ipc9z1LqbVS6qbxctZXCNVfsPjBQRe_V4n_0_1E7zttg==
expires
Thu, 13 Aug 2020 21:08:56 GMT
/
s3.reutersmedia.net/resources/r/ 		687 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.reutersmedia.net/resources/r/?m=02&d=20200731&t=2&i=1527877045&r=LYNXNPEG6U1D5&w=20
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.87 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-87.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
b5771462426214dd38f38352be4e5018e2d479df771d17d87723969efab65a49

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
PXHk6IkLtD2pt0PIqdPJZ3WIZqK3k.av
via
1.1 9e627a2e7bf673974b02e3bf374bb843.cloudfront.net (CloudFront)
x-amz-expiration
expiry-date="Mon, 31 Aug 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified
Fri, 31 Jul 2020 15:03:45 GMT
server
nginx
age
51206
etag
"99ad09d534e9cd2cfa262e77d01586b5"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
date
Wed, 12 Aug 2020 08:00:34 GMT
x-amz-cf-pop
DUS51-C1
content-length
687
x-amz-cf-id
LRA9s8m4O-mD5OdR8MVtH9BJUHwj-krwyKAmCZdEpLlALo9gqyGQeg==
/
s4.reutersmedia.net/resources/r/ 		42 KB
42 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s4.reutersmedia.net/resources/r/?m=02&d=20200731&t=2&i=1527877047&r=LYNXNPEG6U1D9
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.87 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-87.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
09c52e5ea3fdb1ac6d74bf9c68a5411ae21355fb33afd30b8b37c434c3338e2a

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 19:05:20 GMT
via
1.1 987c00b911316df568db602f83876a8e.cloudfront.net (CloudFront)
x-amz-expiration
expiry-date="Mon, 31 Aug 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified
Fri, 31 Jul 2020 15:03:45 GMT
server
nginx
age
11320
etag
"d2c4ae5113a50834133f423b9565d7aa"
x-cache
Hit from cloudfront
x-amz-version-id
C0cntzZ8DoRgeITqsscUR_ZjzuW8xrP8
status
200
x-amz-cf-pop
DUS51-C1
content-type
image/jpeg
content-length
43013
x-amz-cf-id
hwYlkdAS0uqASOVuhnN5C3TqJp2t07W0dmXRG1A6Ytqx2GbgJSowXA==
common.bundle.js
static.reuters.com/resources_v2/react/cookie-reset-b74/ 		756 KB
182 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-30.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
7a093c39bdbf0571cc22c594df90ec9f5b114be57bd9f565a192fa07545562f2

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 21:08:38 GMT
content-encoding
gzip
last-modified
Thu, 06 Aug 2020 21:01:35 GMT
server
nginx
age
3946
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=7200
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
x-amz-cf-id
NmftkOxgHvKwrNNRwBgi2GsljcT8oPa8t7Ghr6CEUJS6hb_ccagpgQ==
via
1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
expires
Wed, 12 Aug 2020 23:08:14 GMT
article.bundle.js
static.reuters.com/resources_v2/react/cookie-reset-b74/ 		367 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.reuters.com/resources_v2/react/cookie-reset-b74/article.bundle.js
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-30.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
3234a9f00027b349b802fae240f760a270d6f4e7f39ecee827e77c3e282f7846

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:08:35 GMT
content-encoding
gzip
age
325
x-cache
Hit from cloudfront
status
200
content-length
53817
last-modified
Thu, 06 Aug 2020 21:01:30 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
via
1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
cache-control
max-age=7200
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
x-amz-cf-id
CSjMNebnjNenf6trQWsRKkWZudbUK0UqSS7OKzAxzYOrJOC691ZuUA==
expires
Thu, 13 Aug 2020 00:08:35 GMT
analytics.js
www.google-analytics.com/ 		45 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W9SLGS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 04 Jun 2020 23:38:14 GMT
server
Golfe2
age
6019
date
Wed, 12 Aug 2020 20:33:41 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18469
expires
Wed, 12 Aug 2020 22:33:41 GMT
js
www.google-analytics.com/gtm/ 		74 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/gtm/js?id=GTM-TBBXQQ&t=gtm2&cid=385117900.1597270441
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
5275e53dca9e7f8cb2741c3e11050df06b6d9167b088dbd8e0ce59052aa97556
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:00 GMT
content-encoding
br
vary
Accept-Encoding
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29782
x-xss-protection
0
last-modified
Wed, 12 Aug 2020 21:52:18 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 12 Aug 2020 22:14:00 GMT
iframe_api
www.youtube.com/ 		859 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
YouTube Frontend Proxy /
Resource Hash
a0d3ad2bd0bb836d67e587c3b497fc7275294125707b05bc38624cf787086dec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:00 GMT
x-content-type-options
nosniff
server
YouTube Frontend Proxy
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
status
200
cache-control
no-cache
content-type
application/javascript
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
859
x-xss-protection
0
expires
Tue, 27 Apr 1971 19:44:06 GMT
truncated
/ 		49 KB
49 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f01d25f7a76e0682a7a43230c32bef653eaf28b8a6f7a683ebb88bf8c6aa4f50

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin
https://www.reuters.com

Response headers

Content-Type
application/font-woff
truncated
/ 		49 KB
49 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d7d62426c6b87d35cef5c2c873355aa44edffcf4a7f927f1c51b10694ea4f6ed

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin
https://www.reuters.com

Response headers

Content-Type
application/font-woff
truncated
/ 		71 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ee0768f9d2def8b13df284410776f5d755109e77b5c0ca17d8895f65b343a0cd

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin
https://www.reuters.com

Response headers

Content-Type
application/font-woff
evidon-sitenotice-tag.js
c.evidon.com/sitenotice/ 		56 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js
Requested by
Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.111.252.228 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-252-228.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
731ebb6e8eb86eb45b6e7269a9374d1ac90533bfca3a81774dfe51f84fee2f92

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
gzip
vary
Accept-Encoding
status
200
content-length
14733
last-modified
Wed, 05 Aug 2020 19:47:31 GMT
server
AkamaiNetStorage
etag
"9ed00dc4b4ef73cfa3427a0b9764a8d0:1596656851.752407"
access-control-max-age
108000
access-control-allow-methods
GET,OPTIONS,POST
content-type
application/x-javascript
access-control-allow-origin
cache-control
max-age=86400, private;max-age=86400
accept-ranges
bytes
access-control-allow-headers
*
expires
Thu, 13 Aug 2020 22:14:01 GMT
country.js
c.evidon.com/geo/ 		299 B
485 B 		Script
General
Check archive.org
Download Go to
Full URL
https://c.evidon.com/geo/country.js
Requested by
Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.111.252.228 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-252-228.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a34de1a7fa8ea23a916005e590bf982aa4fb0f645a6fa908c4144bd7074148ee

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
gzip
last-modified
Sat, 14 Mar 2020 22:02:45 GMT
server
AkamaiNetStorage
status
200
etag
"1503f70c7bb024bac76b917ae38a7af3:1584223365.978506"
vary
Accept-Encoding
access-control-allow-methods
GET,OPTIONS,POST
content-type
application/x-javascript
access-control-allow-origin
access-control-max-age
108000
accept-ranges
bytes
access-control-allow-headers
*
content-length
209
snthemes.js
c.evidon.com/sitenotice/1237/ 		48 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.evidon.com/sitenotice/1237/snthemes.js
Requested by
Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.111.252.228 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-252-228.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
78d7768fb1213eced669894455aac7c1bfb17452b25ef69859ab7617cb85856f

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
gzip
vary
Accept-Encoding
status
200
content-length
3701
last-modified
Fri, 26 Jun 2020 14:04:50 GMT
server
AkamaiNetStorage
etag
"250e5fd831f93b742b230a49f56ee029:1593180290.533778"
access-control-max-age
108000
access-control-allow-methods
GET,OPTIONS,POST
content-type
application/x-javascript
access-control-allow-origin
cache-control
max-age=86400, private;max-age=86400
accept-ranges
bytes
access-control-allow-headers
*
expires
Thu, 13 Aug 2020 22:14:01 GMT
settings.js
c.evidon.com/sitenotice/1237/reuters/ 		19 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.evidon.com/sitenotice/1237/reuters/settings.js
Requested by
Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.111.252.228 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-252-228.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
7962dce1427363ac8964c27e8a221d2b6f320fa55f7e32df3508b288d99ff915

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
gzip
vary
Accept-Encoding
status
200
content-length
2681
last-modified
Wed, 01 Jul 2020 02:14:34 GMT
server
AkamaiNetStorage
etag
"ab26685e301ed5649625ade2ef42d4cf:1593569674.617377"
access-control-max-age
108000
access-control-allow-methods
GET,OPTIONS,POST
content-type
application/x-javascript
access-control-allow-origin
cache-control
max-age=86400, private;max-age=86400
accept-ranges
bytes
access-control-allow-headers
*
expires
Thu, 13 Aug 2020 22:14:01 GMT
service
usasync01.admantx.com/admantx/ 		467 B
663 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://usasync01.admantx.com/admantx/service?request=%7B%22key%22%3A%22234330834c41105ad5ed794fa036e085b40225c44f9228bb9e2692f427917605%22%2C%20%22decorator%22%3A%22template.reuters_ss%22%2C%20%22filter%22%3A%5B%22default%22%5D%2C%20%22method%22%3A%22descriptor%22%2C%20%22mode%22%3A%22async%22%2C%20%22type%22%3A%22URL%22%2C%20%22body%22%3A%22https%253A%252F%252Fwww.reuters.com%252Farticle%252Fus-cyber-cwt-ransom%252Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W%22%7D
Requested by
Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2406:da00:ff00::36eb:b8ea Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
bb56e9cb6a9934d4d3c871e6aa711d2168e0c74c02cc3388539fe50e57091dca

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 12 Aug 2020 22:14:01 GMT
Server
nginx/1.16.1
Connection
keep-alive
Content-Length
467
Content-Type
text/plain; charset=UTF-8
iasPET.1.js
cdn.adsafeprotected.com/ 		22 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adsafeprotected.com/iasPET.1.js
Requested by
Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.11 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-11.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
54138d578ed166d5381db70b3dd14a16830233553b6e4213402bae2fdb0564b4

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 01:14:04 GMT
Content-Encoding
gzip
Connection
keep-alive
Last-Modified
Wed, 08 Jul 2020 20:34:30 GMT
Server
AmazonS3
Age
75619
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 bb45d9db269295920003af6514d7e7eb.cloudfront.net (CloudFront)
Cache-Control
max-age=604800
Transfer-Encoding
chunked
X-Amz-Cf-Pop
DUS51-C1
X-Amz-Cf-Id
Z5jhY6VG9vm4ngx6dpHeW2dyBKqrmQsqDG08fFSQ91fhavKscL9xVQ==
analytics.min.js
cdn.segment.com/analytics.js/v1/IEWBqQ8VWHijTQxb7lEBGFGS9uIJzigZ/ 		456 KB
96 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.segment.com/analytics.js/v1/IEWBqQ8VWHijTQxb7lEBGFGS9uIJzigZ/analytics.min.js
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.145.149 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-145-149.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6d2fe32d253b1c23c584887a2d05bba8d56ad3b233081d190be436c70209ead2

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
YOeClGqZQucGhTexskvvImiIs1YTWvjr
content-encoding
gzip
etag
"b571ddcfce959fdfb468fd0182ffb999"
age
192
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
content-length
98102
access-control-allow-origin
*
last-modified
Fri, 31 Jul 2020 18:21:37 GMT
server
AmazonS3
date
Wed, 12 Aug 2020 22:10:50 GMT
access-control-max-age
3000
access-control-allow-methods
GET, HEAD
content-type
text/javascript; charset=utf-8
via
1.1 8ad073ef904d92431b3428f3430707af.cloudfront.net (CloudFront)
cache-control
public, max-age=300
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
x-amz-cf-id
Af3JfUVAnKHCPy8PfX2sN1XCjMVo4d3QoIBOxDoPysTobSa_8BM_Dw==
contextfeed.js
www.dianomi.com/js/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.dianomi.com/js/contextfeed.js?
Requested by
Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/article.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4dfb7c925e9a341c587ecc6af346f2cf875c63da4609858353eed31324e7ac48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
2225
cf-polished
origSize=16301
status
200
x-xss-protection
1; mode=block
last-modified
Fri, 12 Jun 2020 10:37:13 GMT
server
cloudflare
etag
W/"3fad-5a7e0a8fd0bd3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
expires
Thu, 13 Aug 2020 02:14:01 GMT
cache-control
public, max-age=14400
access-control-allow-credentials
true
cf-request-id
048655d4b90000cc5a3d975200000001
cf-ray
5c1d8c012da1cc5a-ZRH
cf-bgj
minify
breakingNews
www.reuters.com/assets/ 		1 B
370 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.reuters.com/assets/breakingNews?view=json
Requested by
Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.90 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-90.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
via
1.1 d0be2eec997f966c9c7eb03ae2f75c30.cloudfront.net (CloudFront)
server
nginx
age
4
status
200
x-cache
Miss from cloudfront
content-type
application/json;charset=UTF-8
access-control-allow-origin
http://admin.reuters.com
x-amz-cf-pop
DUS51-C1
access-control-allow-headers
Access-Control-Allow-Origin,charset
content-length
1
x-amz-cf-id
2XFvmL9_Yp5zMdrtr-Sz5bGOv7WUiYYlLGAL9gVDv_Xh6sjzffgflw==
expires
Wed, 12 Aug 2020 22:13:54 GMT
/
s3.reutersmedia.net/resources/r/ 		43 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.reutersmedia.net/resources/r/?m=02&d=20200731&t=2&i=1527877045&r=LYNXNPEG6U1D5&w=1280
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.87 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-87.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
0541539bf2c978c0ddec342e71cdeeb6c741a149356dcf13a01ae4217d28e46b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
oObRweTrk8_OxeCSFKAdYD7GOFpoZAsA
via
1.1 9e627a2e7bf673974b02e3bf374bb843.cloudfront.net (CloudFront)
x-amz-expiration
expiry-date="Mon, 31 Aug 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified
Fri, 31 Jul 2020 15:03:52 GMT
server
nginx
age
42681
etag
"9820f131d19eb65a082f3c146a2cb7b4"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
date
Wed, 12 Aug 2020 10:22:40 GMT
x-amz-cf-pop
DUS51-C1
content-length
43556
x-amz-cf-id
1iaHwJYmiBprj_dg8l819_CTSGbuWdEPSf4ujQIX9fKeRJoAF2DhjQ==
/
mab.chartbeat.com/mab_strategy/headline_testing/get_strategy/ 		195 B
482 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mab.chartbeat.com/mab_strategy/headline_testing/get_strategy/?host=reuters.com&domain=reuters.com&path=%2Farticle%2Fus-cyber-cwt-ransom-idUSKCN24W25W
Requested by
Host: static.chartbeat.com
URL: https://static.chartbeat.com/js/chartbeat_mab.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:1b::714 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cfd0da29a6d34ea44fb0035a3a1b409a4a66c091fb0f143ea2f73a643c3f8cef

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
gzip
age
676
x-cache
HIT
status
200
x-cache-hits
1
content-length
161
x-served-by
cache-hhn4061-HHN
access-control-allow-origin
*
x-timer
S1597270441.218987,VS0,VE1
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
content-type
application/json
via
1.1 varnish (Varnish/6.0), 1.1 varnish
cache-control
no-store, no-cache, must-revalidate, max-age=0, s-maxage=0
accept-ranges
bytes
expires
Mon, 10 Aug 2020 22:02:45 GMT
reuters.js
tru.am/scripts/custom/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tru.am/scripts/custom/reuters.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W9SLGS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4af5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6f23d93c9b8e3ca26f6fcc6be6a8d087e43a3f5795daa3c61017071642f66f3c

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
br
cf-cache-status
HIT
age
2230792
x-guploader-uploadid
AAANsUlK-rhqWIaSronpM69LDK3tSKdIlWTr545LHnYUXX1YBJwnHqKhyvJA1BK1p6ChhuoYauFsuyxDZP87axzJFw
x-goog-storage-class
REGIONAL
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
048655d50f0000062d8eb30200000001
last-modified
Fri, 19 Apr 2019 06:14:57 GMT
server
cloudflare
etag
W/"40b7d4de06dae04ec0d6537ef2f54db8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=e3JHUg==, md5=QLfU3gba4E7A1lN+8vVNuA==
x-goog-generation
1555654497328861
content-type
application/javascript
cache-control
public, max-age=2678400
x-goog-stored-content-length
1056
cf-ray
5c1d8c01be09062d-FRA
expires
Sat, 18 Jul 2020 03:34:09 GMT
load
experience.tinypass.com/xbuilder/experience/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://experience.tinypass.com/xbuilder/experience/load?aid=TIDovF4cqC
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bd1dc64fac45e75fffefbd76f176c6ea118ab79b88b3efddc5642d4e7c76d4fe

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
br
cf-cache-status
HIT
age
866
p3p
CP="NON DSP COR OUR IND"
status
200
x-forwarded-https
on
cf-request-id
048655d50d000032337b231200000001
x-request-id
Cb31zeqkEsp
wn
prod-exp-10-0-113-165
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
accept-encoding
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=1800
cf-ray
5c1d8c01a88d3233-FRA
expires
Wed, 12 Aug 2020 22:44:01 GMT
www-widgetapi.js
s.ytimg.com/yts/jsbin/www-widgetapi-vflm7q--B/ 		90 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.ytimg.com/yts/jsbin/www-widgetapi-vflm7q--B/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6a09f19ac3a6fb7a6db7aa92dc9a888e9f6f169b18171d6d958693399af19c99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 11 Aug 2020 23:06:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
83275
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33291
x-xss-protection
0
last-modified
Tue, 11 Aug 2020 20:57:58 GMT
server
sffe
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=691200
accept-ranges
bytes
timing-allow-origin
https://www.youtube.com
expires
Wed, 19 Aug 2020 23:06:06 GMT
context.pl
www.dianomi.com/cgi-bin/ 		2 KB
503 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.dianomi.com/cgi-bin/context.pl?id=4&h=www.reuters.com
Requested by
Host: www.dianomi.com
URL: https://www.dianomi.com/js/contextfeed.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
38f82a586c4984fdc89697da37dac16d17ed9c1d619510ed32991778b3e21b26
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
content-type
application/json; charset=ISO-8859-1
access-control-allow-origin
https://www.reuters.com
x-xss-protection
1; mode=block
cache-control
public, max-age=1200
access-control-allow-credentials
true
cf-ray
5c1d8c029fd0cc5a-ZRH
cf-request-id
048655d59e0000cc5a3d97e200000001
expires
Wed, 12 Aug 2020 22:15:01 GMT
js
www.google-analytics.com/gtm/ 		74 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/gtm/js?id=GTM-KBK7743&cid=385117900.1597270441
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e58b5f1ec0b366d5af022fc6580f518062cd5de023870bb4881cc7936cb4da06
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
br
vary
Accept-Encoding
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29818
x-xss-protection
0
last-modified
Wed, 12 Aug 2020 21:52:18 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 12 Aug 2020 22:14:01 GMT
linkid.js
www.google-analytics.com/plugins/ua/ 		2 KB
995 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 21:46:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
1657
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=3600
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
859
x-xss-protection
0
expires
Wed, 12 Aug 2020 22:46:24 GMT
en.js
c.evidon.com/sitenotice/1237/translations/ 		65 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.evidon.com/sitenotice/1237/translations/en.js
Requested by
Host: c.evidon.com
URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.111.252.228 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-252-228.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
0301abe27c75fe3b60eff31ce1d31238c9b84d4f36c037bacf0a8656b6a6fb45

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
gzip
vary
Accept-Encoding
status
200
content-length
5633
last-modified
Wed, 01 Jul 2020 01:41:52 GMT
server
AkamaiNetStorage
etag
"e21cd11f7f077dfa60a4974f4e56a950:1593567712.14839"
access-control-max-age
108000
access-control-allow-methods
GET,OPTIONS,POST
content-type
application/x-javascript
access-control-allow-origin
cache-control
max-age=86400, private;max-age=86400
accept-ranges
bytes
access-control-allow-headers
*
expires
Thu, 13 Aug 2020 22:14:01 GMT
fbevents.js
connect.facebook.net/en_US/ 		134 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/IEWBqQ8VWHijTQxb7lEBGFGS9uIJzigZ/analytics.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
893df2b9ceb653f94333139d561d363bf4c365e651a0a3ade839d96200942e37
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
34269
x-xss-protection
0
pragma
public
x-fb-debug
xB/VPJb/XbCvE493lLtaD8kbnhM9dhtya+wTBRHDpE5PtmqRA3TUTRbfn5wVozmgBHXUh23Ik+QoLEiy1MQeqg==
x-fb-trip-id
664085054
x-frame-options
DENY
date
Wed, 12 Aug 2020 22:14:01 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
ta-pagesocial-sdk.js
tru.am/scripts/ 		35 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tru.am/scripts/ta-pagesocial-sdk.js
Requested by
Host: tru.am
URL: https://tru.am/scripts/custom/reuters.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4af5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
br
cf-cache-status
HIT
age
2230806
x-guploader-uploadid
AAANsUlz9Yip85RfgS4jGavu6PDS8YEyP7WdDck7YcMKysD_x9qSJ9Qiyi4E5v-ygmEAlwDD_aGRLlN8Bnsmjdj3lw
x-goog-storage-class
REGIONAL
status
200
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
048655d5f20000062d8eb4e200000001
last-modified
Fri, 19 Apr 2019 06:14:55 GMT
server
cloudflare
etag
W/"942d5ae1e512ccdf18813550428dd002"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-goog-hash
crc32c=O7AZFg==, md5=lC1a4eUSzN8YgTVQQo3QAg==
x-goog-generation
1555654495662585
content-type
application/javascript
cache-control
public, max-age=2678400
x-goog-stored-content-length
35540
cf-ray
5c1d8c0319d2062d-FRA
expires
Sat, 18 Jul 2020 03:33:55 GMT
ads.js
www.reuters.com/ 		112 B
522 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.reuters.com/ads.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W9SLGS
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.90 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-90.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
7464555aae6d8d87b77f7170fba1698ff64f7454ded58627ca1819246e9a9969

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
gzip
server
nginx
age
65
status
200
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
http://admin.reuters.com
x-amz-cf-pop
DUS51-C1
access-control-allow-headers
Access-Control-Allow-Origin,charset
content-length
116
via
1.1 d0be2eec997f966c9c7eb03ae2f75c30.cloudfront.net (CloudFront)
x-amz-cf-id
Qam0ndKNdV1D2mRSewov5ob0uVUl4Jvqw2dFIyDwJyj-UM6O0YVT3g==
expires
Wed, 12 Aug 2020 22:12:55 GMT
tinypass.min.js
cdn.tinypass.com/api/ 		385 KB
121 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.tinypass.com/api/tinypass.min.js
Requested by
Host: experience.tinypass.com
URL: https://experience.tinypass.com/xbuilder/experience/load?aid=TIDovF4cqC
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad590c30e8e0ef2b2539b0f1a7e4e4da38a6a7b2a8b3f88048338c22da590253

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
br
cf-cache-status
HIT
age
210
p3p
CP="NON DSP COR OUR IND"
status
200
x-forwarded-https
on
cf-request-id
048655d5f4000032337b261200000001
wn
prod-dash-10-0-127-211
last-modified
Tue, 11 Aug 2020 16:55:24 GMT
server
cloudflare
etag
W/"394506-1597164924000"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
server-time
0.000
cache-control
public, max-age=300
cf-ray
5c1d8c032be63233-FRA
expires
Wed, 12 Aug 2020 22:19:01 GMT
dianomi-context.css
www.dianomi.com/partner/dianomi/css/ 		169 B
272 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.dianomi.com/partner/dianomi/css/dianomi-context.css?v=1.1
Requested by
Host: www.dianomi.com
URL: https://www.dianomi.com/js/contextfeed.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99781410070a5dd4d753fdb8a46f4272082b5be64541dcfcb1b2d3c4aea09c6c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
3164
cf-polished
origSize=199
status
200
x-xss-protection
1; mode=block
last-modified
Mon, 21 Jan 2019 12:43:41 GMT
server
cloudflare
etag
W/"c7-57ff735e16ce7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
expires
Thu, 13 Aug 2020 02:14:01 GMT
cache-control
public, max-age=14400
access-control-allow-credentials
true
cf-request-id
048655d6000000cc5a3d980200000001
cf-ray
5c1d8c03389bcc5a-ZRH
cf-bgj
minify
smartads.epl
www.dianomi.com/ Frame A719 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.dianomi.com/smartads.epl?id=4728&num_ads=5&shuffle=0&cf=545.4.Reuters%20Feed&url=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Requested by
Host: www.dianomi.com
URL: https://www.dianomi.com/js/contextfeed.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.dianomi.com
:scheme
https
:path
/smartads.epl?id=4728&num_ads=5&shuffle=0&cf=545.4.Reuters%20Feed&url=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Response headers

status
200
date
Wed, 12 Aug 2020 22:14:01 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=de8518e3ff47b0e09e847c7b84bb03f561597270441; expires=Fri, 11-Sep-20 22:14:01 GMT; path=/; domain=.dianomi.com; HttpOnly; SameSite=Lax
x-content-type-options
nosniff
x-xss-protection
1; mode=block
access-control-allow-origin
*
access-control-allow-credentials
true
expires
now
pragma
no-cache
cache-control
no-cache,no-store,private
link
</img/a/pss/2649/23.css>;rel=preload;as=style
cf-cache-status
DYNAMIC
cf-request-id
048655d6140000cc5a3d982200000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5c1d8c0358cecc5a-ZRH
content-encoding
br
cf-h2-pushed
</img/a/pss/2649/23.css>
videofeed-combined.js
www.dianomi.com/js/ 		22 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.dianomi.com/js/videofeed-combined.js?id=123
Requested by
Host: www.dianomi.com
URL: https://www.dianomi.com/js/contextfeed.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ed44c518b79ec0c24d13803371365e67d6ca02829631e0dad366850fd466044
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
4904
cf-polished
origSize=32520
status
200
x-xss-protection
1; mode=block
last-modified
Wed, 12 Aug 2020 12:48:38 GMT
server
cloudflare
etag
W/"7f08-5acad9b4df871"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
expires
Thu, 13 Aug 2020 02:14:01 GMT
cache-control
public, max-age=14400
access-control-allow-credentials
true
cf-request-id
048655d6050000cc5a3d981200000001
cf-ray
5c1d8c0338abcc5a-ZRH
cf-bgj
minify
recirculation.epl
www.dianomi.com/ Frame 7C9C 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.dianomi.com/recirculation.epl?id=98&cf=545.4.Reuters%20Feed
Requested by
Host: www.dianomi.com
URL: https://www.dianomi.com/js/contextfeed.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.dianomi.com
:scheme
https
:path
/recirculation.epl?id=98&cf=545.4.Reuters%20Feed
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Response headers

status
200
date
Wed, 12 Aug 2020 22:14:01 GMT
content-type
text/html; charset=utf-8
set-cookie
__cfduid=de8518e3ff47b0e09e847c7b84bb03f561597270441; expires=Fri, 11-Sep-20 22:14:01 GMT; path=/; domain=.dianomi.com; HttpOnly; SameSite=Lax
x-content-type-options
nosniff
x-xss-protection
1; mode=block
access-control-allow-origin
*
access-control-allow-credentials
true
cf-cache-status
DYNAMIC
cf-request-id
048655d6140000cc5a3d983200000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5c1d8c0358d0cc5a-ZRH
content-encoding
br
recirculation.epl
www.dianomi.com/ Frame 04F0 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.dianomi.com/recirculation.epl?id=99&start=6&cf=545.4.Reuters%20Feed
Requested by
Host: www.dianomi.com
URL: https://www.dianomi.com/js/contextfeed.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.dianomi.com
:scheme
https
:path
/recirculation.epl?id=99&start=6&cf=545.4.Reuters%20Feed
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Response headers

status
200
date
Wed, 12 Aug 2020 22:14:01 GMT
content-type
text/html; charset=utf-8
set-cookie
__cfduid=de8518e3ff47b0e09e847c7b84bb03f561597270441; expires=Fri, 11-Sep-20 22:14:01 GMT; path=/; domain=.dianomi.com; HttpOnly; SameSite=Lax
x-content-type-options
nosniff
x-xss-protection
1; mode=block
access-control-allow-origin
*
access-control-allow-credentials
true
cf-cache-status
DYNAMIC
cf-request-id
048655d6150000cc5a3d984200000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5c1d8c0358d5cc5a-ZRH
content-encoding
br
lazyload.iife.min.js
cdnjs.cloudflare.com/ajax/libs/vanilla-lazyload/10.20.1/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/vanilla-lazyload/10.20.1/lazyload.iife.min.js
Requested by
Host: www.dianomi.com
URL: https://www.dianomi.com/js/contextfeed.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:4f6b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c514d4fb8244af230a89d2203522c6a67a55a3f161cfd4fca9f53301c0588ff
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
11232372
content-security-policy-report-only
default-src https: data: wss: 'unsafe-eval' 'unsafe-inline'; report-uri https://cdnjs.cloudflare.com/cdn-cgi/beacon/csp?req_id=5c1d8c036b4105d0
status
200
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
048655d622000005d0c3b59200000001
served-in-seconds
0.003
timing-allow-origin
*
last-modified
Sun, 17 Feb 2019 22:45:51 GMT
server
cloudflare
etag
W/"5c69e41f-14cf"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5c1d8c036b4105d0-FRA
expires
Mon, 02 Aug 2021 22:14:01 GMT
dianomi-max-200x38.png
www.dianomi.com/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.dianomi.com/img/dianomi-max-200x38.png
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
70503c92bcbb8105d95ec4de2012f23098c3383586e95323e4b3384b56af4beb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
536843
cf-polished
origFmt=png, origSize=3940
status
200
content-disposition
inline; filename="dianomi-max-200x38.webp"
content-length
1164
x-xss-protection
1; mode=block
last-modified
Wed, 29 Jul 2020 16:53:11 GMT
server
cloudflare
etag
"f64-5ab97641e5c82"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 12 Sep 2020 08:14:01 GMT
cache-control
public, max-age=2628000
access-control-allow-credentials
true
cf-request-id
048655d6150000cc5a3d985200000001
accept-ranges
bytes
cf-ray
5c1d8c0358d7cc5a-ZRH
cf-bgj
imgq:85,h2pri
pixeltrack.pl
www.dianomi.com/cgi-bin/ 		77 B
414 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.dianomi.com/cgi-bin/pixeltrack.pl?cf=545.4.Reuters%20Feed
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d4fa79afcf5a5cc5a0f12dedaf825f11530e6397d723fe7044cd37ba3c248e57
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:01 GMT
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
content-type
image/gif; charset=ISO-8859-1
access-control-allow-origin
*
x-xss-protection
1; mode=block
access-control-allow-credentials
true
cf-ray
5c1d8c0358dbcc5a-ZRH
content-length
77
cf-request-id
048655d6150000cc5a3d986200000001
expires
Tue, 11 Aug 2020 22:14:01 GMT
truncated
/ 		49 KB
49 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
45610b21279531a97f9566b0f0f8a1d287a45ae4bc6bc545971af5cd7e393cc6

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Origin
https://www.reuters.com

Response headers

Content-Type
application/font-woff
1
l.betrad.com/site/v3/1237/5669/1/1/1/ 		0
120 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://l.betrad.com/site/v3/1237/5669/1/1/1/1?consent=1
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.72.36.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-72-36-5.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
gzip
x-powered-by
Express
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary
Accept-Encoding
smartads_video_json.pl
www.dianomi.com/cgi-bin/ 		3 B
307 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.dianomi.com/cgi-bin/smartads_video_json.pl?id=4729&cf=545.4.Reuters%20Feed
Requested by
Host: www.dianomi.com
URL: https://www.dianomi.com/js/videofeed-combined.js?id=123
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.reuters.com
x-xss-protection
1; mode=block
cache-control
private, no-cache, no-store, must-revalidate, max-age=0, pre-check=0, post-check=0
access-control-allow-credentials
true
cf-ray
5c1d8c04ab1bcc5a-ZRH
cf-request-id
048655d6ec0000cc5a3d9a7200000001
61500
l.betrad.com/site/v3/1237/5669/1/2/1/1/ 		0
120 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://l.betrad.com/site/v3/1237/5669/1/2/1/1/61500?consent=1
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.72.36.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-72-36-5.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
gzip
x-powered-by
Express
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary
Accept-Encoding
61500
l.betrad.com/site/v3/1237/5669/1/1/1/1/ 		0
120 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://l.betrad.com/site/v3/1237/5669/1/1/1/1/61500?consent=1
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.72.36.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-72-36-5.compute-1.amazonaws.com
Software
/ Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
204
date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
gzip
x-powered-by
Express
etag
W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI"
vary
Accept-Encoding
beacon.js
sb.scorecardresearch.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.238.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-238-139.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 22:14:01 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
884
Expires
Thu, 13 Aug 2020 22:14:01 GMT
gwiq.js
gwiqcdn.globalwebindex.net/gwiq/ 		6 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://gwiqcdn.globalwebindex.net/gwiq/gwiq.js
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.93.216 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS
216.93.201.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
6aa7c3edbc1ee1fe66d4db0fea18aa2d0bbe0dfae05d228c9ffeeaeacb6f1c53

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 21:20:17 GMT
age
3224
x-guploader-uploadid
AAANsUlgpVoFcVYEJXZFUVevEYCOF_UA0Lty0Rodpq1eL1MytdVgYwe8YA_uLiAuUIqJRcd9iWE3_LgNcyqG9iwsxHdhmAt3Yg
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
clear
content-length
5766
last-modified
Wed, 15 Apr 2020 08:49:27 GMT
server
UploadServer
etag
"aba61abde9777087262fb27526ba1ef6"
x-goog-hash
crc32c=yYfjgA==, md5=q6Yavel3cIcmL7J1Jroe9g==
x-goog-generation
1586940567400828
cache-control
public, max-age=3600
x-goog-stored-content-length
5766
accept-ranges
bytes
content-type
application/javascript
expires
Wed, 12 Aug 2020 22:20:17 GMT
truncated
/ 		38 B
38 B 		Other
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
52dc24c0429ea6ccc5b579a6da8bb79bf41e471fe5108a62009f3c2e195551c0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/webp
312961195854690
connect.facebook.net/signals/config/ 		525 KB
132 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/312961195854690?v=2.9.23&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
42a2dcedbfef8ef01a17fcf5fcbfed0e6dd7749ec51690e70491c2c5e5b49c6b
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
135384
x-xss-protection
0
pragma
public
x-fb-debug
EcYNPA5AclUkRnKkFUTcE6WWXt8SIHrzHR8g3LR+/JQZW45HT/zeffnafn5cfb/EczSW8G/Hni8zHJwYS66b2g==
x-fb-trip-id
664085054
x-frame-options
DENY
date
Wed, 12 Aug 2020 22:14:01 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
article-recirc
sope.prod.reuters.tv/program/rcom/v1/ 		13 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://sope.prod.reuters.tv/program/rcom/v1/article-recirc?edition=us&pageid=USKCN24W25W&modules=rightrail,ribbon,bottom
Requested by
Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:624f:b000:1a0c:44be:c431:52fe Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
b57edf9e12c72fcbdd2385fd05b19a276bf8629efd6765ede37a495f651d7904

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
seq
ed4b3780-6820-4d82-a84b-e94f921ed073

Response headers

date
Wed, 12 Aug 2020 22:14:02 GMT
x-origin
i-0737d0d98f5efb414.sope.prod.us.reuters.tv
server
nginx/1.14.0 (Ubuntu)
x-amzn-trace-id
Root=1-5f3469aa-6b6362e21d1acaf9f7fe8be4
status
200
content-type
application/json
access-control-allow-origin
*
access-control-allow-headers
connection, range, accept-encoding, user-agent, referer, seq
content-length
13431
bidexchange.js
contextual.media.net/ 		440 KB
124 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/bidexchange.js?cid=8CUF1VN4G&dn=www.reuters.com&version=4.1&https=1
Requested by
Host: static.reuters.com
URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c54eabc4e016ac3cd83469766ba68a2d83feb58cf65508bf034baff93071fff0
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Wed, 12 Aug 2020 22:14:01 GMT
vary
Accept-Encoding
x-mnet-h
E
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
status
200
cache-control
max-age=1800
content-type
text/javascript; charset=utf-8
expires
Wed, 12 Aug 2020 22:44:01 GMT
beacon
beacon.tru.am/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://beacon.tru.am/beacon
Requested by
Host: tru.am
URL: https://tru.am/scripts/ta-pagesocial-sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:274 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:01 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
access-control-allow-origin
https://www.reuters.com
cache-control
no-cache, private, max-age=0
cf-ray
5c1d8c053e969748-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
cf-request-id
048655d7400000974839820200000001
expires
Thu, 01 Jan 1970 00:00:00 UTC
execute
experience.tinypass.com/xbuilder/experience/ 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://experience.tinypass.com/xbuilder/experience/execute?aid=TIDovF4cqC
Requested by
Host: cdn.tinypass.com
URL: https://cdn.tinypass.com/api/tinypass.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:b6b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ebf18dcc16c7de2a8d405ebd3035a852550021021d70b43677b9d5fdeb2b98d2

Request headers

Accept
*/*
Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Wed, 12 Aug 2020 22:14:02 GMT
content-encoding
br
cf-cache-status
DYNAMIC
p3p
CP="NON DSP COR OUR IND"
status
200
x-forwarded-https
on
cf-request-id
048655d75f000032337b283200000001
x-request-id
Cdr1zeqzYRw
pragma
no-cache
wn
prod-exp-10-0-84-129
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods
POST, GET, OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.reuters.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cf-ray
5c1d8c0568883233-FRA
expires
Thu, 01 Jan 1970 00:00:00 GMT
id
dpm.demdex.net/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=4579BF7A580A3C6A0A495DAF%40AdobeOrg&d_nsid=0&ts=1597270441862
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.49.59.93 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-49-59-93.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
f0aca48670c6ddc0797c4b7e29581db9b873a5ce380b374ab99709e1ce0c8c95
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v078-06ee34765.edge-irl1.demdex.com 5.76.0.20200805085924 3ms (+0ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-TID
RGi/XV5dT14=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.reuters.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
1062
Expires
Thu, 01 Jan 1970 00:00:00 GMT
MCX_Thomson_Reuters_Modal_Invite.css
siteintercept.allegiancetech.com/dist/tr1si001/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://siteintercept.allegiancetech.com/dist/tr1si001/MCX_Thomson_Reuters_Modal_Invite.css
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W9SLGS
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
67.221.239.62 , United States, ASN27467 (RACKMY-STL-AS1, US),
Reverse DNS
67-221-239-62.www.allegiancetech.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
baa066783210ec503c97545b0caeffba83b53c3c4d969a9c5ce94ee3ecb4db00

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 22:14:02 GMT
Content-Encoding
gzip
ETag
"030a62402dd61:0"
Last-Modified
Mon, 18 May 2020 18:16:00 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
X-Alleg-Server
cw03
Content-Length
1661
MCX_Thomson_Reuters_Modal_Invite.js
siteintercept.allegiancetech.com/dist/tr1si001/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://siteintercept.allegiancetech.com/dist/tr1si001/MCX_Thomson_Reuters_Modal_Invite.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W9SLGS
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
67.221.239.62 , United States, ASN27467 (RACKMY-STL-AS1, US),
Reverse DNS
67-221-239-62.www.allegiancetech.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
74946a6535af619858813a4ba2513c464acc6499631515961c2c2862b515eab8

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 22:14:02 GMT
Content-Encoding
gzip
ETag
"0c6b777d13dd61:0"
Last-Modified
Mon, 08 Jun 2020 20:14:52 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
X-Alleg-Server
cw03
Content-Length
956
reuters_logo.png
siteintercept.allegiancetech.com/dist/tr1si001/images/ 		122 KB
122 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://siteintercept.allegiancetech.com/dist/tr1si001/images/reuters_logo.png
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
67.221.239.62 , United States, ASN27467 (RACKMY-STL-AS1, US),
Reverse DNS
67-221-239-62.www.allegiancetech.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
7b1d29ae1792d7b78f057f0043a15ba261c39850cc37da2ce80352b9877585db

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 22:14:02 GMT
Last-Modified
Mon, 23 Dec 2019 17:30:37 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"18c757b0b6b9d51:0"
Content-Type
image/png
Accept-Ranges
bytes
X-Alleg-Server
cw03
Content-Length
124736
intersection-observer.js
www.dianomi.com/js/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.dianomi.com/js/intersection-observer.js
Requested by
Host: www.dianomi.com
URL: https://www.dianomi.com/js/videofeed-combined.js?id=123
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.22.230 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8567ea9f657a5f2ea1633ec26b13de309f60f0921a278db2a9be91d2e48984e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:01 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
age
2648
cf-polished
origSize=29813
status
200
x-xss-protection
1; mode=block
last-modified
Thu, 21 May 2020 13:02:02 GMT
server
cloudflare
etag
W/"7475-5a6281e5fc48b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
expires
Thu, 13 Aug 2020 02:14:01 GMT
cache-control
public, max-age=14400
access-control-allow-credentials
true
cf-request-id
048655d7990000cc5a3d9b2200000001
cf-ray
5c1d8c05ccaacc5a-ZRH
cf-bgj
minify
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035630&ns__t=1597270441901&ns_c=UTF-8&cv=3.5&c8=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20crimina...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035630&ns__t=1597270441901&ns_c=UTF-8&cv=3.5&c8=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20crimin...
0
528 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=6035630&ns__t=1597270441901&ns_c=UTF-8&cv=3.5&c8=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals%20-%20Reuters&c7=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&c9=&cs_ak_ss=1
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.238.139 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-238-139.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:01 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=2&c2=6035630&ns__t=1597270441901&ns_c=UTF-8&cv=3.5&c8=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals%20-%20Reuters&c7=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&c9=&cs_ak_ss=1
Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:01 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
tc.js
contextual.media.net/ 		11 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/tc.js?&tpkey=TB4M82W&size=300x250&v=19&nat=1&https=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/bidexchange.js?cid=8CUF1VN4G&dn=www.reuters.com&version=4.1&https=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
3c0d27b79bfe51d6abbc99eb79bd7731804fa80823d85bce422ee364185c6126
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Wed, 12 Aug 2020 22:14:02 GMT
vary
Accept-Encoding
x-mnet-h
E
content-type
text/javascript; charset=utf-8
status
200
cache-control
max-age=172800
content-length
6573
expires
Fri, 14 Aug 2020 22:14:02 GMT
tc.js
contextual.media.net/ 		13 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/tc.js?&tpkey=T645KQG&size=728x90&v=19&nat=1&https=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/bidexchange.js?cid=8CUF1VN4G&dn=www.reuters.com&version=4.1&https=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
d27b59be0fa35fd199035fb3d095a553cf11e6c7b44d583b2942650fc3da5977
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Wed, 12 Aug 2020 22:14:02 GMT
vary
Accept-Encoding
x-mnet-h
E
content-type
text/javascript; charset=utf-8
status
200
cache-control
max-age=172800
content-length
7712
expires
Fri, 14 Aug 2020 22:14:02 GMT
pubcid.php
contextual.media.net/ 		57 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/pubcid.php?itype=HB&cb=window.advBidxc.mnetCoRtusId
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/bidexchange.js?cid=8CUF1VN4G&dn=www.reuters.com&version=4.1&https=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7b48a74fa0f94d83ae6d60c772f5e7aa66e7be1b63ccf223ca14e34d3d7b0d22
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Wed, 12 Aug 2020 22:14:02 GMT
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=1800
content-length
18543
x-mnet-hl2
E
expires
Wed, 12 Aug 2020 22:44:02 GMT
sync
gum.criteo.com/ 		61 B
380 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sync?r=2&c=321&j=window.advBidxc.mnetRtusId
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/bidexchange.js?cid=8CUF1VN4G&dn=www.reuters.com&version=4.1&https=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
f77f47058428a1c21dad5a75ac13fbfdeb9858947218fee2112fded5972a0b5d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
date
Wed, 12 Aug 2020 22:14:01 GMT
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
status
200
cache-control
private, max-age=3600
server-processing-duration-in-ticks
748
content-length
175
expires
60
px.gif
contextual.media.net/ 		43 B
206 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/px.gif?&ch=1&vn=1
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:02 GMT
last-modified
Wed, 19 Jul 2017 10:11:12 GMT
server
Apache
strict-transport-security
max-age=604800
content-type
image/gif
status
200
cache-control
max-age=1112426
accept-ranges
bytes
content-length
43
expires
Tue, 25 Aug 2020 19:14:28 GMT
px.gif
s.mnet-ad.net/ 		43 B
356 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.mnet-ad.net/px.gif?&ch=2&vn=1
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.81.204.228 , Virgin Islands (British), ASN40034 (CONFLUENCE-NETWORK-INC, VG),
Reverse DNS
Software
Apache /
Resource Hash
8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 22:14:02 GMT
Last-Modified
Wed, 19 Jul 2017 10:11:12 GMT
Server
Apache
Content-Type
image/gif
Cache-Control
max-age=1209600
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=112
Content-Length
43
Expires
Wed, 26 Aug 2020 22:14:02 GMT
rtbsspub
cdneu-xch.media.net/AdExchange/ 		50 KB
51 KB 		EventSource
General
Check archive.org
Download Go to
Full URL
https://cdneu-xch.media.net/AdExchange/rtbsspub?&gdpr=0&gdprconsent=0&usp_enf=1&usp_status=0&us_privacy=1YN-&cid=8CUF1VN4G&region=eu&ptrid=8PRL4E7N3&requestString=391166652*4%7C300x600%7C8CUD609M7%7C362622121%7C%7C%7C1%40391166652*23%7C300x250~300x600%7C8CUF1VN4G%7C12762257~12762257%7C%7C%7C1%40391166652*29%7C300x250~300x600%7C11384%7C31484_123996_15~31484_123996_10%7C%7C%7C1%40391166652*51%7C300x250~300x600%7C973973%7C11084976~11084976%7C0.07%7C%7C1%40391166652*74%7C300x250~300x600%7C1113800%7C12209207~12209207%7C%7C%7C1%40391166652*80%7C300x250~300x600%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C0.06%7C%7C1%40391166652*84%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C391166652%7C%7C%7C3%40391166652*117%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C391166652_8CUF1VN4G%7C%7C%7C3%40391166652*145%7C300x600~300x250%7C100600%7C147215~147215%7C%7C%7C1%40391166652*172%7C300x250~300x600%7C8CUF1VN4G%7C15331955~15331955%7C0.06%7C%7C1%40391166652*175%7C300x600~300x250%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C0.01%7C%7C1%40391166652*178%7C300x600~300x250%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C%7C%7C1%40391166652*201%7C300x600~300x250%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C%7C%7C1%40391166652*203%7C300x250~300x600%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C%7C%7C1%40391166652*214%7C300x600~300x250%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C%7C%7C1%40391166652*222%7C300x250~300x600%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C%7C%7C1%40391166652*3007%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C391166652_8CUF1VN4G%7C%7C%7C3%40391166652*3010%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C391166652_8CUF1VN4G%7C%7C%7C3%40391166652*3015%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C391166652~391166652%7C%7C%7C3%40451439109*9%7C300x250%7C8CUD609M7%7C155187763%7C%7C%7C1%40451439109*23%7C300x250%7C8CUF1VN4G%7C12762293%7C%7C%7C1%40451439109*29%7C300x250%7C11384%7C31484_123998_15%7C%7C%7C1%40451439109*51%7C300x250%7C973973%7C11084979%7C0.07%7C%7C1%40451439109*80%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C0.06%7C%7C1%40451439109*84%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C451439109%7C%7C%7C3%40451439109*117%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C3%40451439109*145%7C300x250%7C100600%7C147218%7C%7C%7C1%40451439109*172%7C300x250%7C8CUF1VN4G%7C15331958%7C0.06%7C%7C1%40451439109*175%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C0.01%7C%7C1%40451439109*178%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C1%40451439109*203%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C1%40451439109*214%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C1%40451439109*222%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C1%40451439109*3007%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C3%40451439109*3010%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C3%40451439109*3014%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C3%40518121357*9%7C728x90%7C8CUD609M7%7C996968123%7C%7C%7C1%40518121357*23%7C728x90%7C8CUF1VN4G%7C12762293%7C%7C%7C1%40518121357*29%7C728x90%7C11384%7C31484_123998_2%7C%7C%7C1%40518121357*51%7C728x90%7C973973%7C11084978%7C0.69%7C%7C1%40518121357*80%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C0.06%7C%7C1%40518121357*84%7C1x1_T645KQG_1%7C8CUF1VN4G%7C518121357%7C%7C%7C3%40518121357*117%7C1x1_T645KQG_1%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C3%40518121357*145%7C728x90%7C100600%7C147217%7C%7C%7C1%40518121357*172%7C728x90%7C8CUF1VN4G%7C15331957%7C0.06%7C%7C1%40518121357*175%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C0.01%7C%7C1%40518121357*178%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C1%40518121357*203%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C1%40518121357*214%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C1%40518121357*222%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C1%40518121357*3007%7C1x1_T645KQG_1%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C3%40518121357*3010%7C1x1_T645KQG_1%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C3%40518121357*3014%7C1x1_T645KQG_1%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C3%40612341223*23%7C728x90%7C8CUF1VN4G%7C12762257%7C%7C%7C1%40612341223*29%7C728x90~970x250%7C11384%7C31484_123996_2~31484_123996_57%7C%7C%7C1%40612341223*51%7C728x90%7C973973%7C11084975%7C0.69%7C%7C1%40612341223*74%7C728x90~970x250%7C1113800%7C12209209~12209209%7C%7C%7C1%40612341223*80%7C728x90%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C0.06%7C%7C1%40612341223*84%7C1x1_T645KQG_1%7C8CUF1VN4G%7C612341223%7C%7C%7C3%40612341223*117%7C1x1_T645KQG_1%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C%7C%7C3%40612341223*145%7C728x90~970x250%7C100600%7C147214~147214%7C%7C%7C1%40612341223*172%7C728x90~970x250%7C8CUF1VN4G%7C15303527~15303527%7C0.06%7C%7C1%40612341223*175%7C728x90%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C0.01%7C%7C1%40612341223*178%7C728x90%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C%7C%7C1%40612341223*203%7C728x90~970x250%7C8CUF1VN4G%7C612341223_8CUF1VN4G~612341223_8CUF1VN4G%7C%7C%7C1&crid=391166652%2C451439109%2C518121357%2C612341223&sd=1&requrl=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&bl=1&rt=5&dn=https://www.reuters.com&https=1&act=headerBid&prvReqId=355702068361667721597270442017&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.17804297218932486&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1600%2C%22vh%22%3A1200%2C%22ph%22%3A7286%7D&itype=HB&cc=CH&rc=ZH&ct=ZURICH&sid=8973&scc=1&tmt=200&section=us.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&prid=8PRVCXX19&isRefresh=0&switch=1
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.62.140.165 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
395da3ca5c327fe1f7ba97e75ecc2be72807f621f9c5406fdb1b0ebfb174a7b4

Request headers

Accept
text/event-stream
Cache-Control
no-cache
Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:02 GMT
status
200
content-type
text/event-stream;charset=UTF-8
access-control-allow-origin
https://www.reuters.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
timing-allow-origin
*, *
expires
Wed, 12 Aug 2020 22:14:02 GMT
rtbsspub
cdneu-xch.media.net/AdExchange/ 		12 KB
12 KB 		EventSource
General
Check archive.org
Download Go to
Full URL
https://cdneu-xch.media.net/AdExchange/rtbsspub?&gdpr=0&gdprconsent=0&usp_enf=1&usp_status=0&us_privacy=1YN-&cid=8CUF1VN4G&region=eu&ptrid=8PRL4E7N3&requestString=612341223*4%7C728x90~970x250%7C8CUD609M7%7C813012502~450341239%7C%7C%7C1%40612341223*214%7C970x250~728x90%7C8CUF1VN4G%7C612341223_8CUF1VN4G~612341223_8CUF1VN4G%7C%7C%7C1%40612341223*222%7C728x90%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C%7C%7C1%40612341223*3007%7C1x1_T645KQG_1%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C%7C%7C3%40612341223*3010%7C1x1_T645KQG_1%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C%7C%7C3%40612341223*3015%7C1x1_T645KQG_1%7C8CUF1VN4G%7C612341223~612341223%7C%7C%7C3%40894667540*9%7C300x250%7C8CUD609M7%7C611759711%7C%7C%7C1%40894667540*80%7C300x250%7C8CUF1VN4G%7C894667540_8CUF1VN4G%7C0.06%7C%7C1%40894667540*175%7C300x250%7C8CUF1VN4G%7C894667540_8CUF1VN4G%7C0.01%7C%7C1%40894667540*178%7C300x250%7C8CUF1VN4G%7C894667540_8CUF1VN4G%7C%7C%7C1%40894667540*201%7C300x250%7C8CUF1VN4G%7C894667540_8CUF1VN4G%7C%7C%7C1%40894667540*203%7C300x250%7C8CUF1VN4G%7C894667540_8CUF1VN4G%7C%7C%7C1%40894667540*214%7C300x250%7C8CUF1VN4G%7C894667540_8CUF1VN4G%7C%7C%7C1%40894667540*222%7C300x250%7C8CUF1VN4G%7C894667540_8CUF1VN4G%7C%7C%7C1&crid=612341223%2C894667540&sd=1&requrl=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&bl=1&rt=5&dn=https://www.reuters.com&https=1&act=headerBid&prvReqId=691721274020222251597270442032&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.921922182525293&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1600%2C%22vh%22%3A1200%2C%22ph%22%3A7286%7D&itype=HB&cc=CH&rc=ZH&ct=ZURICH&sid=8973&scc=1&tmt=200&section=us.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&prid=8PRVCXX19&isRefresh=0
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.62.140.165 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6ec8c9246cb65096ce966d070e6e1284e9cf9d5256bfd2104170f470067c63c3

Request headers

Accept
text/event-stream
Cache-Control
no-cache
Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:02 GMT
status
200
content-type
text/event-stream;charset=UTF-8
access-control-allow-origin
https://www.reuters.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
timing-allow-origin
*, *
expires
Wed, 12 Aug 2020 22:14:02 GMT
Cookie set dest5.html
reuters.demdex.net/ Frame 3407 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://reuters.demdex.net/dest5.html?d_nsid=0
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.202.86.190 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-86-190.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
reuters.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
demdex=78254189166458470720889798111828919160
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Wed, 05 Aug 2020 12:34:40 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=78254189166458470720889798111828919160;Path=/;Domain=.demdex.net;Expires=Mon, 08-Feb-2021 22:14:02 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding, User-Agent
X-TID
40aW5VlPRSw=
Content-Length
2785
Connection
keep-alive
gpt.js
www.googletagservices.com/tag/js/ 		55 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/bidexchange.js?cid=8CUF1VN4G&dn=www.reuters.com&version=4.1&https=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b13fd23c0effcdc881aa98e5754af4cdefedd4ba4db81a6310850f8635405b82
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"600 / 979 of 1000 / last-modified: 1597266776"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
18765
x-xss-protection
0
expires
Wed, 12 Aug 2020 22:14:02 GMT
log
cslogger.media.net/ 		35 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cslogger.media.net/log?logid=kfk&evtid=cs&origin=1&vsid=2402720415348313000V10&pvgid=data-co&ovsid=3cedce45-e10f-4462-bb3c-24b9f18fb858&cs=15
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Jetty(9.4.25.v20191220) /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:02 GMT
server
Jetty(9.4.25.v20191220)
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Wed, 12 Aug 2020 22:14:02 GMT
rtbsspub
cdneu-xch.media.net/AdExchange/ 		4 KB
5 KB 		EventSource
General
Check archive.org
Download Go to
Full URL
https://cdneu-xch.media.net/AdExchange/rtbsspub?&gdpr=0&gdprconsent=0&usp_enf=1&usp_status=0&us_privacy=1YN-&cid=8CUF1VN4G&region=eu&ptrid=8PRL4E7N3&requestString=391166652*59%7C300x250~300x600%7C8CUF1VN4G%7C_112891~_112891%7C0.07%7C%7C1%40451439109*59%7C300x250%7C8CUF1VN4G%7C_112891%7C0.07%7C%7C1%40518121357*59%7C728x90%7C8CUF1VN4G%7C_112891%7C0.07%7C%7C1%40612341223*59%7C728x90~970x250%7C8CUF1VN4G%7C_112891~_112891%7C0.07%7C%7C1%40894667540*59%7C300x250%7C8CUF1VN4G%7C_112891%7C0.07%7C%7C1&crid=391166652%2C451439109%2C518121357%2C612341223%2C894667540&sd=1&requrl=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&bl=1&rt=5&dn=https://www.reuters.com&https=1&act=headerBid&prvReqId=213429505566094661597270442105&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.003238387826814071&ndec=1&rtusuid=%7B%2259%22%3A%223cedce45-e10f-4462-bb3c-24b9f18fb858~~15%22%7D&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1600%2C%22vh%22%3A1200%2C%22ph%22%3A7286%7D&itype=HB&cc=CH&rc=ZH&ct=ZURICH&sid=8973&scc=1&tmt=200&section=us.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&prid=8PRVCXX19
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.62.140.165 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
661ed736aaf54503512d6e477d9a2debdbe91b7eadddbaa3202a693462cd4766

Request headers

Accept
text/event-stream
Cache-Control
no-cache
Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:02 GMT
status
200
content-type
text/event-stream;charset=UTF-8
access-control-allow-origin
https://www.reuters.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
timing-allow-origin
*, *
expires
Wed, 12 Aug 2020 22:14:02 GMT
integrator.js
adservice.google.de/adsid/ 		109 B
829 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.reuters.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 12 Aug 2020 22:14:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		109 B
829 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.reuters.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 12 Aug 2020 22:14:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
pubads_impl_2020080501.js
securepubads.g.doubleclick.net/gpt/ 		262 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
sffe /
Resource Hash
2a7a5100d1b04b40f49ec3661a2ce57d3af5acbd35497cd946e87912a6c9e021
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 05 Aug 2020 08:42:44 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
94052
x-xss-protection
0
expires
Wed, 12 Aug 2020 22:14:02 GMT
p
api.segment.io/v1/ 		21 B
141 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.segment.io/v1/p
Requested by
Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/IEWBqQ8VWHijTQxb7lEBGFGS9uIJzigZ/analytics.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.218.0.69 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-218-0-69.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
200
date
Wed, 12 Aug 2020 22:14:02 GMT
access-control-allow-origin
https://www.reuters.com
content-length
21
vary
Origin
content-type
application/json
/
www.facebook.com/tr/ 		44 B
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=312961195854690&ev=PageView&dl=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&rl=&if=false&ts=1597270442209&sw=1600&sh=1200&v=2.9.23&r=stable&a=seg&ec=0&o=30&fbp=fb.1.1597270442208.1245171273&it=1597270441720&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:02 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Wed, 12 Aug 2020 22:14:02 GMT
collect
www.google-analytics.com/ 		35 B
192 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j83&aip=1&a=242085792&t=pageview&_s=1&dl=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&dp=%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&ul=en-us&de=UTF-8&dt=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAiEAjR~&jid=511696037&gjid=2111920225&cid=385117900.1597270441&tid=UA-24152976-22&_gid=1221958855.1597270441&cd2=Cyberrisk&cd11=us-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals&cd4=Article%20-%20News&cd32=Fri%20Jul%2031%202020%2002%3A00%3A00%20GMT%2B0200%20(Central%20European%20Summer%20Time)&cd8=0&cd10=Slideshow&cd9=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&cd19=Page%20Load&cd7=Desktop&cd6=U.S.&cd5=Article&cd17=Jack%20Stubbs&cd3=Tentpoles%20-%20Cyberrisk&cd1=Tentpoles&cd13=529&cd18=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals&cd38=false&cd40=RCOMUS_Cyberrisk&cd41=us.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&cd42=USKCN24W25W&cd43=KCN24W25W&cd44=4&cd45=Fri%20Jul%2031%202020%2002%3A00%3A00%20GMT%2B0200%20(Central%20European%20Summer%20Time)&z=1734586312
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 07 Aug 2020 08:04:36 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
482966
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j83&tid=UA-24152976-22&cid=385117900.1597270441&jid=511696037&gjid=2111920225&_gid=1221958855.1597270441&_u=aGDAiEAjR~&z=1487152758
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=385117900.1597270441&jid=511696037&_v=j83&z=1487152758
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=385117900.1597270441&jid=511696037&_v=j83&z=1487152758&slf_rd=1&random=3735091254
42 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=385117900.1597270441&jid=511696037&_v=j83&z=1487152758&slf_rd=1&random=3735091254
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:02 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=385117900.1597270441&jid=511696037&_v=j83&z=1487152758&slf_rd=1&random=3735091254
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
0b9ae0631dc9cb1d12dd2eb240ef07bb.png
static.reuters.com/resources_v2/react/cookie-reset-b74/ 		22 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.reuters.com/resources_v2/react/cookie-reset-b74/0b9ae0631dc9cb1d12dd2eb240ef07bb.png
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-30.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
9f9104dee58871cdb561e4f139fcf095a2fc1fcb0a7778a964975e6b12059c6a

Request headers

Referer
https://static.reuters.com/resources_v2/react/cookie-reset-b74/article.bundle.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 00:12:58 GMT
content-encoding
gzip
age
79287
x-cache
Hit from cloudfront
status
200
content-length
9050
last-modified
Thu, 06 Aug 2020 21:01:22 GMT
server
nginx
vary
Accept-Encoding
content-type
image/png
via
1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
x-amz-cf-id
f4EkQMk70HikJXRD27ZNw2RR3Q1hCU80jNt5whZZw-e6ie3IDd0p5w==
expires
Thu, 13 Aug 2020 00:12:35 GMT
/
static.reuters.com/resources/r/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.reuters.com/resources/r/?m=02&d=20200812&t=2&i=1529399733&r=LYNXNPEG7B0P3&w=120
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-30.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
6f4ae319a9f80c61a3c9734248d8be481ae430185443f3b2747bc1b4f617cc8f

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 21:31:11 GMT
via
1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
x-amz-expiration
expiry-date="Sat, 12 Sep 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified
Wed, 12 Aug 2020 21:17:15 GMT
server
nginx
age
2571
etag
"7bff502a77ef4d417ccc5b02c79a36d3"
x-cache
Hit from cloudfront
x-amz-version-id
f6xlBLFwfiX4dHtmj4I1UbZZbQl4wdKw
status
200
x-amz-cf-pop
DUS51-C1
content-type
image/jpeg
content-length
1831
x-amz-cf-id
LyRYxO1ZIhBL5tiLIiGczbCvo2avCZzlF-tdVxcdMqSGehnWQGSnVA==
/
static.reuters.com/resources/r/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.reuters.com/resources/r/?m=02&d=20200812&t=2&i=1529329016&r=LYNXNPEG7B0PA&w=120
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-30.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
deebd915997d1fc20b8c17b0ac9e57a20b84cb44a54858b18d0ad0ee6ea51f5a

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 10:30:10 GMT
via
1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
x-amz-expiration
expiry-date="Sat, 12 Sep 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified
Wed, 12 Aug 2020 10:20:11 GMT
server
nginx
age
42232
etag
"758ffec099d7a1e63dcb76ef5a815fdd"
x-cache
Hit from cloudfront
x-amz-version-id
3gjoPXEtuzQ0hPztG09uRglvhBw6By_1
status
200
x-amz-cf-pop
DUS51-C1
content-type
image/jpeg
content-length
3453
x-amz-cf-id
4IQTTwUG7XsE_J9vjF0ZoXkPwGoe5syTFYbAB-gcPfH333bWDPALhg==
/
static.reuters.com/resources/r/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.reuters.com/resources/r/?m=02&d=20200811&t=2&i=1529196472&r=LYNXNPEG7A0N6&w=120
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-30.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
62c155232156eb11fcfd2db27dc8304f7c2fd810da25bfa7740ef28b0b156f88

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
msd_zdO3pS8XGXFU0GWNDWAbszZeVy_g
via
1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
x-amz-expiration
expiry-date="Fri, 11 Sep 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified
Tue, 11 Aug 2020 12:27:57 GMT
server
nginx
age
34732
etag
"34bdde8058497a81615be5df096f5a05"
x-cache
Hit from cloudfront
content-type
image/jpeg
status
200
date
Wed, 12 Aug 2020 12:35:11 GMT
x-amz-cf-pop
DUS51-C1
content-length
2177
x-amz-cf-id
ZZLPP2ularW3nHOxmQmW-lL0pAbs3qXTD38LeksOAY2tfz59p4HxMg==
/
static.reuters.com/resources/r/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.reuters.com/resources/r/?m=02&d=20200812&t=2&i=1529284349&r=LYNXNPEG7B02O&w=120
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-30.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
25adad9ca79b728ee179d70f9f9251b37634f92ddc1421d1e4204b1fbad4e303

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 04:05:22 GMT
via
1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
x-amz-expiration
expiry-date="Sat, 12 Sep 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified
Wed, 12 Aug 2020 02:00:18 GMT
server
nginx
age
65320
etag
"f4dcc1a43f8e8e69191d9b322c09df72"
x-cache
Hit from cloudfront
x-amz-version-id
nZUmN3Gxuxf9IGq3cUUGVDwbxfhN0JdW
status
200
x-amz-cf-pop
DUS51-C1
content-type
image/jpeg
content-length
2257
x-amz-cf-id
_jt1CbvvwAJlqw1sMwaUgBJM5xL9RfasGNPY1mhR2rje5gdEMxF3Hw==
/
static.reuters.com/resources/r/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.reuters.com/resources/r/?m=02&d=20200812&t=2&i=1529400432&r=LYNXNPEG7B1OJ&w=120
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.30 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-30.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
67032371580ed843d5a9460d87afa85e4c02983a1dc620b38020d311308f4e59

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 21:40:40 GMT
via
1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
x-amz-expiration
expiry-date="Sat, 12 Sep 2020 00:00:00 GMT", rule-id="ExpiraIn30Days"
last-modified
Wed, 12 Aug 2020 21:29:12 GMT
server
nginx
age
2002
etag
"a5e9afa95255b808d9ad6e1f05168034"
x-cache
Hit from cloudfront
x-amz-version-id
Bss26jeXJh963MfHzmHaezzKixPdy1B2
status
200
x-amz-cf-pop
DUS51-C1
content-type
image/jpeg
content-length
3342
x-amz-cf-id
WoLTxMQMpuk1ZSFGRHGbxK1BgSsQO8o_rrx8Uea8MVMUE_6oAvT7jw==
pub
pixel.adsafeprotected.com/services/ 		324 B
556 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pixel.adsafeprotected.com/services/pub?anId=10764&slot=%7Bid:dpslot_mpu_4630042_USKCN24W25W,ss:%5B300.250,300.600,1.1%5D,p:/4735792/us.reuters/tentpoles/cyberrisk/article,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=decf2e45-70cc-c948-9e01-3e0db1b9369c&url=https%253A%252F%252Fwww.reuters.com%252Farticle%252Fus-cyber-cwt-ransom%252Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Requested by
Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.102.72 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-102-72.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
90ccdd961b13e4d360559359104a17514700c2f888f2880599170ca377dfcbcb

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:02 GMT
x-server-name
app11.ie.303net.net
status
200
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.reuters.com
access-control-expose-headers
X-Server-Name
access-control-allow-credentials
true
timing-allow-origin
*
server
nginx
pub
pixel.adsafeprotected.com/services/ 		331 B
564 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pixel.adsafeprotected.com/services/pub?anId=10764&slot=%7Bid:canvas_leaderboard_9324928926299638_USKCN24W25W,ss:%5B728.90,970.250,970.90,1100.100,1100.90,1100.250,1.1%5D,p:/4735792/us.reuters/tentpoles/cyberrisk/article,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=decf2e45-70cc-c948-9e01-3e0db1b9369c&url=https%253A%252F%252Fwww.reuters.com%252Farticle%252Fus-cyber-cwt-ransom%252Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Requested by
Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.102.72 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-102-72.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
99e0ec85e006482952c415bc44c752871b89bd197b6a2d299144b1fd0311db44

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:02 GMT
x-server-name
app14.ie.303net.net
status
200
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.reuters.com
access-control-expose-headers
X-Server-Name
access-control-allow-credentials
true
timing-allow-origin
*
server
nginx
pub
pixel.adsafeprotected.com/services/ 		56 B
289 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pixel.adsafeprotected.com/services/pub?anId=10764&slot=%7Bid:dpslot_connatix_8147211_USKCN24W25W,s:1100,420.1100,400.fluid,p:/4735792/us.reuters/tentpoles/cyberrisk/article,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=decf2e45-70cc-c948-9e01-3e0db1b9369c&url=https%253A%252F%252Fwww.reuters.com%252Farticle%252Fus-cyber-cwt-ransom%252Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Requested by
Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.102.72 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-102-72.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
bf3669795bba5ee81c6defbeb24c48986d4693233ce0964138e897363527c3af

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:02 GMT
x-server-name
app09.ie.303net.net
status
200
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.reuters.com
access-control-expose-headers
X-Server-Name
access-control-allow-credentials
true
timing-allow-origin
*
server
nginx
pub
pixel.adsafeprotected.com/services/ 		290 B
523 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pixel.adsafeprotected.com/services/pub?anId=10764&slot=%7Bid:dpslot_bizdev_article_rr2_13808924_USKCN24W25W,ss:%5B300.280,300.250%5D,p:/4735792/us.reuters/tentpoles/cyberrisk/article,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=decf2e45-70cc-c948-9e01-3e0db1b9369c&url=https%253A%252F%252Fwww.reuters.com%252Farticle%252Fus-cyber-cwt-ransom%252Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Requested by
Host: cdn.adsafeprotected.com
URL: https://cdn.adsafeprotected.com/iasPET.1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.102.72 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-102-72.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
a938823e28bf7fe7d6192a30d952abd9446417d12bffd9047ef5849f56d21df5

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:02 GMT
x-server-name
app25.ie.303net.net
status
200
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.reuters.com
access-control-expose-headers
X-Server-Name
access-control-allow-credentials
true
timing-allow-origin
*
server
nginx
mcxSiteIntercept-1.9.1.js
siteintercept.allegiancetech.com/InterceptScripts/ 		33 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://siteintercept.allegiancetech.com/InterceptScripts/mcxSiteIntercept-1.9.1.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W9SLGS
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
67.221.239.62 , United States, ASN27467 (RACKMY-STL-AS1, US),
Reverse DNS
67-221-239-62.www.allegiancetech.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
47b498fc79a4b9d57c126b8ae0769ad842913bf897910c2fdd74801c82f2dc6f

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 22:14:02 GMT
Content-Encoding
gzip
ETag
"80f84e47b0d51:0"
Last-Modified
Wed, 11 Dec 2019 17:18:51 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
X-Alleg-Server
cw03
Content-Length
9156
/
www.facebook.com/tr/ 		0
83 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundarybuHASOkQ7afsml6F

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
server
proxygen-bolt
date
Wed, 12 Aug 2020 22:14:02 GMT
status
200
content-type
text/plain
access-control-allow-origin
https://www.reuters.com
access-control-allow-credentials
true
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
0
chartbeat_video.js
static.chartbeat.com/js/ 		69 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.chartbeat.com/js/chartbeat_video.js
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2182:3c00:18:1fcd:34e:d2a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
ba607af2c8d414ab6d4bac90c526d90a939cb0adf507b6ba063265347479159d

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 21:33:42 GMT
content-encoding
gzip
last-modified
Fri, 24 Apr 2020 00:58:19 GMT
server
nginx
age
2420
etag
W/"5ea239ab-11347"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
status
200
cache-control
max-age=7200
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
WQg-a6cJS5V6YYgpMBU6zBYfJvaHWmob83CZTxyKY8PghHwxsNnxiQ==
via
1.1 147cd286989da71c73312280bb09c200.cloudfront.net (CloudFront)
expires
Wed, 12 Aug 2020 23:33:42 GMT
checksync.php
contextual.media.net/ Frame 36B0 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8CUF1VN4G&prvid=3%2C23%2C28%2C29%2C33%2C38%2C41%2C51%2C54%2C56%2C59%2C69%2C72%2C74%2C76%2C77%2C80%2C82%2C84%2C97%2C106%2C108%2C109%2C113%2C117%2C118%2C122%2C126%2C138%2C139%2C141%2C145%2C147%2C159%2C172%2C173%2C174%2C175%2C178%2C182%2C184%2C188%2C193%2C201%2C203%2C208%2C214%2C222%2C225%2C226%2C3004%2C3007%2C3008%2C3010%2C3012%2C3014%2C3015%2C3017&rtime=782&https=1&usp_status=0&usp_consent=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/bidexchange.js?cid=8CUF1VN4G&dn=www.reuters.com&version=4.1&https=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

:method
GET
:authority
contextual.media.net
:scheme
https
:path
/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8CUF1VN4G&prvid=3%2C23%2C28%2C29%2C33%2C38%2C41%2C51%2C54%2C56%2C59%2C69%2C72%2C74%2C76%2C77%2C80%2C82%2C84%2C97%2C106%2C108%2C109%2C113%2C117%2C118%2C122%2C126%2C138%2C139%2C141%2C145%2C147%2C159%2C172%2C173%2C174%2C175%2C178%2C182%2C184%2C188%2C193%2C201%2C203%2C208%2C214%2C222%2C225%2C226%2C3004%2C3007%2C3008%2C3010%2C3012%2C3014%2C3015%2C3017&rtime=782&https=1&usp_status=0&usp_consent=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Response headers

status
200
server
Apache
content-type
text/html; charset=UTF-8
set-cookie
visitor-id=2402720425348371000V10; Expires=Thu, 12 Aug 2021 22:14:02 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2
E
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
strict-transport-security
max-age=604800
vary
Accept-Encoding
content-encoding
gzip
cache-control
max-age=28464
expires
Thu, 13 Aug 2020 06:08:26 GMT
date
Wed, 12 Aug 2020 22:14:02 GMT
content-length
8324
tag.min.js
get.s-onetag.com/4ed1416f-67eb-4d50-8a45-916a5921fee8/ 		42 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://get.s-onetag.com/4ed1416f-67eb-4d50-8a45-916a5921fee8/tag.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W9SLGS
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.37 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-37.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f37beed085d2cfdd1386a8942434d8011aa20f2e7afa20d7edfd0d49998da1e7

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
null
content-encoding
gzip
last-modified
Thu, 09 Jul 2020 16:33:02 GMT
server
AmazonS3
age
32
date
Wed, 12 Aug 2020 22:13:30 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
status
200
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
CHRDJxsxsYj_RUyDxkf7T7VPN9Z0-Yzue5mozHCQgp0HQYzf3hwzIQ==
via
1.1 90dd5141cd2d05c51d479a582cded281.cloudfront.net (CloudFront)
i
api.segment.io/v1/ 		21 B
141 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.segment.io/v1/i
Requested by
Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/IEWBqQ8VWHijTQxb7lEBGFGS9uIJzigZ/analytics.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.218.0.69 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-218-0-69.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

status
200
date
Wed, 12 Aug 2020 22:14:02 GMT
access-control-allow-origin
https://www.reuters.com
content-length
21
vary
Origin
content-type
application/json
collect
www.google-analytics.com/ 		35 B
90 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j83&aip=1&a=242085792&t=timing&_s=2&dl=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&dp=%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&ul=en-us&de=UTF-8&dt=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=2620&pdt=53&dns=1&rrt=0&srt=381&tcp=77&dit=920&clt=920&_gst=547&_gbt=580&_cst=468&_cbt=537&_u=aHDAiEAjR~&jid=89411162&gjid=1037336812&cid=385117900.1597270441&tid=UA-24152976-22&_gid=1221958855.1597270441&cd2=Cyberrisk&cd11=us-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals&cd4=Article%20-%20News&cd32=Fri%20Jul%2031%202020%2002%3A00%3A00%20GMT%2B0200%20(Central%20European%20Summer%20Time)&cd8=0&cd10=Slideshow&cd9=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&cd19=Page%20Load&cd7=Desktop&cd6=U.S.&cd5=Article&cd17=Jack%20Stubbs&cd3=Tentpoles%20-%20Cyberrisk&cd1=Tentpoles&cd13=529&cd18=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals&cd38=false&cd40=RCOMUS_Cyberrisk&cd41=us.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&cd42=USKCN24W25W&cd43=KCN24W25W&cd44=4&cd45=Fri%20Jul%2031%202020%2002%3A00%3A00%20GMT%2B0200%20(Central%20European%20Summer%20Time)&z=1416815434
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 07 Aug 2020 08:04:36 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
482966
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
Redirect Chain
  • https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j83&tid=UA-24152976-22&cid=385117900.1597270441&jid=89411162&gjid=1037336812&_gid=1221958855.1597270441&_u=aHDAiEAjR~&z=602098230
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=385117900.1597270441&jid=89411162&_v=j83&z=602098230
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=385117900.1597270441&jid=89411162&_v=j83&z=602098230&slf_rd=1&random=1711448837
42 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=385117900.1597270441&jid=89411162&_v=j83&z=602098230&slf_rd=1&random=1711448837
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:02 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-24152976-22&cid=385117900.1597270441&jid=89411162&_v=j83&z=602098230&slf_rd=1&random=1711448837
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ping
ping.chartbeat.net/ 		43 B
168 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ping.chartbeat.net/ping?h=reuters.com&p=reuters.com%2Farticle%2Fus-cyber-cwt-ransom-idUSKCN24W25W&u=CgH9HCCSIxHMC3h0h2&d=reuters.com&g=52639&g0=Cyberrisk&g1=Jack%20Stubbs&g4=Article&n=1&f=00001&c=0&x=0&m=0&y=7286&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=2620&t=CTmWJ-ezW7fB5xOjqBEIp93pFBUC&V=120&i=%27Payment%20sent%27%20-%20travel%20giant%20CWT%20pays%20%244.5%20million%20ransom%20to%20cyber%20criminals%20-%20Reuters&tz=-120&sn=1&sv=BDriXAD2u5nvcaPeeaqCJ8C-1-n6&sd=1&im=06679cf0&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.178.4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-178-4.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
pragma
no-cache
date
Wed, 12 Aug 2020 22:14:03 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
/
s3.reutersmedia.net/resources/r/ 		68 B
460 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.reutersmedia.net/resources/r/?m=02&d=20170626&t=2&i=9391632524&w=300&fh=&fw=&ll=&pl=&sq=&rtn=LYNNXMPEGJ3BB4&x30y10&r=LIYXPPGG10FT
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.87 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-87.dus51.r.cloudfront.net
Software
ADFCDN/5.2.3 / AdDefend GmbH
Resource Hash
adfa0c7de03bc3bea3de80b4a4514881c8b6296568f43a5acd5cd7a16fffd1c9

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:02 GMT
via
1.1 9e627a2e7bf673974b02e3bf374bb843.cloudfront.net (CloudFront)
server
ADFCDN/5.2.3
x-amz-cf-pop
DUS51-C1
x-powered-by
AdDefend GmbH
x-cache
Miss from cloudfront
content-type
image/png
status
200
cache-control
max-age=0, max-stale=0, must-revalidate, no-cache, no-store, no-transform, post-check=0, pre-check=0, private
accept-ranges
bytes
content-length
68
x-amz-cf-id
kLJze3qkkoMrQwFWxsCXHkXqkhL2HaQwzBYiMyWq3ba-0wFA0MZARA==
expires
0
beacon.min.js
beacon.s-onetag.com/ 		18 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beacon.s-onetag.com/beacon.min.js
Requested by
Host: get.s-onetag.com
URL: https://get.s-onetag.com/4ed1416f-67eb-4d50-8a45-916a5921fee8/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2182:d000:5:9a4c:9b00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d640ed39630d91dec61dcb107b977293ec29fecbb5e74467e017d872bf76b0db

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
iJO00mi5pglap2bW60H1GBGtloYAnC3A
content-encoding
gzip
last-modified
Thu, 09 Apr 2020 15:07:03 GMT
server
AmazonS3
age
140014
date
Tue, 11 Aug 2020 07:20:29 GMT
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
status
200
cache-control
max-age=172800
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
qwu4nYswhU1SqrQP4gOK3MNzy2kJHSKAjA2qYhHlIPrvbCr-pR5ryQ==
via
1.1 0ee6aea018b9489b266252370f1e002e.cloudfront.net (CloudFront)
/
s3.reutersmedia.net/resources/r/adinclude/ 		68 B
459 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.reutersmedia.net/resources/r/adinclude/?m=02&d=20170520&t=2&i=3572511741&w=201&fh=&fw=&ll=&pl=&sq=2&r=CNHE3BB4.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.87 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-87.dus51.r.cloudfront.net
Software
ADFCDN/5.2.3 / AdDefend GmbH
Resource Hash
adfa0c7de03bc3bea3de80b4a4514881c8b6296568f43a5acd5cd7a16fffd1c9

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:02 GMT
via
1.1 9e627a2e7bf673974b02e3bf374bb843.cloudfront.net (CloudFront)
server
ADFCDN/5.2.3
x-amz-cf-pop
DUS51-C1
x-powered-by
AdDefend GmbH
x-cache
Miss from cloudfront
content-type
image/png
status
200
cache-control
max-age=0, max-stale=0, must-revalidate, no-cache, no-store, no-transform, post-check=0, pre-check=0, private
accept-ranges
bytes
content-length
68
x-amz-cf-id
iXKTmY8qfbsqizeepqjUbp96qrQQFjoQ-ChdBT4ucljY8QTwh5SQOQ==
expires
0
rtbsspub
cdneu-xch.media.net/AdExchange/ 		23 KB
24 KB 		EventSource
General
Check archive.org
Download Go to
Full URL
https://cdneu-xch.media.net/AdExchange/rtbsspub?&gdpr=0&gdprconsent=0&usp_enf=1&usp_status=0&us_privacy=1YN-&cid=8CUF1VN4G&region=eu&ptrid=8PRL4E7N3&requestString=391166652*51%7C300x250~300x600%7C973973%7C11084976~11084976%7C0.07%7C%7C1%40391166652*80%7C300x250~300x600%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C0.06%7C%7C1%40391166652*84%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C391166652%7C%7C%7C3%40391166652*117%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C391166652_8CUF1VN4G%7C%7C%7C3%40391166652*145%7C300x600~300x250%7C100600%7C147215~147215%7C%7C%7C1%40391166652*172%7C300x250~300x600%7C8CUF1VN4G%7C15331955~15331955%7C0.06%7C%7C1%40391166652*175%7C300x600~300x250%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C0.01%7C%7C1%40391166652*178%7C300x600~300x250%7C8CUF1VN4G%7C391166652_8CUF1VN4G~391166652_8CUF1VN4G%7C%7C%7C1%40451439109*51%7C300x250%7C973973%7C11084979%7C0.07%7C%7C1%40451439109*80%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C0.06%7C%7C1%40451439109*84%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C451439109%7C%7C%7C3%40451439109*117%7C1x1_TB4M82W_1%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C3%40451439109*145%7C300x250%7C100600%7C147218%7C%7C%7C1%40451439109*172%7C300x250%7C8CUF1VN4G%7C15331958%7C0.06%7C%7C1%40451439109*175%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C0.01%7C%7C1%40451439109*178%7C300x250%7C8CUF1VN4G%7C451439109_8CUF1VN4G%7C%7C%7C1%40518121357*80%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C0.06%7C%7C1%40518121357*84%7C1x1_T645KQG_1%7C8CUF1VN4G%7C518121357%7C%7C%7C3%40518121357*117%7C1x1_T645KQG_1%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C3%40518121357*145%7C728x90%7C100600%7C147217%7C%7C%7C1%40518121357*172%7C728x90%7C8CUF1VN4G%7C15331957%7C0.06%7C%7C1%40518121357*175%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C0.01%7C%7C1%40518121357*178%7C728x90%7C8CUF1VN4G%7C518121357_8CUF1VN4G%7C%7C%7C1%40612341223*51%7C728x90%7C973973%7C11084975%7C0.69%7C%7C1%40612341223*80%7C728x90%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C0.06%7C%7C1%40612341223*84%7C1x1_T645KQG_1%7C8CUF1VN4G%7C612341223%7C%7C%7C3%40612341223*117%7C1x1_T645KQG_1%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C%7C%7C3%40612341223*145%7C728x90~970x250%7C100600%7C147214~147214%7C%7C%7C1%40612341223*172%7C728x90~970x250%7C8CUF1VN4G%7C15303527~15303527%7C0.06%7C%7C1%40612341223*175%7C728x90%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C0.01%7C%7C1%40612341223*178%7C728x90%7C8CUF1VN4G%7C612341223_8CUF1VN4G%7C%7C%7C1&crid=391166652%2C451439109%2C518121357%2C612341223&sd=1&requrl=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&bl=1&rt=5&dn=https://www.reuters.com&https=1&act=cache&prvReqId=385913960491851221597270443045&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.1051148055168365&ndec=1&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1600%2C%22vh%22%3A1200%2C%22ph%22%3A7307%7D&itype=HB&cc=CH&rc=ZH&ct=ZURICH&sid=8973&scc=1&tmt=300&section=us.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&prid=8PRVCXX19&switch=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.62.140.165 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
204e4bc3052ec43891fa672b858f1c5277a0d4f02b3757ca0343fb577ed86aba

Request headers

Accept
text/event-stream
Cache-Control
no-cache
Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:03 GMT
status
200
content-type
text/event-stream;charset=UTF-8
access-control-allow-origin
https://www.reuters.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
timing-allow-origin
*, *
expires
Wed, 12 Aug 2020 22:14:03 GMT
rtbsspub
cdneu-xch.media.net/AdExchange/ 		4 KB
4 KB 		EventSource
General
Check archive.org
Download Go to
Full URL
https://cdneu-xch.media.net/AdExchange/rtbsspub?&gdpr=0&gdprconsent=0&usp_enf=1&usp_status=0&us_privacy=1YN-&cid=8CUF1VN4G&region=eu&ptrid=8PRL4E7N3&requestString=391166652*59%7C300x250~300x600%7C8CUF1VN4G%7C_112891~_112891%7C0.07%7C%7C1%40451439109*59%7C300x250%7C8CUF1VN4G%7C_112891%7C0.07%7C%7C1%40612341223*59%7C728x90~970x250%7C8CUF1VN4G%7C_112891~_112891%7C0.07%7C%7C1%40894667540*59%7C300x250%7C8CUF1VN4G%7C_112891%7C0.07%7C%7C1&crid=391166652%2C451439109%2C612341223%2C894667540&sd=1&requrl=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&bl=1&rt=5&dn=https://www.reuters.com&https=1&act=cache&prvReqId=138084666264344791597270443050&erTr=0&hlt=1&ugd=4&adt=desktop&tr=0.43331035325762834&ndec=1&rtusuid=%7B%2259%22%3A%223cedce45-e10f-4462-bb3c-24b9f18fb858~~15%22%7D&scrsize=1600x1200&taginfo=%7B%7D&pageinfo=%7B%22vw%22%3A1600%2C%22vh%22%3A1200%2C%22ph%22%3A7307%7D&itype=HB&cc=CH&rc=ZH&ct=ZURICH&sid=8973&scc=1&tmt=300&section=us.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&prid=8PRVCXX19
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.62.140.165 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-62-140-165.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e7005c02b5be4507faa3beb9121e27257e69da872075c186cbac15e6ab910c3e

Request headers

Accept
text/event-stream
Cache-Control
no-cache
Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:03 GMT
status
200
content-type
text/event-stream;charset=UTF-8
access-control-allow-origin
https://www.reuters.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
timing-allow-origin
*, *
expires
Wed, 12 Aug 2020 22:14:03 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		65 KB
17 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=451836963902823&correlator=1735550971918508&output=ldjh&impl=fifs&adsid=NT&eid=21067056%2C21066289%2C21066992&vrg=2020080501&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200812&iu_parts=4735792%2Cus.reuters%2Ctentpoles%2Ccyberrisk%2Carticle&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=300x250%7C300x600%7C1x1%2C728x90%7C970x250%7C970x90%7C1100x100%7C1100x90%7C1100x250%7C1x1%2C320x50%7C1100x420%7C1100x400%2C300x280%7C300x250&fluid=0%2C0%2Cheight%2C0&prev_scp=type%3Dmpu%26div_id%3D4630042%26pixel_distance%3D400%26articleID%3DUSKCN24W25W%26storychannel%3DRCOMUS_Cyberrisk%253Bcyber-risk-full%253BRCOM-cyberrisk-extended%253Bcyber-security%253BbusinessNews%253Bcompanies-semi%253BeverythingNews%253BUS-The-Wire%253BUSWire_EL%253Bcompanies-swit%26story%3D0%26template%3Darticle%26p_count%3D19%26asset%3Dimage%26id%3D20dbd5c0-dce9-11ea-bb13-024bf4a6d028%26vw%3D40%2C50%2C60%2C70%2C80%26grm%3D40%2C50%2C60%2C70%2C80%26pub%3D40%2C50%2C60%2C70%26mnetDNB%3D1%26mnetPageID%3D1%26mnetCV%3D3%26mnetCC%3DCH%26mnetUGD%3D4%7Ctype%3Dleaderboard%26div_id%3D9324928926299638%26articleID%3DUSKCN24W25W%26storychannel%3DRCOMUS_Cyberrisk%253Bcyber-risk-full%253BRCOM-cyberrisk-extended%253Bcyber-security%253BbusinessNews%253Bcompanies-semi%253BeverythingNews%253BUS-The-Wire%253BUSWire_EL%253Bcompanies-swit%26story%3D0%26template%3Darticle%26p_count%3D19%26asset%3Dimage%26id%3D20dbd5f3-dce9-11ea-ab9f-02c390e9b11a%26vw%3D40%2C50%2C60%2C70%26grm%3D40%2C50%2C60%2C70%26pub%3D40%2C50%2C60%2C70%26mnetDNB%3D1%26mnetPageID%3D4%26mnetCV%3D3%26mnetCC%3DCH%26mnetUGD%3D4%7Ctype%3Dconnatix%26div_id%3D8147211%26pixel_distance%3D20000%26articleID%3DUSKCN24W25W%26storychannel%3DRCOMUS_Cyberrisk%253Bcyber-risk-full%253BRCOM-cyberrisk-extended%253Bcyber-security%253BbusinessNews%253Bcompanies-semi%253BeverythingNews%253BUS-The-Wire%253BUSWire_EL%253Bcompanies-swit%26story%3D0%26template%3Darticle%26p_count%3D19%26asset%3Dimage%7Ctype%3Dbizdev_article_rr2%26div_id%3D13808924%26pixel_distance%3D20000%26articleID%3DUSKCN24W25W%26storychannel%3DRCOMUS_Cyberrisk%253Bcyber-risk-full%253BRCOM-cyberrisk-extended%253Bcyber-security%253BbusinessNews%253Bcompanies-semi%253BeverythingNews%253BUS-The-Wire%253BUSWire_EL%253Bcompanies-swit%26story%3D0%26template%3Darticle%26p_count%3D19%26asset%3Dimage%26id%3D20dbd535-dce9-11ea-ac85-06a809c23df0%26vw%3D40%26grm%3D40%2C50%26pub%3D40%26mnetDNB%3D1%26mnetPageID%3D5%26mnetCV%3D3%26mnetCC%3DCH%26mnetUGD%3D4&cust_params=bidxc%3D1%26admant%3DAccentureAPAC_Negative%252CArtificial_Intelligence%252CBarclays%252CBarclays_2%252CBoeing_Neg%252CBofA_Neg%252CBofA_Neg_Topics%252CCME_Negative%252CCognizant_Coronavirus_3%252CDIT_Negative_kw1%252CDWA-Cisco-Coronavirus%252CExxon_Negative%252CFRB%252CGoldmanSachs%252CIBM%252CJPMorgan_Neg%252CJuliusBaer2020_FinancialPlanning-2%252CMSFT_Neg%252CMarcusUSDeposits_1%252CMobkoi_FB_Negative%252CNegative_Keywords_3.2%252CSaudiAramco_Negative%252CTradeWeb_AiEx%252CWorkdayPG_Neg%26ntvPlacement%3D1093478%26fr%3Dfalse%26adt%3DveryLow%26alc%3DveryLow%26dlm%3DveryLow%26drg%3DveryLow%26hat%3DveryLow%26off%3DveryLow%26vio%3DveryLow&cookie_enabled=1&bc=31&abxe=1&lmt=1597270443&dt=1597270443137&dlt=1597270440590&idt=1775&frm=20&biw=1600&bih=1200&oid=3&adxs=1140%2C-12245933%2C258%2C1140&adys=404%2C-12245933%2C3487%2C3044&adks=390661369%2C2573966859%2C3092690048%2C2562512413&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&dssz=77&icsg=11274292224&mso=512&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x-1%7C0x-1%7C754x420%7C300x-1&msz=300x-1%7C0x-1%7C754x420%7C300x-1&ga_vid=385117900.1597270441&ga_sid=1597270443&ga_hid=242085792&fws=4%2C132%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
cafe /
Resource Hash
ed98a8e8e7347f903b4e5fd2108d2c932378f5624fc308217687c62ff1ab5d3a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:03 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16732
x-xss-protection
0
google-lineitem-id
5400724040,5400723065,4806613891,-1
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138315342570,138315308411,138288736159,-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.reuters.com
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
7cfdd55c1a0273065026975cff5e535f.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://7cfdd55c1a0273065026975cff5e535f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:819::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
event
reuters.demdex.net/ 		3 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://reuters.demdex.net/event?d_dil_ver=9.3&_ts=1597270443249
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.202.86.190 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-86-190.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
db593eacb6cf64edc299e34a7f2602cb9e390f21043e948bbf0ae4f968e1e52a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v078-0a6cd4988.edge-irl1.demdex.com 5.76.0.20200805085924 4ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
92IFn+zOT/M=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.reuters.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
2933
Expires
Thu, 01 Jan 1970 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame B407 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvwp1G4HVbjk2QMoFnzsLxMmY6BkAP37VdbOoBAHsMkQYItUVAYWd3CitivMZ5QbajDmk6M-MujWzYv01WV3y6EVRiNZV2DJXZrmzqvhNwhrg1s1G1UxR14_dSVTk3vifmFogQSxZQ1TyebPy-NqAn2oGb-jlr2mcu-rH9HdEa3pIj4pHDXHxowecqCwx90fgP7gc9WOLG1aVXZZ_33ERMFfQYjIBXMpyCqLZ-gZdMtLN0Ge6b9EUsLMEONKNfRE8aO2gdofybjiOGTp5Luhp3RwF3cvnjDqSkZWJ-LPSKsZQ&sig=Cg0ArKJSzP9UkEBcHoh3EAE&urlfix=1&adurl=
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 12 Aug 2020 22:14:03 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
/
track.adform.net/adfscript/ Frame B407 		20 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/adfscript/?bn=37798403;click=https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjsuBKGEJIghmslVHIsGGal9zxzpqmlB5IBawEuvtPdv0D3i-uZ4gqPd-YWnQV214j4ikOES4193-Sa865INE8-nd7c_r3jszvAkB5P7KJB5MXA5jt3xrM6HXFnj7jzt4iaZCj-qREucTfKqm_Fq8mdC699RPujQA6WsEZNmBLOPAiMkKC4bADfMJp9hIyEaRl_RB_WQelqb3bGDpa3zjkpy6yRuAtYZb7UaXMj7QX4dt1TnsGXlFPSuFw9XZcDzDKo6nEl3KyUSpb0USDUw7fasnCJzONgJwgGOS-EhmEw&sig=Cg0ArKJSzCJaqc2g8kHWEAE&urlfix=1&adurl=
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
85c45ca12ba3ed0f93ec9c7f2c8a4ee46da8fdadfcb5841234080d7f2454a04e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:03 GMT
content-encoding
gzip
server
nginx
status
200
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/javascript; charset=utf-8
content-length
9928
expires
-1
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame B407 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c516c523ffceafbf9482017d73bbcea30b998c15ca9de148fc00514561daaf67
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1597059737948561"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
28328
x-xss-protection
0
expires
Wed, 12 Aug 2020 22:14:03 GMT
moatad.js
z.moatads.com/reutersdfpcw319687550988/ Frame B407 		307 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/reutersdfpcw319687550988/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
11558e1d027dc06afd27bf2613c169508a497d802019b0d97c417097977f00e8

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:03 GMT
content-encoding
gzip
last-modified
Wed, 29 Jul 2020 14:58:25 GMT
server
AmazonS3
x-amz-request-id
352C3CD7E782C9B6
etag
"06798e04d86839b070d5ea052c4d21a3"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=55072
accept-ranges
bytes
content-length
105048
x-amz-id-2
lv0+mroHSSkpj/PdhFrrkaQcmNHD9q4c8Mi9LhbPmdM6Gtj+HxsdstOwvu6C8G+YNVqL/3vjXPY=
view
securepubads.g.doubleclick.net/pcs/ Frame 531B 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuKfvz4BpJcMw8JxT1ac-SqZUoQWABHnAa0nLEjQxNuih2rRuSqmvHcd22xpxiYvT9mqZG7nFxeHaN_nOQv10QGylfPoPTJgP2Si-Dm_kRPpV9gPRtQd9bsK7lXWiGo1n_DeDCGJr0AEqhx2dQEyO-0ZJnE859FiMe8RdFil2Xn6uHGkblWqO2Hk185yKNTrKXgf2kYaOKPx4asQvQNY11UOjgQb6Y4vXUvHZAPaY5GbldpRNxkavBAKYbdEEWI50722lGwXk58xdwtTqpbaqspEpsTd99C3EyerKI4EVvgPg&sig=Cg0ArKJSzFCO-2qqsivIEAE&urlfix=1&adurl=
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 12 Aug 2020 22:14:03 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
/
track.adform.net/adfscript/ Frame 531B 		20 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/adfscript/?bn=37798389;click=https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjssiE4xmZc0S2REx4IChmplwLkN_GHCzIL6uDNYR2wq060C1zuEl_7fJB6BvyQ28S9o-zWkLoZ2srXdE66juwocBGy5pcpjDaePkMzW0pxdiNX4xf95ioPuLKuZRStCIhXJNQHBsdFHMPv7PlW9CbXH71_j_eajl9NrS7Pq3R1QiIyVVvi4BHzflwOLzXqkTEHsl26zKREdUrbWg17PSFzIdw1UZ_pRpixOhWwr1exCoUsvPQZYPWu0l0OmvNESILByBLHNHy9VZy5sLfLVyfAKbNNm31n5-MwsKABMcCw&sig=Cg0ArKJSzGMwxZDXMOxGEAE&urlfix=1&adurl=
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
3054b0161a1a4aa7ad8ef3f4711612a7aa7a196905f30ff61f8c6d87b5b2270f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:03 GMT
content-encoding
gzip
server
nginx
status
200
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/javascript; charset=utf-8
content-length
9925
expires
-1
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 531B 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c516c523ffceafbf9482017d73bbcea30b998c15ca9de148fc00514561daaf67
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1597059737948561"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
28328
x-xss-protection
0
expires
Wed, 12 Aug 2020 22:14:03 GMT
moatad.js
z.moatads.com/reutersdfpcw319687550988/ Frame 531B 		307 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/reutersdfpcw319687550988/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
11558e1d027dc06afd27bf2613c169508a497d802019b0d97c417097977f00e8

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:03 GMT
content-encoding
gzip
last-modified
Wed, 29 Jul 2020 14:58:25 GMT
server
AmazonS3
x-amz-request-id
352C3CD7E782C9B6
etag
"06798e04d86839b070d5ea052c4d21a3"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=55072
accept-ranges
bytes
content-length
105048
x-amz-id-2
lv0+mroHSSkpj/PdhFrrkaQcmNHD9q4c8Mi9LhbPmdM6Gtj+HxsdstOwvu6C8G+YNVqL/3vjXPY=
view
securepubads.g.doubleclick.net/pcs/ Frame 8844 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvX7A3FIwFLbChE_2-pA0491tc2tGl_JOQJ3yGCMVOV0qZAWKtVS-DCnMFqq7ca24zd4KzdJjwBSxzSyy4o-7eZHHhwG_FeIfO8eb8kktJOHznJzEsDFcZF2QodWa4Io4BltMDUXe2mICQM2XvgjnM_zvAFqw0KWLRqnuFihwcOJ8TJxk9bnxx7AKMiBzF2S50H-RV4wlngKVw1rmuspR7UkQYM1pAqOyARDQkQONfJwVfLyEIxc2oSKuyqhLazs8Iw1G8f2XkuTOYrsd1leqbD9kNz5IRxHReeE84U&sig=Cg0ArKJSzGniPlBoj1kMEAE&urlfix=1&adurl=
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 12 Aug 2020 22:14:03 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
connatix.player.dc.js
cds.connatix.com/p/44385/ Frame 40AE
Redirect Chain
  • https://cd.connatix.com/connatix.player.js
  • https://cds.connatix.com/p/44385/connatix.player.dc.js
800 KB
198 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/44385/connatix.player.dc.js
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f9b0def9c2f40e6dd8149a4166a4364fb3c27337e9d3e63bfbc265ecaa1f9058

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:03 GMT
content-encoding
gzip
age
27654
x-cache
HIT, HIT
status
200
content-length
202778
x-served-by
cache-dca17776-DCA, cache-hhn4082-HHN
access-control-allow-origin
*
last-modified
Wed, 12 Aug 2020 13:58:48 GMT
x-timer
S1597270444.754846,VS0,VE0
etag
"078c3c9ab4ad1e400d37fa3dc7a4c768"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish, 1.1 varnish
cache-control
max-age=31557600
accept-ranges
bytes
x-cache-hits
1, 1986

Redirect headers

date
Wed, 12 Aug 2020 22:14:03 GMT
via
1.1 varnish
server
Varnish
age
0
x-served-by
cache-hhn4082-HHN
status
302
x-cache
HIT
location
https://cds.connatix.com/p/44385/connatix.player.dc.js
cache-control
no-cache, no-store, must-revalidate, max-age=0
accept-ranges
bytes
x-timer
S1597270444.706691,VS0,VE0
content-length
0
retry-after
0
x-cache-hits
0
osd_listener.js
www.googletagservices.com/activeview/js/current/ Frame 8844 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c516c523ffceafbf9482017d73bbcea30b998c15ca9de148fc00514561daaf67
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1597059737948561"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
28328
x-xss-protection
0
expires
Wed, 12 Aug 2020 22:14:03 GMT
moatad.js
z.moatads.com/reutersdfpcw319687550988/ Frame 8844 		307 KB
103 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/reutersdfpcw319687550988/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
11558e1d027dc06afd27bf2613c169508a497d802019b0d97c417097977f00e8

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:03 GMT
content-encoding
gzip
last-modified
Wed, 29 Jul 2020 14:58:25 GMT
server
AmazonS3
x-amz-request-id
352C3CD7E782C9B6
etag
"06798e04d86839b070d5ea052c4d21a3"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=55072
accept-ranges
bytes
content-length
105048
x-amz-id-2
lv0+mroHSSkpj/PdhFrrkaQcmNHD9q4c8Mi9LhbPmdM6Gtj+HxsdstOwvu6C8G+YNVqL/3vjXPY=
5400724040
dfp-gateway.s-onetag.com/1/4735792/ 		112 B
581 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dfp-gateway.s-onetag.com/1/4735792/5400724040
Requested by
Host: get.s-onetag.com
URL: https://get.s-onetag.com/4ed1416f-67eb-4d50-8a45-916a5921fee8/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.85 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-85.dus51.r.cloudfront.net
Software
/
Resource Hash
482d82a54d9618d1038baffb214f05b2257d25fae39a68365f97fb1257f9f54a

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 04:20:44 GMT
via
1.1 04599a8a3c6eb66f23e5ae02d1ec4cf2.cloudfront.net (CloudFront), 1.1 8033f9c6b87a03b2eca7c2db5157e10e.cloudfront.net (CloudFront)
age
64399
x-amzn-requestid
fbdb0c58-cb5f-487f-af43-24de0d961391
status
200
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=86400, public
x-amzn-trace-id
Root=1-5f336e1b-3a2cb1cd10608b964234b5ab;Sampled=0
x-amz-cf-pop
FRA6-C1, DUS51-C1
x-amz-apigw-id
RI4kYEKDCYcFYIQ=
content-length
112
x-amz-cf-id
xky9NuL0Dzf_5_zbHlDSPtiI9B0fCKHJPujNStyTTILgEUiqfnoogQ==
5400723065
dfp-gateway.s-onetag.com/1/4735792/ 		112 B
582 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dfp-gateway.s-onetag.com/1/4735792/5400723065
Requested by
Host: get.s-onetag.com
URL: https://get.s-onetag.com/4ed1416f-67eb-4d50-8a45-916a5921fee8/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.85 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-85.dus51.r.cloudfront.net
Software
/
Resource Hash
482d82a54d9618d1038baffb214f05b2257d25fae39a68365f97fb1257f9f54a

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 13:13:44 GMT
via
1.1 163be08bc1bc44818353c4fd88655bee.cloudfront.net (CloudFront), 1.1 8033f9c6b87a03b2eca7c2db5157e10e.cloudfront.net (CloudFront)
age
32419
x-amzn-requestid
ed43bc7c-4479-49e6-a0e4-68c9d7442444
status
200
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=86400, public
x-amzn-trace-id
Root=1-5f33eb08-ca001c571759ac2750472c52;Sampled=0
x-amz-cf-pop
FRA6-C1, DUS51-C1
x-amz-apigw-id
RKGpUGrfCYcFZwA=
content-length
112
x-amz-cf-id
9n_1Gf2_ukk8HJZhfqxHevQB4XRl6OvPOtRpBMhO8sSaP61s8Zqwng==
4806613891
dfp-gateway.s-onetag.com/1/4735792/ 		114 B
581 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dfp-gateway.s-onetag.com/1/4735792/4806613891
Requested by
Host: get.s-onetag.com
URL: https://get.s-onetag.com/4ed1416f-67eb-4d50-8a45-916a5921fee8/tag.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.85 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-85.dus51.r.cloudfront.net
Software
/
Resource Hash
698a0d14189cdfa590d112b056e978324c551080f63a9e0b340b6f1b204af296

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 21:29:21 GMT
via
1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront), 1.1 8033f9c6b87a03b2eca7c2db5157e10e.cloudfront.net (CloudFront)
age
2682
x-amzn-requestid
207f4e37-ad94-4b2a-a6b1-7251f0796d5d
status
200
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=86400, public
x-amzn-trace-id
Root=1-5f345f31-7e59d9250bddb0639e0eed51;Sampled=0
x-amz-cf-pop
FRA6-C1, DUS51-C1
x-amz-apigw-id
RLPPuEmXiYcFlpw=
content-length
114
x-amz-cf-id
0aUWqHSQIjAL3ePDg6R6MGODJEkqEnoiRRiFAZ_DpD04yzQ9uQQaag==
osd.js
www.googletagservices.com/activeview/js/current/ 		71 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
394415bedb33f0d07d610f1ac10439e12098d7a747aca0510cddabca81a9092d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1597059737948561"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
27037
x-xss-protection
0
expires
Wed, 12 Aug 2020 22:14:03 GMT
amp4ads-v0.js
cdn.ampproject.org/rtv/012007302351000/ Frame 6B32 		206 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012007302351000/amp4ads-v0.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
68ff86e6a3bc683739e7190e4efaff20bbafe0d89c99c42c1b17163ef5203968
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
30146
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
57393
x-xss-protection
0
server
sffe
date
Wed, 12 Aug 2020 13:51:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"6c9ea7f49fde3b6d"
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 12 Aug 2021 13:51:37 GMT
amp-ad-exit-0.1.js
cdn.ampproject.org/rtv/012007302351000/v0/ Frame 6B32 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012007302351000/v0/amp-ad-exit-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ee1ed7b578e1ef6fc0b4eac9c4f9eaa16f3301fce096666526e9d08e4956bb5d
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
49106
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5908
x-xss-protection
0
server
sffe
date
Wed, 12 Aug 2020 08:35:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"da3eb6a12045948e"
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 12 Aug 2021 08:35:37 GMT
amp-analytics-0.1.js
cdn.ampproject.org/rtv/012007302351000/v0/ Frame 6B32 		96 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012007302351000/v0/amp-analytics-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e41f07eced66e12809bec654b0a18677a78a7814525dcb6b99934d0b4bcecfc4
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
30150
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29738
x-xss-protection
0
server
sffe
date
Wed, 12 Aug 2020 13:51:33 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"c56a9dc6dcfd844b"
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 12 Aug 2021 13:51:33 GMT
amp-fit-text-0.1.js
cdn.ampproject.org/rtv/012007302351000/v0/ Frame 6B32 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012007302351000/v0/amp-fit-text-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
18c44f4e64c66d0c037bfd7ed0c8fae6f4e25f395135d2a6e06aa233f01173f4
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
49106
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1782
x-xss-protection
0
server
sffe
date
Wed, 12 Aug 2020 08:35:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"9975c81b3db44358"
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 12 Aug 2021 08:35:37 GMT
amp-form-0.1.js
cdn.ampproject.org/rtv/012007302351000/v0/ Frame 6B32 		48 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/rtv/012007302351000/v0/amp-form-0.1.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
187ef47cfc091c4fc645d78e6e4c56951cdd6144e5b9a6adddfacc286f1b1aa6
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
age
49322
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14954
x-xss-protection
0
server
sffe
date
Wed, 12 Aug 2020 08:32:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/javascript
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000
etag
"536b0698dfd565aa"
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 12 Aug 2021 08:32:01 GMT
truncated
/ Frame 6B32 		213 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7ce982087ae44317f0aad7450b6c076b373c33b183833e7808dd6c3d6dcef3cc

Request headers

Referer
https://www.reuters.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
15984391418006660896
tpc.googlesyndication.com/simgad/ Frame 6B32 		37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/15984391418006660896?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qnRaU-m0lPHU04-rYyrSOVRvzfHqQ
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1812b780b33437b1222ebf3f6e7ae84051aa024f36bca24105f8df529d022dc7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 10 Aug 2020 10:56:22 GMT
x-content-type-options
nosniff
last-modified
Wed, 17 Jun 2020 11:24:21 GMT
server
sffe
age
213461
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37567
x-xss-protection
0
expires
Tue, 10 Aug 2021 10:56:22 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6B32 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 12 Aug 2020 11:08:58 GMT
x-content-type-options
nosniff
server
cafe
age
39905
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 13 Aug 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6B32 		295 B
518 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 12 Aug 2020 21:26:58 GMT
x-content-type-options
nosniff
server
cafe
age
2825
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Thu, 13 Aug 2020 21:26:58 GMT
l
www.google.com/ads/measurement/ Frame 6B32 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaStqnZm0uk3KLU6H8_EueNUkrjgMEWfjlt5wQdFBXcwNltXTHnXSM24hQD98eikaaaZLUM_5w_0dDZ82BGif7gPG94W_w
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.reuters.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
adview
securepubads.g.doubleclick.net/pagead/ Frame 6B32 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CuNeBq2k0X-WoDdSHgAfgwZSQC5W0_NdersLS3OELv-EeEAEg2p61FWD1lc6B4ASgAYeiqdwCyAECqQLk9Jh-icWzPuACAKgDAcgDCKoE1wJP0Jrc7eYeYVuV2Rtlg2wK2nB_wGPklWqM4mTw1otgRn0gDF1NLaUuE0EbM4LvhvuT0BR70r5vnnv7-E_4MCEW1lSlmoIwN-43g_RI3kzoxkFGHtczasjcIfmc3XzP-qh7Kt7xCXf0EZjQyQT1nvD9aV2_7e_cPRsT4SyjqMGaa9b8Dp4Bxcay_S-1o-kADbeHlaes0oLRiH9vnkDzMtGqCPRzdqEzVI7R5CNJRvS2uth0W2JmxAwxAU7l0tzlYjdBzjfVg8H226mlc-i_ao2PGzNu10WPWVP31xY4uCwNZTFsWhIWAIdLu6SOK8P179e2AFJUANCnBxPGdSLzhn1-3EyoDXDK0c_7xFBvA6B_F1T7Gi1vNtg5iaQUWK5PQrZDT90lL_8gKBL57mZvPCPdVH13rTj8ljy1NuI7tlD2SAMkwtcLnHMCT-6E72OUG8iHRD0exb5WwATqr42v7wLgBAGSBQQIBBgBkgUECAUYBKAGAoAHqs3p1gGoB47OG6gH1ckbqAeT2BuoB7oGqAfw2RuoB_LZG6gHpr4bqAfs1RvYBwHyBwQQgNkM0ggHCIBhEAEYHYAKA8gLAdgTDA&sigh=PsTfD69ksfQ&tpd=AGWhJmt2A4Y2zQzDQhbNkY7VY7wLBaiFjFPBWEc7sZ2A8mUTeQ
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.reuters.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
sodar
pagead2.googlesyndication.com/getconfig/ 		8 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020080501&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d20fce09ded558cf0c4bac7cb324828ee1ba17624eaed51fbdc53e953ff2686d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 12 Aug 2020 22:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
6340
x-xss-protection
0
truncated
/ Frame 8844 		215 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f546cca1ccf7330b7ba05ca0ab0064d979340e169a0ccdd527dd35e3d996b6d2

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
jload
pixel.adsafeprotected.com/ Frame 3BCA 		46 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pixel.adsafeprotected.com/jload?anId=10764&campId=1100x420&pubId=20159232&chanId=247866432&placementId=4806613891&pubCreative=138288736159&pubOrder=453477432&cb=339954935&custom=connatix&custom2=20000&custom3=0&adsafe_par&impId=
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.102.72 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-102-72.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
c183c1626bcd7149328ea3ac80731240cca401982a790d89ed973771275f455f

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:03 GMT
content-encoding
gzip
x-server-name
app18.ie.303net.net
status
200
content-type
application/javascript;charset=utf-8
access-control-allow-origin
pixel.adsafeprotected.com
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
expires
Wed, 31 Dec 1969 23:59:59 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020080501.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1591403518460474"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5540
x-xss-protection
0
expires
Wed, 12 Aug 2020 22:14:03 GMT
si
googleads.g.doubleclick.net/pagead/drt/ Frame 6B32
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date
Wed, 12 Aug 2020 22:14:03 GMT
x-content-type-options
nosniff
server
safe
status
302
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si
cache-control
private
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
246
x-xss-protection
0
bootstrap.js
s1.adform.net/stoat/620/s1.adform.net/ Frame B407 		33 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Requested by
Host: track.adform.net
URL: https://track.adform.net/adfscript/?bn=37798403;click=https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjsuBKGEJIghmslVHIsGGal9zxzpqmlB5IBawEuvtPdv0D3i-uZ4gqPd-YWnQV214j4ikOES4193-Sa865INE8-nd7c_r3jszvAkB5P7KJB5MXA5jt3xrM6HXFnj7jzt4iaZCj-qREucTfKqm_Fq8mdC699RPujQA6WsEZNmBLOPAiMkKC4bADfMJp9hIyEaRl_RB_WQelqb3bGDpa3zjkpy6yRuAtYZb7UaXMj7QX4dt1TnsGXlFPSuFw9XZcDzDKo6nEl3KyUSpb0USDUw7fasnCJzONgJwgGOS-EhmEw&sig=Cg0ArKJSzCJaqc2g8kHWEAE&urlfix=1&adurl=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
bf6f96985d9f9ab3332721601ff06191bfb8630e60fcf414cdde0cdf4e5eb811

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
last-modified
Thu, 09 Jul 2020 14:30:32 GMT
server
nginx
status
200
x-cache-status
HIT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=100000
expires
Fri, 14 Aug 2020 01:55:52 GMT
bootstrap.js
s1.adform.net/stoat/620/s1.adform.net/ Frame 531B 		33 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Requested by
Host: track.adform.net
URL: https://track.adform.net/adfscript/?bn=37798389;click=https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjssiE4xmZc0S2REx4IChmplwLkN_GHCzIL6uDNYR2wq060C1zuEl_7fJB6BvyQ28S9o-zWkLoZ2srXdE66juwocBGy5pcpjDaePkMzW0pxdiNX4xf95ioPuLKuZRStCIhXJNQHBsdFHMPv7PlW9CbXH71_j_eajl9NrS7Pq3R1QiIyVVvi4BHzflwOLzXqkTEHsl26zKREdUrbWg17PSFzIdw1UZ_pRpixOhWwr1exCoUsvPQZYPWu0l0OmvNESILByBLHNHy9VZy5sLfLVyfAKbNNm31n5-MwsKABMcCw&sig=Cg0ArKJSzGMwxZDXMOxGEAE&urlfix=1&adurl=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
bf6f96985d9f9ab3332721601ff06191bfb8630e60fcf414cdde0cdf4e5eb811

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
last-modified
Thu, 09 Jul 2020 14:30:32 GMT
server
nginx
status
200
x-cache-status
HIT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=100000
expires
Fri, 14 Aug 2020 01:55:52 GMT
n.js
geo.moatads.com/ 		112 B
287 B 		Script
General
Check archive.org
Download Go to
Full URL
https://geo.moatads.com/n.js?e=35&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%26GGfD.%5BH%7BQ&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=REUTERSDFPCW3&hp=1&wf=1&vb=4&cm=14&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1597270443864&de=832240886420&m=0&ar=2bf682d4aa-clean&iw=4490aac&q=2&cb=0&ym=0&cu=1597270443864&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=20159232%3A453477432%3A4806613891%3A138288736159&zMoatTP=connatix&zMoatStory=0&zMoatAU=%2F4735792%2Fus.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&zMoatPixelDistance=20000&zMoatRawSlicer1=3735912&zMoatRawSlicer2=247866432&zMoatReutersSlicer1=3735912&zMoatReutersSlicer2=247866432&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&id=1&ii=4&bo=3735912&bd=247866432&zMoatOrigSlicer1=3735912&zMoatOrigSlicer2=247866432&dfp=0%2C1&la=247866432&gw=reutersdfpcw319687550988&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A806%3A806%3A2626%3A920&fs=183324&na=1811484904&cs=0&callback=DOMlessLLDcallback_27826943
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/reutersdfpcw319687550988/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.10.133.216 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-10-133-216.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
9e9e2039d789de658a139f9993f8c1809671246f7c9f1b3d5792fc2c8e19e500

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
server
TornadoServer/4.5.3
etag
"183c3b324c7c79636fede4543d8ff96afffa6402"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
112
n.js
geo.moatads.com/ 		114 B
288 B 		Script
General
Check archive.org
Download Go to
Full URL
https://geo.moatads.com/n.js?e=35&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%26GGfD.%5BH%7BQ&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=REUTERSDFPCW3&hp=1&wf=1&vb=4&cm=14&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1597270443864&de=832240886420&m=0&ar=2bf682d4aa-clean&iw=4490aac&q=3&cb=0&ym=0&cu=1597270443864&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=20159232%3A453477432%3A4806613891%3A138288736159&zMoatTP=connatix&zMoatStory=0&zMoatAU=%2F4735792%2Fus.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&zMoatPixelDistance=20000&zMoatRawSlicer1=3735912&zMoatRawSlicer2=247866432&zMoatReutersSlicer1=3735912&zMoatReutersSlicer2=247866432&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&id=1&ii=4&bo=3735912&bd=247866432&zMoatOrigSlicer1=3735912&zMoatOrigSlicer2=247866432&dfp=0%2C1&la=247866432&gw=reutersdfpcw319687550988&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A806%3A806%3A2626%3A920&fs=183324&na=1531145081&cs=0&callback=MoatDataJsonpRequest_27826943
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/reutersdfpcw319687550988/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.10.133.216 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-10-133-216.eu-west-2.compute.amazonaws.com
Software
TornadoServer/4.5.3 /
Resource Hash
3f52c3c54dadb4127c6f861b5f3105d0167c1edaf2fbc001edb2263e4fea72ea

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
server
TornadoServer/4.5.3
etag
"0f4cb235f67ef1fc1db8677560a205f062b6a5fb"
content-type
text/html; charset=UTF-8
status
200
cache-control
max-age=900
timing-allow-origin
*
content-length
114
view
securepubads.g.doubleclick.net/pcs/ Frame 8844 		0
54 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssaNl1Xf0M8kBkxUTsORiBSuJey9pPbxyKL3KQWDHNQEh4xm6Bjj8bvHm9_6D9_9m6kH1kMhf-dE28SkW93Um4o_WR1iJ7-iXU1xzO6_ieDcq4Pfdx3b3Tik1OsJibftS_XKJ3M2PNzt3nwKlSCeWHZLuogM1_gNV33dzVpBzIay4zBgjaxjxPdWgwLCQFhG_-CIapHtb_4ZB4Uvj_u6CBEqr3C7HqbXlwx1ba6gHY-i3Us2aNuy85vwihET-q3_akuvOPPFNdiO47gTMdr5dNp96MGAb0LN1OqnkFnz9c&sig=Cg0ArKJSzAmffL14UQ5IEAE&urlfix=1&adurl=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 12 Aug 2020 22:14:03 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame 294E 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/210/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W

Response headers

status
200
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
content-length
4590
date
Wed, 12 Aug 2020 21:20:01 GMT
expires
Thu, 12 Aug 2021 21:20:01 GMT
last-modified
Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
3242
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
connatix.player.css
cds.connatix.com/p/44385/ 		49 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/44385/connatix.player.css
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/44385/connatix.player.dc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ce2ba098bd8570d95c60d33cc035ee6764193c8ff7e0d7a531d0e1e98e9ad592

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
age
27655
x-cache
HIT, HIT
status
200
content-length
8095
x-served-by
cache-dca17739-DCA, cache-hhn4082-HHN
access-control-allow-origin
*
last-modified
Wed, 12 Aug 2020 13:58:48 GMT
x-timer
S1597270444.043586,VS0,VE0
etag
"880884ab75ace2385f14bd369f4ab798"
vary
Accept-Encoding
content-type
text/css
via
1.1 varnish, 1.1 varnish
cache-control
max-age=31557600
accept-ranges
bytes
x-cache-hits
1, 2228
15984391418006660896
tpc.googlesyndication.com/simgad/ Frame 6B32 		37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/15984391418006660896?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qnRaU-m0lPHU04-rYyrSOVRvzfHqQ
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012007302351000/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1812b780b33437b1222ebf3f6e7ae84051aa024f36bca24105f8df529d022dc7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 10 Aug 2020 10:56:22 GMT
x-content-type-options
nosniff
last-modified
Wed, 17 Jun 2020 11:24:21 GMT
server
sffe
age
213462
status
200
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37567
x-xss-protection
0
expires
Tue, 10 Aug 2021 10:56:22 GMT
en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6B32 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/en.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012007302351000/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 12 Aug 2020 11:08:58 GMT
x-content-type-options
nosniff
server
cafe
age
39906
etag
14819457070020093239
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2502
x-xss-protection
0
expires
Thu, 13 Aug 2020 11:08:58 GMT
icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 6B32 		295 B
356 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012007302351000/amp4ads-v0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 12 Aug 2020 21:26:58 GMT
x-content-type-options
nosniff
server
cafe
age
2826
etag
426692510519060060
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
public, max-age=86400
content-type
image/png
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Thu, 13 Aug 2020 21:26:58 GMT
main.gr.19.8.111.js
static.adsafeprotected.com/ Frame 3BCA 		172 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.adsafeprotected.com/main.gr.19.8.111.js
Requested by
Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=10764&campId=1100x420&pubId=20159232&chanId=247866432&placementId=4806613891&pubCreative=138288736159&pubOrder=453477432&cb=339954935&custom=connatix&custom2=20000&custom3=0&adsafe_par&impId=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2182:6e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
34cdb6307b099bbbbe4bd77a40fc926d20d665f864aa629a060a8348eeb1df58

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 11 Aug 2020 15:21:00 GMT
content-encoding
gzip
age
111184
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
last-modified
Tue, 11 Aug 2020 15:04:59 GMT
server
AmazonS3
etag
W/"fc8b8074cb052ac77c1348a5b1d26a7a"
vary
Accept-Encoding
x-amz-version-id
mbfh50bvtCpFumq34uSouA0rbdqMfBTn
via
1.1 e542677c3bd2d6c30a5ed3dab78f8476.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
content-type
application/javascript
x-amz-cf-id
BuDX_6kTtKMcSMrbucdME7Ds88KXRNi_rBCaBmFOfUcsRlWmoH1DKQ==
pls
capi.connatix.com/core/ Frame 40AE 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/core/pls?v=44385
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/44385/connatix.player.dc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.128.233.190 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-128-233-190.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
6268b1c20e1456226c8c1f44d691bcee210b83fa7d9d2647bceddcf273980074

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Wed, 12 Aug 2020 22:14:04 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://www.reuters.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
1374
sca.17.4.114.js
static.adsafeprotected.com/ Frame 2E58 		81 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.adsafeprotected.com/sca.17.4.114.js
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2182:6e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ad9ae0374e0334d2511e951a2381a164fa87ce86594fc027d25a8624774c3c96

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 30 Jun 2020 05:16:22 GMT
content-encoding
gzip
age
3776263
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
last-modified
Mon, 13 Jan 2020 23:54:54 GMT
server
AmazonS3
vary
Accept-Encoding
x-amz-version-id
gSPddsS9N0PGtUp2YQy7vCAfLQOR874Z
via
1.1 e542677c3bd2d6c30a5ed3dab78f8476.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
content-type
application/javascript
x-amz-cf-id
a2YZMOnJVW0Noyyca7vp3D-Jr03z85_keUrYWEjpQQXX3glSsPiyBA==
mon
pixel.adsafeprotected.com/ 		43 B
216 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.adsafeprotected.com/mon?anId=10764&campId=1100x420&pubId=20159232&chanId=247866432&placementId=4806613891&pubCreative=138288736159&pubOrder=453477432&cb=339954935&custom=connatix&custom2=20000&custom3=0&adsafe_par&impId=&adsafe_url=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&adsafe_type=abdfq&adsafe_jsinfo=,id:55b8a3c1-412d-a461-d624-aa86ab3cb2d9,c:ldqH7O,sl:outOfView,em:true,fr:true,mn:app18ie,pt:1-5-15,wc:0.0.1600.1200,ac:258.3769.1100.420,am:i,cc:258.3769.1100.420,piv:0,obst:0,th:0,reas:l,br:u,abv:na,an:n,oam:0,scm:publ1.grpm1,fm:s7uw0la+11|12|13|14|15|16|17|18|191|1a|1b|1c*.10764|1c1|1c2|1d|1e|1f1,idMap:1c*,pl:,rmeas:1,rend:1,renddet:DIV.qs.sn,es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,tt:jload,thd:1,et:81,oid:21a73b87-dce9-11ea-af54-0ab32f77e5b0,v:19.8.111,sp:1,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.102.72 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-102-72.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:04 GMT
x-server-name
app30.ie.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
status
200
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=55b8a3c1-412d-a461-d624-aa86ab3cb2d9&tv={c:ldqH7Q,pingTime:-8,time:82,type:l,es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:0,o:83,n:0,pp:0,pm:0},slEvents:[{sl:o,t:80,wc:0.0.1600.1200,ac:258.3769.1100.420,am:i,cc:258.3769.1100.420,piv:0,obst:0,th:0,reas:l,bkn:{piv:[22~0],as:[22~1100.420]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:s7uw0la+11|12|13|14|15|16|17|18|191|1a|1b|1c*.10764|1c1|1c2|1d|1e|1f1,idMap:1c*,rmeas:1,rend:1,renddet:DIV.qs.sn}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:04 GMT
X-Server-Name
dt57ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=55b8a3c1-412d-a461-d624-aa86ab3cb2d9&tv={c:ldqH8k,pingTime:-2,time:112,type:a,im:{sf:0,pom:1,prf:{beA:359,beZ:360,mfA:415,cmA:417,inA:417,inZ:423,prA:423,prZ:430,si:440,poA:442,poZ:455,cmZ:455,mfZ:455,loA:464,loZ:467,ltA:470,ltZ:470}},sca:{dfp:{df:4,sz:1100.420,dom:div}},env:{cca:true,gca:true,gca2:false},clog:[{piv:0,vs:o,r:l,w:1100,h:420,t:80}],es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:0,o:112,n:0,pp:0,pm:0},slEvents:[{sl:o,t:80,wc:0.0.1600.1200,ac:258.3769.1100.420,am:i,cc:258.3769.1100.420,piv:0,obst:0,th:0,reas:l,bkn:{piv:[51~0],as:[51~1100.420]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:s7uw0la+11|12|13|14|15|16|17|18|191|1a|1b|1c*.10764|1c1|1c2|1d|1e|1f1,idMap:1c*,rmeas:1,rend:1,renddet:DIV.qs.sn,slid:[google_ads_iframe_/4735792/us.reuters/tentpoles/cyberrisk/article_2,google_ads_iframe_/4735792/us.reuters/tentpoles/cyberrisk/article_2__container__,dpslot_connatix_8147211_USKCN24W25W,USKCN24W25W],sinceFw:27,readyFired:true}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:04 GMT
X-Server-Name
dt57ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=55b8a3c1-412d-a461-d624-aa86ab3cb2d9&tv={c:ldqH8W,time:150,type:e,env:{ar:self.0},es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:0,o:150,n:0,pp:0,pm:0},slEvents:[{sl:o,t:80,wc:0.0.1600.1200,ac:258.3769.1100.420,am:i,cc:258.3769.1100.420,piv:0,obst:0,th:0,reas:l,bkn:{piv:[89~0],as:[89~1100.420]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:s7uw0la+11|12|13|14|15|16|17|18|191|1a|1b|1c*.10764|1c1|1c2|1d|1e|1f1,idMap:1c*,rmeas:1,rend:1,renddet:DIV.qs.sn}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:04 GMT
X-Server-Name
dt77ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
/
track.adform.net/wpf/v2/kla44j1c.lY5BNvcKyAdMUDFBpBeA0fUm7qKFz0Xnj3wMvsD7z5meTuCUMz_WMXWMYGzXJJIneGffLMC7EZ3QHPBirTYKUowRslzRQqwSM2ieQTNHkdn.MqgXK_Pmtd0SHp815LyjaY2.rINj.rINM6uJ6o6e0T.5yjaY1WMsiZRP... Frame B407 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/wpf/v2/kla44j1c.lY5BNvcKyAdMUDFBpBeA0fUm7qKFz0Xnj3wMvsD7z5meTuCUMz_WMXWMYGzXJJIneGffLMC7EZ3QHPBirTYKUowRslzRQqwSM2ieQTNHkdn.MqgXK_Pmtd0SHp815LyjaY2.rINj.rINM6uJ6o6e0T.5yjaY1WMsiZRPrwXC_JEkNgvlE4yy2XElgebiYMpztNKscKsoUs_43wuZPup_nH2t05oaYAhrcpMxE6DBUr5xj6Kkveara3g9Rk4xf7_OLgiPFMtrs1OeyjaY1vSiwqyJkRQOneNufuyPBDjaY2ftckuyPBB2SCX0iakJrPKJg7FduevMAR0odm_dhrxbuJjkWxv5iJ3A0KAGYidY.0Y.KI6JseI_FeWrTKIwcMw9UXGfe2Rc7L1eWNNW5BNlYiMeBNlY0bAQk45BPQkYjSXu_XVA4.L9.gJ0Nc1lF4XV4L9.J1pNc0KAKXVPyPDI_XVPyPDI_XV8Lf4.90PgJ.huy.4Bp/adfserve/?CC=1&bn=37798403;click=https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjsuBKGEJIghmslVHIsGGal9zxzpqmlB5IBawEuvtPdv0D3i-uZ4gqPd-YWnQV214j4ikOES4193-Sa865INE8-nd7c_r3jszvAkB5P7KJB5MXA5jt3xrM6HXFnj7jzt4iaZCj-qREucTfKqm_Fq8mdC699RPujQA6WsEZNmBLOPAiMkKC4bADfMJp9hIyEaRl_RB_WQelqb3bGDpa3zjkpy6yRuAtYZb7UaXMj7QX4dt1TnsGXlFPSuFw9XZcDzDKo6nEl3KyUSpb0USDUw7fasnCJzONgJwgGOS-EhmEw&sig=Cg0ArKJSzCJaqc2g8kHWEAE&urlfix=1&adurl=;js=1;adfxid=1x;1833;set=en-US|en-US|1600X1200|0|300|600|24|8|3|7|0|0;gdpr=;gdpr_consent=;fd=0|2&CREFURL=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
db9e31fbe599256b6904f9f00a756db056b71cbb2c9ed370d3e238a26cbe4a61
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
server
nginx
status
200
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/javascript; charset=utf-8
content-length
2543
expires
-1
gen_204
pagead2.googlesyndication.com/pagead/ 		0
144 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gpt_2020080501&jk=451836963902823&bg=!DA-lDxdYKGs4GCKAY5wCAAAAWVIAAAAQmQGmFMeE3wR_GMGwlF-TeU_1OlOjOzTb7hRoGqTcorJSMhO4NXbBs3t8wpOvJvgwFc6pLGSeEjMFyTFpCWqDrNhR2mgUVW8wxAGXp_p51V7Nxb507mnHuQ95OEzuf14IxrzbsKUZL2oAxFB7S1TYJsL5HjqzNH4aH8kDcBWDB-4LYFP0885u9V4MSvaox1qwrXBMTJpvwPKdtSgNx_xK5SODIFga2WIMAoVqbCLeMk26NKc96qZ4_E7u5yaYorzkhL4RN1RqWjlL9bT-4ot2nP7sovILh03uOqNv_3_YMv1LVv-DXI9QA5XVQdrWjqcgtOMiQj-zKubu8av2M6BgOXS5kTreKwQtdwrpgPg2Q47pDMDiiL3F8GbE3UBvGE3pBuum-G3XroXEOykVkLBLE57jPjykLdYXE8SQnaadfiPhvPhNHxP1Z8yYjCaB_JZIbouy89JQe5ik3OMxsDyhyaUJaO5I-wWgnrbZ5KIADAySVAC4CR2t9VNmPvDwZ8TexQASrm7VKWC2GOS4hVdy2ywSbaFFM6i5cdPWiutMSVU9L7dHC2VG2hM
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:04 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
204
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
track.adform.net/wpf/v2/sla44j1c.lY5BNvcKyAdMUDFBpBeA0fUm7qKFz0Xnj3wMvsD7z5meTuCUMz_WMXWMYGzXJJIneGffLMC7EZ3QHPBirTYKUowRslzRQqwSM2ieQTNHkdn.MqgXK_Pmtd0SHp815LyjaY2.rINj.rINM6uJ6o6e0T.5yjaY1WMsiZRP... Frame 531B 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/wpf/v2/sla44j1c.lY5BNvcKyAdMUDFBpBeA0fUm7qKFz0Xnj3wMvsD7z5meTuCUMz_WMXWMYGzXJJIneGffLMC7EZ3QHPBirTYKUowRslzRQqwSM2ieQTNHkdn.MqgXK_Pmtd0SHp815LyjaY2.rINj.rINM6uJ6o6e0T.5yjaY1WMsiZRPrwXC_JEkNgvlE4yy2XElgebiYMpztNKscKsoUs_43wuZPup_nH2t05oaYAhrcpMxE6DBUr5xj6Kkveara3g9Rk4xf7_OLgiPFMtrs1OeyjaY1vSiwqyJkRQOneNufuyPBDjaY2ftckuyPBB2SCX0iakJrPKJg7FduW_iLs2dI_AIQjvEodUW2vqCRc7L1eLY6RCw.5B0KBSIXdDK1e6StKEmWUkdy85icCmVWN9e4WX3NlY5DtTclY5B5Rhj.JNldj1DxqAeL9.gJ0Nc1lF4XVA4.L9.KNc0FAKXV4JhL90ftctDL90ftctDL90q_WL9.J1pNc0Qpw.822/adfserve/?CC=1&bn=37798389;click=https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjssiE4xmZc0S2REx4IChmplwLkN_GHCzIL6uDNYR2wq060C1zuEl_7fJB6BvyQ28S9o-zWkLoZ2srXdE66juwocBGy5pcpjDaePkMzW0pxdiNX4xf95ioPuLKuZRStCIhXJNQHBsdFHMPv7PlW9CbXH71_j_eajl9NrS7Pq3R1QiIyVVvi4BHzflwOLzXqkTEHsl26zKREdUrbWg17PSFzIdw1UZ_pRpixOhWwr1exCoUsvPQZYPWu0l0OmvNESILByBLHNHy9VZy5sLfLVyfAKbNNm31n5-MwsKABMcCw&sig=Cg0ArKJSzGMwxZDXMOxGEAE&urlfix=1&adurl=;js=1;adfxid=2x;8187;set=en-US|en-US|1600X1200|0|950|250|24|8|3|7|0|0;gdpr=;gdpr_consent=;fd=0|2&CREFURL=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
c4715df69ab3c955690ad6d9b24ebe3fec4269ab1632a27f628e727d8ab5294d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
server
nginx
status
200
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/javascript; charset=utf-8
content-length
2539
expires
-1
truncated
/ Frame B407 		218 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2745a25e7c3895caeb5665057bf492a8555d724b959789d840bd2992528066ff

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
jload
pixel.adsafeprotected.com/ Frame D34D 		46 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pixel.adsafeprotected.com/jload?anId=10764&campId=300x600&pubId=4822186048&chanId=247866432&placementId=5400724040&pubCreative=138315342570&pubOrder=2708662048&cb=803177988&custom=mpu&custom2=400&custom3=0&adsafe_par&impId=20dbd5c0-dce9-11ea-bb13-024bf4a6d028
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.102.72 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-102-72.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5126084b5c3ae3d86a6c314c2cb5dcb31fba636a5ef8faafac6b182a3fcb4a5e

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
x-server-name
app06.ie.303net.net
status
200
content-type
application/javascript;charset=utf-8
access-control-allow-origin
pixel.adsafeprotected.com
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
expires
Wed, 31 Dec 1969 23:59:59 GMT
pixel.gif
px.moatads.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=17&i=REUTERSDFPCW3&hp=1&wf=1&vb=4&cm=6&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1597270444286&de=349880371230&m=0&ar=2bf682d4aa-clean&iw=4490aac&q=8&cb=0&ym=0&cu=1597270444286&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4822186048%3A2708662048%3A5400724040%3A138315342570&zMoatTP=mpu&zMoatStory=0&zMoatAU=%2F4735792%2Fus.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&zMoatPixelDistance=400&zMoatRawSlicer1=3735912&zMoatRawSlicer2=247866432&zMoatReutersSlicer1=3735912&zMoatReutersSlicer2=247866432&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&id=1&ii=4&zMoatBlacklist=true&bo=3735912&bd=247866432&zMoatOrigSlicer1=3735912&zMoatOrigSlicer2=247866432&dfp=0%2C1&la=247866432&gw=reutersdfpcw319687550988&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A806%3A806%3A2626%3A920&fs=183324&na=1901670407&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:04 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:04 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame B407 		0
54 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssOd83yNQgBcrcblnmpDLxO7iwtvp9szslEkH1Xky3D3j8NfQsSvzr7LlkpjZVfWsujh1zrrcQoq5r7XKgxOtWRVKoH8fO8K4GCRqkvqFgC-cYLACmx_f0mXid_8KmFN_XVzul_BQSBcC3fLudQbBWOGe9flgT1BAFtib1dC_rxSZoG-FRNm2Re3pPlMj3SEyC4j_n9XLt1tcTKh2YNUskc3o_VUKQ7BCFXCn1iupnuyXPAI6s7ZZhovuBg4ne7KSZI4uqfcxQnjx_f7tM-mU4qly07_V_TSaLG7zMgo2CKEdJz&sig=Cg0ArKJSzHudvnX5ZAaLEAE&urlfix=1&adurl=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 12 Aug 2020 22:14:04 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
truncated
/ Frame 531B 		215 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8b29fec90a8865477f7dd35ac532823dab44c2ea9480567f491dd61c2bf707bf

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
jload
pixel.adsafeprotected.com/ Frame B892 		46 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pixel.adsafeprotected.com/jload?anId=10764&campId=970x250&pubId=4822186048&chanId=247866432&placementId=5400723065&pubCreative=138315308411&pubOrder=2708662048&cb=340024628&custom=leaderboard&custom2=&custom3=0&adsafe_par&impId=20dbd5f3-dce9-11ea-ab9f-02c390e9b11a
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.102.72 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-102-72.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
526d41d59fc80ab6862c407300e4f7f7ea1b4e29fdbf6d9201f49598785d35c0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
x-server-name
app29.ie.303net.net
status
200
content-type
application/javascript;charset=utf-8
access-control-allow-origin
pixel.adsafeprotected.com
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
expires
Wed, 31 Dec 1969 23:59:59 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 531B 		0
54 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvNwaj35sJGO-BnVRy3kAlWbVrAJywNBk_qIFeYTgTr-T5MnKa1QNjyUUSqOyIWr_zC3lz-MKQg-yJiW_PrqjPnrwBkQU_aFyzfarlxWHbAKPoJOaEqiODXWhK5zo0VADac5q4dvQkeq5a-s4-xo8pFrt7OcQGZPWFVGsVOTCpxCx1cGY7o5UIsF2ZL-ony0LobFJ1PwMXSC-MvbYi3f4Vmo21A1z8kLgLXFt32DAlxpf8_kUkRhMWjJeFmSAcdzDTm3TDZ4Ji7EjqRq2KLKvLtVNPjAkbVNDnVHZMDtjJ0XLFH&sig=Cg0ArKJSzBnXqKNANITmEAE&urlfix=1&adurl=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 12 Aug 2020 22:14:04 GMT
x-content-type-options
nosniff
server
cafe
status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
Standard
s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.190/e/.wSBgiD/i/vCAv.IAAAAFAAA/r:AdConstructor:contents/HTML:types/ Frame B407 		89 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.190/e/.wSBgiD/i/vCAv.IAAAAFAAA/r:AdConstructor:contents/HTML:types/Standard
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
31f14d476f00f561b40eaa467c71aeeb5fcdebd2b9f09128ae16b3f536b333b8

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
last-modified
Thu, 09 Jul 2020 14:30:32 GMT
server
nginx
status
200
x-cache-status
HIT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=100000
expires
Fri, 14 Aug 2020 01:48:59 GMT
Standard
s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.190/e/.wSBgiD/i/vCAv.IAAAAFAAA/r:AdConstructor:contents/HTML:types/ Frame 531B 		89 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.190/e/.wSBgiD/i/vCAv.IAAAAFAAA/r:AdConstructor:contents/HTML:types/Standard
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
31f14d476f00f561b40eaa467c71aeeb5fcdebd2b9f09128ae16b3f536b333b8

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
last-modified
Thu, 09 Jul 2020 14:30:32 GMT
server
nginx
status
200
x-cache-status
HIT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=100000
expires
Fri, 14 Aug 2020 01:48:59 GMT
main.gr.19.8.111.js
static.adsafeprotected.com/ Frame D34D 		172 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.adsafeprotected.com/main.gr.19.8.111.js
Requested by
Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=10764&campId=300x600&pubId=4822186048&chanId=247866432&placementId=5400724040&pubCreative=138315342570&pubOrder=2708662048&cb=803177988&custom=mpu&custom2=400&custom3=0&adsafe_par&impId=20dbd5c0-dce9-11ea-bb13-024bf4a6d028
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2182:6e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
34cdb6307b099bbbbe4bd77a40fc926d20d665f864aa629a060a8348eeb1df58

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 11 Aug 2020 15:21:00 GMT
content-encoding
gzip
age
111184
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
last-modified
Tue, 11 Aug 2020 15:04:59 GMT
server
AmazonS3
etag
W/"fc8b8074cb052ac77c1348a5b1d26a7a"
vary
Accept-Encoding
x-amz-version-id
mbfh50bvtCpFumq34uSouA0rbdqMfBTn
via
1.1 e542677c3bd2d6c30a5ed3dab78f8476.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
content-type
application/javascript
x-amz-cf-id
egmgZU_KCcYpMQshS3BFIEANaEwE6N2ZE6ykRexIgqqmohPjeWj04g==
sca.17.4.114.js
static.adsafeprotected.com/ Frame E417 		81 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.adsafeprotected.com/sca.17.4.114.js
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2182:6e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ad9ae0374e0334d2511e951a2381a164fa87ce86594fc027d25a8624774c3c96

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 30 Jun 2020 05:16:22 GMT
content-encoding
gzip
age
3776263
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
last-modified
Mon, 13 Jan 2020 23:54:54 GMT
server
AmazonS3
vary
Accept-Encoding
x-amz-version-id
gSPddsS9N0PGtUp2YQy7vCAfLQOR874Z
via
1.1 e542677c3bd2d6c30a5ed3dab78f8476.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
content-type
application/javascript
x-amz-cf-id
FeHOgHwWDfJhRpfkUY9-I-8DG73WYM3xly3JkEDzovCVPgQZ8rfSKQ==
mon
pixel.adsafeprotected.com/ 		43 B
216 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.adsafeprotected.com/mon?anId=10764&campId=300x600&pubId=4822186048&chanId=247866432&placementId=5400724040&pubCreative=138315342570&pubOrder=2708662048&cb=803177988&custom=mpu&custom2=400&custom3=0&adsafe_par&impId=20dbd5c0-dce9-11ea-bb13-024bf4a6d028&adsafe_url=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&adsafe_type=abdfq&adsafe_jsinfo=,id:78329595-52b8-8b3e-9736-a2dba96ded7f,c:ldqHbA,sl:inView,em:true,fr:true,mn:app06ie,pt:1-5-15,wc:0.0.1600.1200,ac:1140.686.300.600,am:i,cc:1140.686.300.600,piv:86,obst:0,th:0,reas:,br:u,abv:na,an:n,oam:0,scm:publ1.grpm1,fm:s7uw0pE+11|12|13|14|15|16|17|18|191|1a*.10764|1a1|1b1|1c1|1c2|1c3|1d|1e,idMap:1a*,pl:,rmeas:1,rend:1,renddet:DIV.qs.sn,es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,tt:jload,thd:1,et:37,oid:21f02c12-dce9-11ea-b793-0a6d0b536c42,v:19.8.111,sp:1,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.102.72 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-102-72.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:04 GMT
x-server-name
app28.ie.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
status
200
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
main.gr.19.8.111.js
static.adsafeprotected.com/ Frame B892 		172 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.adsafeprotected.com/main.gr.19.8.111.js
Requested by
Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=10764&campId=970x250&pubId=4822186048&chanId=247866432&placementId=5400723065&pubCreative=138315308411&pubOrder=2708662048&cb=340024628&custom=leaderboard&custom2=&custom3=0&adsafe_par&impId=20dbd5f3-dce9-11ea-ab9f-02c390e9b11a
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2182:6e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
34cdb6307b099bbbbe4bd77a40fc926d20d665f864aa629a060a8348eeb1df58

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 11 Aug 2020 15:21:00 GMT
content-encoding
gzip
age
111184
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
last-modified
Tue, 11 Aug 2020 15:04:59 GMT
server
AmazonS3
etag
W/"fc8b8074cb052ac77c1348a5b1d26a7a"
vary
Accept-Encoding
x-amz-version-id
mbfh50bvtCpFumq34uSouA0rbdqMfBTn
via
1.1 e542677c3bd2d6c30a5ed3dab78f8476.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
content-type
application/javascript
x-amz-cf-id
fnxyL50MNVXe4hN-timUz_qkyhQuLkQ255zFK3EhjaSygtwNBe47wA==
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=78329595-52b8-8b3e-9736-a2dba96ded7f&tv={c:ldqHbT,pingTime:-2,time:55,type:a,im:{sf:0,pom:1,prf:{beA:60,beZ:62,mfA:88,cmA:88,inA:88,inZ:90,prA:90,prZ:94,si:97,poA:98,poZ:102,cmZ:103,mfZ:103,loA:108,loZ:109,ltA:115,ltZ:115}},sca:{dfp:{df:4,sz:300.600,dom:body}},env:{cca:true,gca:true,gca2:false},clog:[{piv:86,vs:i,r:,w:300,h:600,t:36}],es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:55,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:36,wc:0.0.1600.1200,ac:1140.686.300.600,am:i,cc:1140.686.300.600,piv:86,obst:0,th:0,reas:,bkn:{piv:[27~75],as:[27~300.600]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:s7uw0pE+11|12|13|14|15|16|17|18|191|1a*.10764|1a1|1b1|1c1|1c2|1c3|1d|1e,idMap:1a*,rmeas:1,rend:1,renddet:DIV.qs.sn,slid:[google_ads_iframe_/4735792/us.reuters/tentpoles/cyberrisk/article_0,google_ads_iframe_/4735792/us.reuters/tentpoles/cyberrisk/article_0__container__,dpslot_mpu_4630042_USKCN24W25W,USKCN24W25W],sinceFw:17,readyFired:true}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:04 GMT
X-Server-Name
dt77ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
/
track.adform.net/csimpr/ Frame B407 		35 B
469 B 		Other
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/csimpr/?bn=37798403&csi=APjiZVrsfUlX5sxp6O8H9rCy5Dl95YMyd2XTJJPmpgSb9pOb2db8eWVPWf_tWlpde0CCSFGOo8MC6CxZwVL9XQPXVEkVsynicUs7LMyenhmvdHGrRZwV4w2
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:04 GMT
server
nginx
status
200
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.reuters.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=55b8a3c1-412d-a461-d624-aa86ab3cb2d9&tv={c:ldqHdW,pingTime:-10,time:460,type:s,mvn:ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--,fsc:17.4.114v220002022000220000022002222000022220202020222220222220002222022002222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022202220020222222000220000222202222202222000002002002222222222220022202200222002220222202,sd:MTcuNC4xMTR2MTIwMHx8MTYwMHx8MXx8MXx8MjR8fDEyMDB8fDB8fDB8fDF8fGxhbmRzY2FwZS1wcmltYXJ5fHwyNHx8NC8zfHw0LzN8fDB8fDE2MDA-,no:MTcuNC4xMTR2TW96aWxsYXx8TmV0c2NhcGV8fG58fDE2fHxufHwwfHxufHxMaW51eCB4ODZfNjR8fEdlY2tvfHwyMDAzMDEwN3x8LTEyMHx8TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,asp:1597270444523||ea7abd996b9bc01a84e2022e37362700||71ff54ebddb1e090fbf173d96e2342c8||966cebcebdfdfac6ea72448eac550e04||29f26a53b1ed2eb80813c98ed55de911||d37fb090e9e93a50e0410a929c4ab5be||b4161bb151e7f84e740ea5190a0265dd||5dc6d770cdd0601fdb46b639391e924b||1576000828}
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:04 GMT
X-Server-Name
dt77ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
8259368.js
s1.adform.net/Banners/Elements/Files/6268/8259368/ Frame 5D8E 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/6268/8259368/8259368.js?ADFassetID=8259368&bv=513
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
ea1e888e9399dc32e3c68344589b20d11e8ee2532efd971961ab0dd219e39674
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
last-modified
Tue, 23 Jun 2020 11:57:37 GMT
server
nginx
status
200
etag
W/"5ef1ee31-cb1"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
/
track.adform.net/csimpr/ Frame 531B 		35 B
469 B 		Other
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/csimpr/?bn=37798389&csi=Lb1ex--fL4hhBewJpK3ZwO0SOjd7BMaqd2XTJJPmpgSb9pOb2db8eWVPWf_tWlpde0CCSFGOo8MC6CxZwVL9XQPXVEkVsynicUs7LMyenhmvdHGrRZwV4w2
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:04 GMT
server
nginx
status
200
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.reuters.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
8259383.js
s1.adform.net/Banners/Elements/Files/6268/8259383/ Frame CB85 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/6268/8259383/8259383.js?ADFassetID=8259383&bv=513
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
1fb1163d28187416e25e2045924072c9b884118c56dcfc91188e032e5b506669
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
last-modified
Tue, 23 Jun 2020 11:57:41 GMT
server
nginx
status
200
etag
W/"5ef1ee35-cb1"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
sca.17.4.114.js
static.adsafeprotected.com/ Frame 71AC 		81 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.adsafeprotected.com/sca.17.4.114.js
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:2182:6e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ad9ae0374e0334d2511e951a2381a164fa87ce86594fc027d25a8624774c3c96

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 30 Jun 2020 05:16:22 GMT
content-encoding
gzip
age
3776263
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
status
200
x-amz-replication-status
COMPLETED
last-modified
Mon, 13 Jan 2020 23:54:54 GMT
server
AmazonS3
vary
Accept-Encoding
x-amz-version-id
gSPddsS9N0PGtUp2YQy7vCAfLQOR874Z
via
1.1 e542677c3bd2d6c30a5ed3dab78f8476.cloudfront.net (CloudFront)
cache-control
max-age=315360000
x-amz-cf-pop
DUS51-C1
content-type
application/javascript
x-amz-cf-id
zTE_7-wnlcH8sYyXagw7_9F01Icett8TBXqJjJDzaMxJHVeAHedaRA==
mon
pixel.adsafeprotected.com/ 		43 B
216 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.adsafeprotected.com/mon?anId=10764&campId=970x250&pubId=4822186048&chanId=247866432&placementId=5400723065&pubCreative=138315308411&pubOrder=2708662048&cb=340024628&custom=leaderboard&custom2=&custom3=0&adsafe_par&impId=20dbd5f3-dce9-11ea-ab9f-02c390e9b11a&adsafe_url=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&adsafe_type=abdfq&adsafe_jsinfo=,id:7dff01c3-41a1-89d6-d214-73e57b44b54e,c:ldqHeL,sl:inView,em:true,fr:true,mn:app29ie,pt:1-5-15,wc:0.0.1600.1200,ac:315.92.970.250,am:i,cc:315.92.970.250,piv:100,obst:0,th:0,reas:,br:u,abv:na,an:n,oam:0,scm:publ1.grpm1,fm:s7uw0qt+11|12|13|14|15|16|17|18|191|1a1|1a2|1a3|1b*.10764|1b1|1b2|1c1|1c2|1c3|1d|1e,idMap:1b*,pl:,rmeas:1,rend:1,renddet:DIV.qs.sn,es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,tt:jload,thd:1,et:182,oid:21f471e1-dce9-11ea-add3-0ae27972a930,v:19.8.111,sp:1,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.215.102.72 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-215-102-72.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:04 GMT
x-server-name
app09.ie.303net.net
p3p
CP="COM NAV INT STA NID OUR IND NOI"
status
200
cache-control
no-cache
content-type
image/gif
content-length
43
server
nginx
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=7dff01c3-41a1-89d6-d214-73e57b44b54e&tv={c:ldqHeL,pingTime:-8,time:182,type:l,es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:182,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:182,wc:0.0.1600.1200,ac:315.92.970.250,am:i,cc:315.92.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[10~100],as:[10~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:s7uw0qt+11|12|13|14|15|16|17|18|191|1a1|1a2|1a3|1b*.10764|1b1|1b2|1c1|1c2|1c3|1d|1e,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:04 GMT
X-Server-Name
dt77ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=7dff01c3-41a1-89d6-d214-73e57b44b54e&tv={c:ldqHf0,pingTime:0,time:197,type:pf,clog:[{piv:100,vs:i,r:,w:970,h:250,t:182}],es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:197,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:182,wc:0.0.1600.1200,ac:315.92.970.250,am:i,cc:315.92.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[25~100],as:[25~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:s7uw0qt+11|12|13|14|15|16|17|18|191|1a1|1a2|1a3|1b*.10764|1b1|1b2|1c1|1c2|1c3|1d|1e,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:04 GMT
X-Server-Name
dt57ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
Adform.DHTML.js
s1.adform.net/banners/scripts/rmb/ Frame 5D8E 		30 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js?bv=620
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.190/e/.wSBgiD/i/vCAv.IAAAAFAAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
09367caa70514803713fced8ee4ac247e1fbefe5fb13502fb24f20b46804d826

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
last-modified
Mon, 18 May 2020 16:13:27 GMT
server
nginx
etag
W/"5ec2b427-7875"
x-cache-status
HIT
status
200
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js
s0.2mdn.net/ads/studio/cached_libs/ Frame 5D8E 		186 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/ads/studio/cached_libs/createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.190/e/.wSBgiD/i/vCAv.IAAAAFAAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
0
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
49100
x-xss-protection
0
last-modified
Wed, 16 Mar 2016 13:51:35 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=0
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 12 Aug 2020 22:14:04 GMT
vF300x600_JB_SmartAdvertising_Financial_en.js
s1.adform.net/Banners/Elements/Files/6268/8259368/bvpath_513/ Frame 5D8E 		43 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/6268/8259368/bvpath_513/vF300x600_JB_SmartAdvertising_Financial_en.js
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.190/e/.wSBgiD/i/vCAv.IAAAAFAAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
24cb78b580db1230f6566648f7b20e4ecc308c8fc35ef82f72fdcb708f785968
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
last-modified
Tue, 23 Jun 2020 11:57:37 GMT
server
nginx
status
200
etag
W/"5ef1ee31-ad71"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=7dff01c3-41a1-89d6-d214-73e57b44b54e&tv={c:ldqHf9,pingTime:-2,time:206,type:a,im:{sf:0,pom:1,prf:{beA:84,beZ:86,mfA:253,cmA:253,inA:253,inZ:257,prA:257,prZ:262,si:266,poA:267,poZ:271,cmZ:271,mfZ:271,loA:282,loZ:283,ltA:290,ltZ:290}},sca:{dfp:{df:4,sz:970.250,dom:body}},env:{cca:true,gca:true,gca2:false},clog:[{piv:100,vs:i,r:,w:970,h:250,t:182}],es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:206,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:182,wc:0.0.1600.1200,ac:315.92.970.250,am:i,cc:315.92.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[33~100],as:[33~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:s7uw0qt+11|12|13|14|15|16|17|18|191|1a1|1a2|1a3|1b*.10764|1b1|1b2|1c1|1c2|1c3|1d|1e,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn,slid:[google_ads_iframe_/4735792/us.reuters/tentpoles/cyberrisk/article_1,google_ads_iframe_/4735792/us.reuters/tentpoles/cyberrisk/article_1__container__,canvas_leaderboard_9324928926299638_USKCN24W25W],sinceFw:23,readyFired:true}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:04 GMT
X-Server-Name
dt77ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
Adform.DHTML.js
s1.adform.net/banners/scripts/rmb/ Frame CB85 		30 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js?bv=620
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.190/e/.wSBgiD/i/vCAv.IAAAAFAAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
09367caa70514803713fced8ee4ac247e1fbefe5fb13502fb24f20b46804d826

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
last-modified
Mon, 18 May 2020 16:13:27 GMT
server
nginx
etag
W/"5ec2b427-7875"
x-cache-status
HIT
status
200
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js
s0.2mdn.net/ads/studio/cached_libs/ Frame CB85 		186 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/ads/studio/cached_libs/createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.190/e/.wSBgiD/i/vCAv.IAAAAFAAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
0
status
200
alt-svc
h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
49100
x-xss-protection
0
last-modified
Wed, 16 Mar 2016 13:51:35 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=0
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 12 Aug 2020 22:14:04 GMT
vF970x250_JB_SmartAdvertising_Financial_en.js
s1.adform.net/Banners/Elements/Files/6268/8259383/bvpath_513/ Frame CB85 		45 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/6268/8259383/bvpath_513/vF970x250_JB_SmartAdvertising_Financial_en.js
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.190/e/.wSBgiD/i/vCAv.IAAAAFAAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
092cb38034e7ba42e8fd1f025a262c74010ee844fc181a13c61ac41787a68756
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
last-modified
Tue, 23 Jun 2020 11:57:41 GMT
server
nginx
status
200
etag
W/"5ef1ee35-b389"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=78329595-52b8-8b3e-9736-a2dba96ded7f&tv={c:ldqHfm,time:270,type:e,env:{ar:self.0},es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:270,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:36,wc:0.0.1600.1200,ac:1140.686.300.600,am:i,cc:1140.686.300.600,piv:86,obst:0,th:0,reas:,bkn:{piv:[242~75],as:[242~300.600]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:130,fm:s7uw0pE+11|12|13|14|15|16|17|18|191|1a*.10764|1a1|1b.10764|1b1|1c1|1c2|1c3|1d|1e,idMap:1a*,rmeas:1,rend:1,renddet:DIV.qs.sn}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:04 GMT
X-Server-Name
dt57ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=7dff01c3-41a1-89d6-d214-73e57b44b54e&tv={c:ldqHfI,time:241,type:e,env:{ar:self.0},es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:241,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:182,wc:0.0.1600.1200,ac:315.92.970.250,am:i,cc:315.92.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[69~100],as:[69~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:41,fm:s7uw0qt+11|12|13|14|15|16|17|18|191|1a1|1a2|1a3|1b*.10764|1b1|1b2|1c1|1c2|1c3|1d|1e,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:04 GMT
X-Server-Name
dt77ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
connatix.player.css
cds.connatix.com/p/44385/ Frame 8844 		49 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/44385/connatix.player.css
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/44385/connatix.player.dc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ce2ba098bd8570d95c60d33cc035ee6764193c8ff7e0d7a531d0e1e98e9ad592

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
content-encoding
gzip
age
27656
x-cache
HIT, HIT
status
200
content-length
8095
x-served-by
cache-dca17739-DCA, cache-hhn4082-HHN
access-control-allow-origin
*
last-modified
Wed, 12 Aug 2020 13:58:48 GMT
x-timer
S1597270445.672400,VS0,VE0
etag
"880884ab75ace2385f14bd369f4ab798"
vary
Accept-Encoding
content-type
text/css
via
1.1 varnish, 1.1 varnish
cache-control
max-age=31557600
accept-ranges
bytes
x-cache-hits
1, 2229
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=78329595-52b8-8b3e-9736-a2dba96ded7f&tv={c:ldqHgh,pingTime:-10,time:327,type:s,mvn:ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--,fsc:17.4.114v220002022000220000022002222000022220202020222220222220002222022002222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022202220020222222000220000222202222202222000002002002222222222220022202200222002220222202,sd:MTcuNC4xMTR2MTIwMHx8MTYwMHx8MXx8MXx8MjR8fDEyMDB8fDB8fDB8fDF8fGxhbmRzY2FwZS1wcmltYXJ5fHwyNHx8NC8zfHw0LzN8fDB8fDE2MDA-,no:MTcuNC4xMTR2TW96aWxsYXx8TmV0c2NhcGV8fG58fDE2fHxufHwwfHxufHxMaW51eCB4ODZfNjR8fEdlY2tvfHwyMDAzMDEwN3x8LTEyMHx8TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,asp:1597270444523||ea7abd996b9bc01a84e2022e37362700||71ff54ebddb1e090fbf173d96e2342c8||966cebcebdfdfac6ea72448eac550e04||29f26a53b1ed2eb80813c98ed55de911||d37fb090e9e93a50e0410a929c4ab5be||b4161bb151e7f84e740ea5190a0265dd||5dc6d770cdd0601fdb46b639391e924b||1576000828,sca:{spg:55b8a3c1-412d-a461-d624-aa86ab3cb2d9}}
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:04 GMT
X-Server-Name
dt57ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
chatbox1.png
s1.adform.net/Banners/Elements/Files/6268/8259368/bvpath_513/ Frame 5D8E 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/6268/8259368/bvpath_513/chatbox1.png
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e23e579cc684e3244e0556685034279581cc32f155b8e8bbd481bf92e265560e
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
last-modified
Tue, 23 Jun 2020 11:57:36 GMT
server
nginx
status
200
etag
"5ef1ee30-638f"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
25487
truncated
/ Frame 5D8E 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 5D8E 		715 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
chatbox1.png
s1.adform.net/Banners/Elements/Files/6268/8259383/bvpath_513/ Frame CB85 		35 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/6268/8259383/bvpath_513/chatbox1.png
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
cf2306b9feb8c0a2d21afe0d307b1066d3ee5eced9f7f1c23bf84811d8c8ad75
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:04 GMT
last-modified
Tue, 23 Jun 2020 11:57:40 GMT
server
nginx
status
200
etag
"5ef1ee34-8b06"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
35590
vF300x600_Financial.mp4
pipe08.sitebarad.com/riverhost/Julius%20Baer/0042%20Smart%20Advertising/04_Video_Low_1x/vF300x600_JB_SmartAdvertising_Financial_en/ Frame 5D8E
Redirect Chain
  • https://balancer.sitebarad.com/riverhost/Julius%20Baer/0042%20Smart%20Advertising/04_Video_Low_1x/vF300x600_JB_SmartAdvertising_Financial_en/vF300x600_Financial.mp4
  • https://pipe08.sitebarad.com/riverhost/Julius%20Baer/0042%20Smart%20Advertising/04_Video_Low_1x/vF300x600_JB_SmartAdvertising_Financial_en/vF300x600_Financial.mp4
942 KB
942 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://pipe08.sitebarad.com/riverhost/Julius%20Baer/0042%20Smart%20Advertising/04_Video_Low_1x/vF300x600_JB_SmartAdvertising_Financial_en/vF300x600_Financial.mp4
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.231.207.224 Bellach, Switzerland, ASN21069 (ASN-METANET Routing/peering issues: noc@metanet.ch, CH),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
306725f35f8c44921ea1465a88bedafcbbae5ced866635443189b22b22e1d97b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 22:14:34 GMT
Last-Modified
Fri, 03 Jul 2020 08:50:23 GMT
Server
nginx
Access-Control-Allow-Origin
*
X-Powered-By
PleskLin
ETag
"5efef14f-eb7fe"
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
video/mp4
Content-Range
bytes 0-964605/964606
Access-Control-Expose-Headers
Content-Length
Connection
keep-alive
Access-Control-Allow-Headers
Range
Content-Length
964606

Redirect headers

date
Wed, 12 Aug 2020 22:14:05 GMT
server
nginx
status
301
x-powered-by
PleskLin
location
https://pipe08.sitebarad.com/riverhost/Julius%20Baer/0042%20Smart%20Advertising/04_Video_Low_1x/vF300x600_JB_SmartAdvertising_Financial_en/vF300x600_Financial.mp4
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html; charset=iso-8859-1
access-control-allow-origin
*
access-control-expose-headers
Content-Length
access-control-allow-headers
Range
content-length
370
pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=4&fi=0&apd=8&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=reuters.com&L1id=4822186048&L2id=2708662048&L3id=5400724040&L4id=138315342570&S1id=3735912&S2id=247866432&ord=1597270444286&r=349880371230&t=meas&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:04 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:04 GMT
pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=4&fi=0&apd=8&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=reuters.com&L1id=4822186048&L2id=2708662048&L3id=5400724040&L4id=138315342570&S1id=3735912&S2id=247866432&ord=1597270444286&r=349880371230&t=nht&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:04 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:04 GMT
pixel.gif
px.moatads.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vb=4&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=1&ak=https%3A%2F%2Fwww.reuters.com%2F%2Farticle%2Fus-cyber-cwt-ransom%2F-&i=REUTERSDFPCW3&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%26GGfD.%5BH%7BQ&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&id=1&ii=4&cm=6&f=0&j=&t=1597270444286&de=349880371230&cu=1597270444286&m=684&ar=2bf682d4aa-clean&iw=4490aac&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=8033&le=1&lf=0&lg=1&lh=13&gm=1&io=1&vv=1&vw=1%3A3%3A0&vp=86&vx=86%3A-%3A-&pe=1%3A806%3A806%3A2626%3A920&as=0&ag=4&an=0&gf=0&gg=0&ix=0&ic=0&ez=1&aj=1&pg=86&pf=0&ib=1&cc=0&bw=4&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=8&cd=0&ah=8&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=4822186048%3A2708662048%3A5400724040%3A138315342570&zMoatRawSlicer1=3735912&zMoatRawSlicer2=247866432&zMoatBlacklist=true&bo=3735912&bd=247866432&gw=reutersdfpcw319687550988&zMoatOrigSlicer1=3735912&zMoatOrigSlicer2=247866432&dfp=0%2C1&la=247866432&zMoatTP=mpu&zMoatStory=0&zMoatAU=%2F4735792%2Fus.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&zMoatPixelDistance=400&zMoatReutersSlicer1=3735912&zMoatReutersSlicer2=247866432&hv=ADFORMADS-1&ab=2&ac=1&fd=1&kt=strict&it=500&oq=0&ot=cc&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=183324&na=829634833&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:04 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:04 GMT
vF970x250_Financial.mp4
pipe08.sitebarad.com/riverhost/Julius%20Baer/0042%20Smart%20Advertising/04_Video_Low_1x/vF970x250_JB_SmartAdvertising_Financial_en/ Frame CB85
Redirect Chain
  • https://balancer.sitebarad.com/riverhost/Julius%20Baer/0042%20Smart%20Advertising/04_Video_Low_1x/vF970x250_JB_SmartAdvertising_Financial_en/vF970x250_Financial.mp4
  • https://pipe08.sitebarad.com/riverhost/Julius%20Baer/0042%20Smart%20Advertising/04_Video_Low_1x/vF970x250_JB_SmartAdvertising_Financial_en/vF970x250_Financial.mp4
944 KB
944 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://pipe08.sitebarad.com/riverhost/Julius%20Baer/0042%20Smart%20Advertising/04_Video_Low_1x/vF970x250_JB_SmartAdvertising_Financial_en/vF970x250_Financial.mp4
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.231.207.224 Bellach, Switzerland, ASN21069 (ASN-METANET Routing/peering issues: noc@metanet.ch, CH),
Reverse DNS
Software
nginx / PleskLin
Resource Hash
f2a4b8eca1da948f9dc47eb9a7eddb441d0c926be47d6dd055bfd43f281c7ed2

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 22:14:34 GMT
Last-Modified
Fri, 03 Jul 2020 08:52:19 GMT
Server
nginx
Access-Control-Allow-Origin
*
X-Powered-By
PleskLin
ETag
"5efef1c3-ebf0d"
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
video/mp4
Content-Range
bytes 0-966412/966413
Access-Control-Expose-Headers
Content-Length
Connection
keep-alive
Access-Control-Allow-Headers
Range
Content-Length
966413

Redirect headers

date
Wed, 12 Aug 2020 22:14:05 GMT
server
nginx
status
301
x-powered-by
PleskLin
location
https://pipe08.sitebarad.com/riverhost/Julius%20Baer/0042%20Smart%20Advertising/04_Video_Low_1x/vF970x250_JB_SmartAdvertising_Financial_en/vF970x250_Financial.mp4
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html; charset=iso-8859-1
access-control-allow-origin
*
access-control-expose-headers
Content-Length
access-control-allow-headers
Range
content-length
370
pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=14&fi=1&apd=27&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=reuters.com&L1id=4822186048&L2id=2708662048&L3id=5400723065&L4id=138315308411&S1id=3735912&S2id=247866432&ord=1597270444314&r=225658211177&t=meas&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:05 GMT
pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=14&fi=1&apd=27&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=reuters.com&L1id=4822186048&L2id=2708662048&L3id=5400723065&L4id=138315308411&S1id=3735912&S2id=247866432&ord=1597270444314&r=225658211177&t=fv&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:05 GMT
pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=14&fi=1&apd=27&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=reuters.com&L1id=4822186048&L2id=2708662048&L3id=5400723065&L4id=138315308411&S1id=3735912&S2id=247866432&ord=1597270444314&r=225658211177&t=nht&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:05 GMT
sr
capi.connatix.com/tr/ Frame 40AE 		0
324 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/sr?v=44385
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/44385/connatix.player.dc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.128.233.190 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-128-233-190.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Wed, 12 Aug 2020 22:14:05 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://www.reuters.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
2_media.bin
vid.connatix.com/527c8473-6656-49ea-aa01-5c870b9999f4/ Frame 40AE 		626 B
737 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/527c8473-6656-49ea-aa01-5c870b9999f4/2_media.bin
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/44385/connatix.player.dc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
5b548c55cb99a60bc5d2ed82331220dd5363894f1d0f6a98900b486ce9e85d3b

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:05 GMT
content-encoding
gzip
age
36700
x-cache
HIT, HIT
status
200
content-length
473
x-served-by
cache-bwi5139-BWI, cache-hhn4079-HHN
last-modified
Wed, 12 Aug 2020 10:14:12 GMT
x-timer
S1597270445.202456,VS0,VE0
etag
"27a89cdf78269413f6c8725934546be9"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
x-cache-hits
3, 35
chatbox2.png
s1.adform.net/Banners/Elements/Files/6268/8259368/bvpath_513/ Frame 5D8E 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/6268/8259368/bvpath_513/chatbox2.png
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
7592d77fd22fcb2a04f3be99244059bd057440217b74917b2c54a2d3dd7656be
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Tue, 23 Jun 2020 11:57:36 GMT
server
nginx
status
200
etag
"5ef1ee30-1d9d"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
7581
pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=227&fi=0&apd=231&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=reuters.com&L1id=4822186048&L2id=2708662048&L3id=5400724040&L4id=138315342570&S1id=3735912&S2id=247866432&ord=1597270444286&r=349880371230&t=hdn&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:05 GMT
chatbox2.png
s1.adform.net/Banners/Elements/Files/6268/8259383/bvpath_513/ Frame CB85 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/6268/8259383/bvpath_513/chatbox2.png
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
ae0a54c57bc625c5af8742f7655f75bc94b148ed3cc638507dff2176f2c8dce8
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Tue, 23 Jun 2020 11:57:40 GMT
server
nginx
status
200
etag
"5ef1ee34-2039"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
8249
pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=202&fi=1&apd=215&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=reuters.com&L1id=4822186048&L2id=2708662048&L3id=5400723065&L4id=138315308411&S1id=3735912&S2id=247866432&ord=1597270444314&r=225658211177&t=hdn&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:05 GMT
chatbox3.png
s1.adform.net/Banners/Elements/Files/6268/8259368/bvpath_513/ Frame 5D8E 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/6268/8259368/bvpath_513/chatbox3.png
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
307f995d0069ac32dfd6595f75dce66f9b152e537b6bf796f7a9849eb0410fa0
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Tue, 23 Jun 2020 11:57:36 GMT
server
nginx
status
200
etag
"5ef1ee30-209e"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
8350
ps
capi.connatix.com/tr/ Frame 40AE 		0
324 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/ps?v=44385
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/44385/connatix.player.dc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.128.233.190 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-128-233-190.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Wed, 12 Aug 2020 22:14:05 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://www.reuters.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
ao
capi.connatix.com/tr/ Frame 40AE 		0
324 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/ao?v=44385
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/44385/connatix.player.dc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.128.233.190 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-128-233-190.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Wed, 12 Aug 2020 22:14:05 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://www.reuters.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
1_th.jpg
img.connatix.com/527c8473-6656-49ea-aa01-5c870b9999f4/ Frame 8844 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/527c8473-6656-49ea-aa01-5c870b9999f4/1_th.jpg?crop=755:425,smart&width=755&height=425&format=jpeg&quality=60&fit=crop
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
eaad44637697425c5c17e2f974faf574cd5d522e2410405fa462331e4b79a313

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:05 GMT
via
1.1 varnish, 1.1 varnish
age
36733
x-cache
HIT, HIT
fastly-io-info
ifsz=90313 idim=2562x1440 ifmt=jpeg ofsz=15142 odim=755x425 ofmt=webp
status
200
fastly-stats
io=1
content-encoding
gzip
content-length
15165
x-served-by
cache-dca17757-DCA, cache-hhn4082-HHN
x-timer
S1597270445.245944,VS0,VE1
etag
"+y83qt+C6ti64aLGZ2xKT8hLAQe6wDBjyPXlPJvNgXI"
vary
Accept
x-amz-request-id
4137AC3EA453C855
access-control-allow-origin
*
cache-control
max-age=31557600
accept-ranges
bytes
content-type
image/webp
x-cache-hits
2, 1
chatbox3.png
s1.adform.net/Banners/Elements/Files/6268/8259383/bvpath_513/ Frame CB85 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/6268/8259383/bvpath_513/chatbox3.png
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
c118b64bbb3ed166f68f2f5c02469cd1373f6abff79ab495b1f33726a972f53d
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Tue, 23 Jun 2020 11:57:40 GMT
server
nginx
status
200
etag
"5ef1ee34-6f06"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
28422
profil1.jpg
s1.adform.net/Banners/Elements/Files/6268/8259368/bvpath_513/ Frame 5D8E 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/6268/8259368/bvpath_513/profil1.jpg
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
f46352b7163b3636d127be739e4adca5bba29cb87247098ec04bde2dc5575702
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Tue, 23 Jun 2020 11:57:36 GMT
server
nginx
status
200
etag
"5ef1ee30-a73"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/jpeg
content-length
2675
profil1.jpg
s1.adform.net/Banners/Elements/Files/6268/8259383/bvpath_513/ Frame CB85 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/6268/8259383/bvpath_513/profil1.jpg
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
f46352b7163b3636d127be739e4adca5bba29cb87247098ec04bde2dc5575702
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Tue, 23 Jun 2020 11:57:40 GMT
server
nginx
status
200
etag
"5ef1ee34-a73"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/jpeg
content-length
2675
profil2.jpg
s1.adform.net/Banners/Elements/Files/6268/8259368/bvpath_513/ Frame 5D8E 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/6268/8259368/bvpath_513/profil2.jpg
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
67238e3d12ebbeeea890e4e9a67611b31bb21d2a0d22e7179876ffb06a6a8719
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Tue, 23 Jun 2020 11:57:36 GMT
server
nginx
status
200
etag
"5ef1ee30-9e3"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/jpeg
content-length
2531
profil2.jpg
s1.adform.net/Banners/Elements/Files/6268/8259383/bvpath_513/ Frame CB85 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/6268/8259383/bvpath_513/profil2.jpg
Requested by
Host: www.reuters.com
URL: https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
67238e3d12ebbeeea890e4e9a67611b31bb21d2a0d22e7179876ffb06a6a8719
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Tue, 23 Jun 2020 11:57:40 GMT
server
nginx
status
200
etag
"5ef1ee34-9e3"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/jpeg
content-length
2531
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=78329595-52b8-8b3e-9736-a2dba96ded7f&tv={c:ldqHvg,pingTime:1,time:1256,type:p,clog:[{piv:86,vs:i,r:,w:300,h:600,t:36}],es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:1256,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:36,wc:0.0.1600.1200,ac:1140.686.300.600,am:i,cc:1140.686.300.600,piv:86,obst:0,th:0,reas:,bkn:{piv:[1228~75],as:[1228~300.600]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:479,fm:s7uw0pE+11|12|13|14|15|16|17|18|191|1a*.10764|1a1|1b.10764|1b1|1c1|1c2|1c3|1d|1e,idMap:1a*,rmeas:1,rend:1,renddet:DIV.qs.sn}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:05 GMT
X-Server-Name
dt57ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
activeview
pagead2.googlesyndication.com/pcs/ Frame 531B 		42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstnCrDIydRXqncBVFNVGpv3ea8K4u58VG5ME4Aoz8n1ITw02BDf3i69pJf__483KAcICbM1p0DodPAufocq6gYMKagfK4hOkyapgBtiA1s&sig=Cg0ArKJSzEInrh04HhpfEAE&adk=2573966859&tt=-1&bs=1600%2C1200&mtos=1255,1255,1255,1255,1255&tos=1255,0,0,0,0&p=92,315,342,1285&mcvt=1255&rs=0&ht=0&tfs=16&tls=1271&mc=1&lte=1&bas=0&bac=0&met=mue&la=1&avms=nio&exg=1&md=2&btr=0&cpmav=0&lm=2&rst=1597270443655&dlt&rpt=669&isd=0&msd=0&xdi=0&ps=1600%2C8037&scs=1600%2C1200&pt=-1&bin=4&deb=1-0-0-7-2-6-6-0-0-0&tvt=1270&is=970%2C250&iframe_loc=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&r=v&id=osdim&vs=4&uc=7&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200810
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=7dff01c3-41a1-89d6-d214-73e57b44b54e&tv={c:ldqHzo,pingTime:1,time:1461,type:p,clog:[{piv:100,vs:i,r:,w:970,h:250,t:182}],es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:1461,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:182,wc:0.0.1600.1200,ac:315.92.970.250,am:i,cc:315.92.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[1288~100],as:[1288~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:514,fm:s7uw0qt+11|12|13|14|15|16|17|18|191|1a1|1a2|1a3|1b*.10764|1b1|1b2|1c1|1c2|1c3|1d|1e,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:05 GMT
X-Server-Name
dt57ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=7dff01c3-41a1-89d6-d214-73e57b44b54e&tv={c:ldqHzp,pingTime:1,time:1462,type:pf,clog:[{piv:100,vs:i,r:,w:970,h:250,t:182}],es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:1462,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:182,wc:0.0.1600.1200,ac:315.92.970.250,am:i,cc:315.92.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[1289~100],as:[1289~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:514,fm:s7uw0qt+11|12|13|14|15|16|17|18|191|1a1|1a2|1a3|1b*.10764|1b1|1b2|1c1|1c2|1c3|1d|1e,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:05 GMT
X-Server-Name
dt77ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=7dff01c3-41a1-89d6-d214-73e57b44b54e&tv={c:ldqHzq,pingTime:1,time:1463,type:c,clog:[{piv:100,vs:i,r:,w:970,h:250,t:182}],es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:1463,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:182,wc:0.0.1600.1200,ac:315.92.970.250,am:i,cc:315.92.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[1290~100],as:[1290~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:514,fm:s7uw0qt+11|12|13|14|15|16|17|18|191|1a1|1a2|1a3|1b*.10764|1b1|1b2|1c1|1c2|1c3|1d|1e,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn,metricId:publ1,cmr:t}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:05 GMT
X-Server-Name
dt03ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=7dff01c3-41a1-89d6-d214-73e57b44b54e&tv={c:ldqHzq,pingTime:1,time:1463,type:c,clog:[{piv:100,vs:i,r:,w:970,h:250,t:182}],es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:1463,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:182,wc:0.0.1600.1200,ac:315.92.970.250,am:i,cc:315.92.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[1290~100],as:[1290~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:514,fm:s7uw0qt+11|12|13|14|15|16|17|18|191|1a1|1a2|1a3|1b*.10764|1b1|1b2|1c1|1c2|1c3|1d|1e,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn,metricId:grpm1,cmr:t}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:05 GMT
X-Server-Name
dt56ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
activeview
pagead2.googlesyndication.com/pcs/ Frame B407 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv02DSFvAjy-IS5PToU_lJw8kFZX-smnXOrCnZ_zq1MbG5Jqc6jIa9mhR1zvb1KCoo_3WdAg3BfXpOTuPi2Qz2zA-XQgEngZVV4E2rk8CE&sig=Cg0ArKJSzE8pSWLrpnm4EAE&adk=390661369&tt=-1&bs=1600%2C1200&mtos=0,1300,1300,1300,1300&tos=0,1300,0,0,0&p=686,1140,1286,1440&mcvt=1300&rs=0&ht=0&tfs=17&tls=1317&mc=0.85&lte=0.85&bas=0&bac=0&met=mue&avms=nio&exg=1&md=2&btr=0&cpmav=0&lm=2&rst=1597270443654&dlt&rpt=643&isd=0&msd=0&xdi=0&ps=1600%2C8037&scs=1600%2C1200&pt=-1&bin=4&deb=1-0-0-8-2-7-7-0-0-0&tvt=1316&is=300%2C600&iframe_loc=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&r=v&id=osdim&vs=4&uc=8&upc=1&tgt=DIV&cl=1&cec=1&wf=0&cac=1&cd=0x0&itpl=19&v=20200810
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=300&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=reuters.com&L1id=20159232&L2id=453477432&L3id=4806613891&L4id=138288736159&S1id=3735912&S2id=247866432&ord=1597270443864&r=832240886420&t=meas&bedc=1&q=1&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:05 GMT
pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=300&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=reuters.com&L1id=20159232&L2id=453477432&L3id=4806613891&L4id=138288736159&S1id=3735912&S2id=247866432&ord=1597270443864&r=832240886420&t=nht&bedc=1&q=2&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:05 GMT
pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=313&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=reuters.com&L1id=20159232&L2id=453477432&L3id=4806613891&L4id=138288736159&S1id=3735912&S2id=247866432&ord=1597270443864&r=832240886420&t=hdn&bedc=1&q=3&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:05 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:05 GMT
pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=893&tet=1088&fi=1&apd=1101&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=0&d=reuters.com&L1id=4822186048&L2id=2708662048&L3id=5400723065&L4id=138315308411&S1id=3735912&S2id=247866432&ord=1597270444314&r=225658211177&t=iv&bedc=1&q=5&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:06 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:06 GMT
pixel.gif
px.moatads.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&vb=4&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=REUTERSDFPCW3&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%26GGfD.%5BH%7BQ&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&id=1&ii=4&cm=6&f=0&j=&t=1597270444286&de=349880371230&cu=1597270444286&m=1827&ar=2bf682d4aa-clean&iw=4490aac&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=8037&le=1&lf=0&lg=1&lh=13&gm=1&io=1&vv=1&vw=1%3A3%3A0&vp=86&vx=86%3A86%3A-&pe=1%3A806%3A806%3A2626%3A920&as=1&ag=1165&an=4&gf=0&gg=0&ix=0&ic=0&ez=1&ck=1165&kw=959&aj=1&pg=86&pf=86&ib=1&cc=1&bw=1165&bx=4&ci=1165&jz=959&dj=1&aa=1&ad=1050&cn=0&gk=0&gl=0&ik=0&co=1050&cp=959&cq=1&im=0&in=0&pd=0&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=959&cd=8&ah=959&am=8&rf=0&re=0&wb=1&cl=0&at=0&d=4822186048%3A2708662048%3A5400724040%3A138315342570&zMoatRawSlicer1=3735912&zMoatRawSlicer2=247866432&zMoatBlacklist=true&bo=3735912&bd=247866432&gw=reutersdfpcw319687550988&zMoatOrigSlicer1=3735912&zMoatOrigSlicer2=247866432&dfp=0%2C1&la=247866432&zMoatTP=mpu&zMoatStory=0&zMoatAU=%2F4735792%2Fus.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&zMoatPixelDistance=400&zMoatReutersSlicer1=3735912&zMoatReutersSlicer2=247866432&hv=ADFORMADS-1&ab=2&ac=1&fd=1&kt=strict&it=500&oq=0&ot=cc&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=183324&na=670052602&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:06 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:06 GMT
pixel.gif
reutersdfpcw319687550988.s.moatpixel.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://reutersdfpcw319687550988.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=959&tet=1165&fi=0&apd=1169&ui=0&uit=0&h=0&th=-1&s=0&ts=-1&bfa=1&d=reuters.com&L1id=4822186048&L2id=2708662048&L3id=5400724040&L4id=138315342570&S1id=3735912&S2id=247866432&ord=1597270444286&r=349880371230&t=iv&bedc=1&q=4&nu=1&ib=0&dc=1&ob=1&oh=0&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:06 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:06 GMT
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=7dff01c3-41a1-89d6-d214-73e57b44b54e&tv={c:ldqHDS,pingTime:-10,time:1739,type:s,mvn:ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--,fsc:17.4.114v220002022000220000022002222000022220202020222220222220002222022002222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022202220020222222000220000222202222202222000002002002222222222220022202200222002220222202,sd:MTcuNC4xMTR2MTIwMHx8MTYwMHx8MXx8MXx8MjR8fDEyMDB8fDB8fDB8fDF8fGxhbmRzY2FwZS1wcmltYXJ5fHwyNHx8NC8zfHw0LzN8fDB8fDE2MDA-,no:MTcuNC4xMTR2TW96aWxsYXx8TmV0c2NhcGV8fG58fDE2fHxufHwwfHxufHxMaW51eCB4ODZfNjR8fEdlY2tvfHwyMDAzMDEwN3x8LTEyMHx8TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,asp:1597270444523||ea7abd996b9bc01a84e2022e37362700||71ff54ebddb1e090fbf173d96e2342c8||966cebcebdfdfac6ea72448eac550e04||29f26a53b1ed2eb80813c98ed55de911||d37fb090e9e93a50e0410a929c4ab5be||b4161bb151e7f84e740ea5190a0265dd||5dc6d770cdd0601fdb46b639391e924b||1576000828,sca:{spg:55b8a3c1-412d-a461-d624-aa86ab3cb2d9}}
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:06 GMT
X-Server-Name
dt56ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
/
track.adform.net/serving/unload/ Frame B407 		35 B
469 B 		Other
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/serving/unload/?version=15&unload=-7676788430072563913@@37798403,3088045939183094535,86|1007|0|0|0|0|0|0|0||81|0|||||1|0|0|KOcZByEOMoVlFVzN-43Zs90Tw71o5ZqUUGgq9CjFJ3GehiBm3Uj6Qj-VoxiuxKRtHuDilNLlWoQ1|||11|0
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:06 GMT
server
nginx
status
200
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.reuters.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
/
track.adform.net/serving/unload/ Frame 531B 		35 B
469 B 		Other
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/serving/unload/?version=15&unload=-7676788430072563913@@37798389,2991846994744406717,100|1078|0|0|0|0|0|0|0||136|0|||||1|0|0|i36KGv3BrWhlFVzN-43Zs90Tw71o5ZqUUGgq9CjFJ3GehiBm3Uj6Qj-VoxiuxKRtHuDilNLlWoQ1||1|11|0
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:06 GMT
server
nginx
status
200
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.reuters.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=78329595-52b8-8b3e-9736-a2dba96ded7f&tv={c:ldqIut,pingTime:5,time:5051,type:p,clog:[{piv:86,vs:i,r:,w:300,h:600,t:36}],es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:5051,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:36,wc:0.0.1600.1200,ac:1140.686.300.600,am:i,cc:1140.686.300.600,piv:86,obst:0,th:0,reas:,bkn:{piv:[5024~75],as:[5024~300.600]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:309,fm:s7uw0pE+11|12|13|14|15|16|17|18|191|1a*.10764|1a1|1b.10764|1b1|1c1|1c2|1c3|1d|1e,idMap:1a*,rmeas:1,rend:1,renddet:DIV.qs.sn}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:09 GMT
X-Server-Name
dt56ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
/
track.adform.net/serving/unload/ Frame B407 		35 B
460 B 		Other
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/serving/unload/?version=15&unload=-7676788430072563913@@37798403,3088045939183094535,86|3804|0|0|0|0|0|0|0||306|0|||||1|0|0|KOcZByEOMoVlFVzN-43Zs90Tw71o5ZqUUGgq9CjFJ3GehiBm3Uj6Qj-VoxiuxKRtHuDilNLlWoQ1|||01|0
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:09 GMT
server
nginx
status
200
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.reuters.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=7dff01c3-41a1-89d6-d214-73e57b44b54e&tv={c:ldqIxM,pingTime:5,time:5205,type:p,clog:[{piv:100,vs:i,r:,w:970,h:250,t:182}],es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:5205,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:182,wc:0.0.1600.1200,ac:315.92.970.250,am:i,cc:315.92.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[5032~100],as:[5032~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:41,fm:s7uw0qt+11|12|13|14|15|16|17|18|191|1a1|1a2|1a3|1b*.10764|1b1|1b2|1c1|1c2|1c3|1d|1e,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:09 GMT
X-Server-Name
dt56ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
dt
dt.adsafeprotected.com/ 		43 B
308 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dt.adsafeprotected.com/dt?anId=10764&asId=7dff01c3-41a1-89d6-d214-73e57b44b54e&tv={c:ldqIxM,pingTime:5,time:5205,type:pf,clog:[{piv:100,vs:i,r:,w:970,h:250,t:182}],es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:{i:5205,o:0,n:0,pp:0,pm:0},slEvents:[{sl:i,t:182,wc:0.0.1600.1200,ac:315.92.970.250,am:i,cc:315.92.970.250,piv:100,obst:0,th:0,reas:,bkn:{piv:[5032~100],as:[5032~970.250]}}],slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:41,fm:s7uw0qt+11|12|13|14|15|16|17|18|191|1a1|1a2|1a3|1b*.10764|1b1|1b2|1c1|1c2|1c3|1d|1e,idMap:1b*,rmeas:1,rend:1,renddet:DIV.qs.sn}&br=u
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.39.20 , United States, ASN7415 (ADSAFE-1, US),
Reverse DNS
amidt.adsafeprotected.com
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 12 Aug 2020 22:14:09 GMT
X-Server-Name
dt77ami.ami.303net.pvt
P3P
CP="COM NAV INT STA NID OUR IND NOI"
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Server
nginx
/
track.adform.net/serving/unload/ Frame 531B 		35 B
469 B 		Other
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/serving/unload/?version=15&unload=-7676788430072563913@@37798389,2991846994744406717,100|3678|0|0|0|0|0|0|0||465|0|||||1|0|0|i36KGv3BrWhlFVzN-43Zs90Tw71o5ZqUUGgq9CjFJ3GehiBm3Uj6Qj-VoxiuxKRtHuDilNLlWoQ1||1|01|0
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:09 GMT
server
nginx
status
200
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.reuters.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
pixel.gif
px.moatads.com/ 		43 B
253 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&vb=4&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=REUTERSDFPCW3&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C%2C1%2C0%2C0%2Cprobably%2Cprobably&os=&qp=00000&is=BBBBB2IUEY4vGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMQSQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Skg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccypBsrB41kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTCyBBrbjBC4ehueB57NG9aJfR0BqEKiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=%26GGfD.%5BH%7BQ&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=0&gp=0&zGSRS=1&zGSRC=1&gu=https%3A%2F%2Fwww.reuters.com%2Farticle%2Fus-cyber-cwt-ransom%2Fpayment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W&id=1&ii=4&cm=6&f=0&j=&t=1597270444286&de=349880371230&cu=1597270444286&m=5783&ar=2bf682d4aa-clean&iw=4490aac&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=8037&le=1&lf=0&lg=1&lh=13&gm=1&io=1&vv=1&vw=1%3A3%3A0&vp=86&vx=86%3A86%3A-&pe=1%3A806%3A806%3A2626%3A920&as=1&ag=5121&an=1165&gf=0&gg=0&ix=0&ic=0&ez=1&ck=1165&kw=959&aj=1&pg=86&pf=86&ib=1&cc=1&bw=5121&bx=1165&ci=1165&jz=959&dj=1&aa=1&ad=5006&cn=1050&gk=0&gl=0&ik=0&co=1050&cp=959&cq=1&im=0&in=0&pd=0&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4909&cd=959&ah=4909&am=959&rf=0&re=0&wb=1&cl=0&at=0&d=4822186048%3A2708662048%3A5400724040%3A138315342570&zMoatRawSlicer1=3735912&zMoatRawSlicer2=247866432&zMoatBlacklist=true&bo=3735912&bd=247866432&gw=reutersdfpcw319687550988&zMoatOrigSlicer1=3735912&zMoatOrigSlicer2=247866432&dfp=0%2C1&la=247866432&zMoatTP=mpu&zMoatStory=0&zMoatAU=%2F4735792%2Fus.reuters%2Ftentpoles%2Fcyberrisk%2Farticle&zMoatPixelDistance=400&zMoatReutersSlicer1=3735912&zMoatReutersSlicer2=247866432&hv=ADFORMADS-1&ab=2&ac=1&fd=1&kt=strict&it=500&oq=0&ot=cc&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=183324&na=2143954433&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-40.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 12 Aug 2020 22:14:10 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
Apache
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
status
200
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 12 Aug 2020 22:14:10 GMT
st
capi.connatix.com/tr/ Frame 40AE 		0
324 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/tr/st?v=44385
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/44385/connatix.player.dc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.128.233.190 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-128-233-190.us-east-2.compute.amazonaws.com
Software
openresty/1.15.8.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
multipart/form-data

Response headers

Date
Wed, 12 Aug 2020 22:14:12 GMT
Content-Encoding
gzip
Server
openresty/1.15.8.2
Vary
Accept-Encoding
Content-Type
multipart/form-data
Access-Control-Allow-Origin
https://www.reuters.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
20
/
onetag-geo.s-onetag.com/ 		24 B
425 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://onetag-geo.s-onetag.com/
Requested by
Host: beacon.s-onetag.com
URL: https://beacon.s-onetag.com/beacon.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.49 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-49.dus51.r.cloudfront.net
Software
/
Resource Hash
245c7bb98e9ec0aaf0712f56ab6738e58bcee55110c6a8d8802efe864d0bdbd0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 21:47:42 GMT
via
1.1 1277de71b2472d19ca0bfc510db9ec54.cloudfront.net (CloudFront), 1.1 877a7509af39a63279b2520fa0b455fa.cloudfront.net (CloudFront)
age
1591
x-amzn-requestid
8bd08d99-294e-434e-bad4-6dcfd765fcf1
status
200
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=86400
x-amz-cf-pop
FRA6-C1, DUS51-C1
x-amz-apigw-id
RLR7yEYciYcFnpA=
content-length
24
x-amz-cf-id
UDXugMr8cWbfDssboHuO29-wewK5p_YEukEMvLxj3Fff09aaty_biw==
EU
onetag-geo-grouping.s-onetag.com/regionalbloc/ 		1 KB
837 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://onetag-geo-grouping.s-onetag.com/regionalbloc/EU
Requested by
Host: beacon.s-onetag.com
URL: https://beacon.s-onetag.com/beacon.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.115 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-115.dus51.r.cloudfront.net
Software
restify /
Resource Hash
6088012dda2274a27fa40ed153d9e3a6c96a22af1b177f8a2916368eb3e88bb0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:03:53 GMT
content-encoding
gzip
server
restify
age
620
status
200
vary
Accept-Encoding,origin
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
https://www.reuters.com
access-control-expose-headers
api-version, content-length, content-md5, content-type, date, request-id, response-time
cache-control
max-age=86400
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
CtBK6DrD5MpwWqS_SRymDXOeiNEnW_LDT4nAQYgklS801H0XYixfUw==
via
1.1 a67be963c7536322e9a591e428e62d28.cloudfront.net (CloudFront)
EU
onetag-geo-grouping.s-onetag.com/regionalbloc/ 		1 KB
827 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://onetag-geo-grouping.s-onetag.com/regionalbloc/EU
Requested by
Host: beacon.s-onetag.com
URL: https://beacon.s-onetag.com/beacon.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.226.155.115 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-155-115.dus51.r.cloudfront.net
Software
restify /
Resource Hash
6088012dda2274a27fa40ed153d9e3a6c96a22af1b177f8a2916368eb3e88bb0

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 22:03:53 GMT
content-encoding
gzip
server
restify
age
620
status
200
vary
Accept-Encoding,origin
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
https://www.reuters.com
access-control-expose-headers
api-version, content-length, content-md5, content-type, date, request-id, response-time
cache-control
max-age=86400
x-amz-cf-pop
DUS51-C1
x-amz-cf-id
bD6WH2uhxd8YhLZEiKUaKnIJ6bx8opAqsBYvgL0OTSiPj0WOFfXS0g==
via
1.1 a67be963c7536322e9a591e428e62d28.cloudfront.net (CloudFront)
v2
ap.lijit.com/readerinfo/
Redirect Chain
  • https://ap.lijit.com/readerinfo/v2
  • https://ap.lijit.com/readerinfo/v2?sovrn_retry=true
41 B
478 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/readerinfo/v2?sovrn_retry=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx /
Resource Hash
ce075d393fe639efae1669527b65016814f28526ff0b5db916fb760aeba3b3cc

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 22:14:13 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://www.reuters.com
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap1ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
61

Redirect headers

Date
Wed, 12 Aug 2020 22:14:13 GMT
Server
nginx
Location
https://ap.lijit.com/readerinfo/v2?sovrn_retry=true
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
https://www.reuters.com
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap1ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
0
metrics
metrics-collector.s-onetag.com/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://metrics-collector.s-onetag.com/metrics
Requested by
Host: beacon.s-onetag.com
URL: https://beacon.s-onetag.com/beacon.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.131.92 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
https://www.reuters.com
access-control-expose-headers
api-version, content-length, content-md5, content-type, date, request-id, response-time

Verdicts & Comments Add Verdict or Comment

231 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| analytics object| dataLayer object| google_tag_manager function| postscribe string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| google_optimize object| Reuters object| parallelMediaHosts object| tag object| firstScriptTag object| player function| onYouTubeIframeAPIReady function| onPlayerPlaybackQualityChange function| onPlayerReady function| onPlayerStateChange object| player2 function| onYouTubeIframeAPIReady2 function| onPlayerReady2 function| onPlayerPlaybackQualityChange2 function| onPlayerStateChange2 object| player3 function| onYouTubeIframeAPIReady3 function| onPlayerReady3 function| onPlayerPlaybackQualityChange3 function| onPlayerStateChange3 object| player4 function| onYouTubeIframeAPIReady4 function| onPlayerReady4 function| onPlayerPlaybackQualityChange4 function| onPlayerStateChange4 object| player5 function| onYouTubeIframeAPIReady5 function| onPlayerReady5 function| onPlayerPlaybackQualityChange5 function| onPlayerStateChange5 object| player7 function| onYouTubeIframeAPIReady7 function| onPlayerReady7 function| onPlayerPlaybackQualityChange7 function| onPlayerStateChange7 undefined| script function| $ function| jQuery object| _sf_async_config number| _sf_startpt object| __core-js_shared__ object| RTVEmbedder object| _cb_shared object| RCOM_Data function| webpackJsonp object| core object| scrollMonitor object| gptadslots object| googletag function| setImmediate function| clearImmediate function| initBootstrap object| evidon function| __cmp function| __uspapi object| bootstrap function| renderComponent function| VCSFNdd object| jvrkl259Flags string| jvrkl1c4Rnd function| VCSFNTrkFailed object| jvrkld0d2tc function| commonPopup boolean| jvrkle24sdl boolean| jvrkle24sdln string| jvrkld0d2genat string| jvrkld0d2sthash boolean| jvrkl4cbforceimp object| article_date object| author object| content_channel object| keywords object| tp boolean| jvrklb29Body object| YT object| YTConfig function| onYTReady object| _cbm object| diagPixSentCodes object| __iasPET object| __iasAdRefreshConfig string| dianomiContextHost function| dianomiLoadContext function| dianomiContextSetHeight function| dianomiContextSetWidth function| dianomiContextSetFloat function| iframebuster function| videoMPU function| dianomiContextElement function| dianomiReloadContext function| dianomiContextReady function| _fbq function| fbq function| Tracktor function| normalize object| lazyLoadOptions object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportLogPayloadsQueue_ object| ytLoggingTransportGELQueue_ object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingGelSequenceIdObj_ object| TRUE_ANTHEM function| e number| abp object| _comscore function| getValuesGWIQ function| _extends function| LazyLoad string| segment_user_id function| ___tp object| advBidxc string| __tpVersion object| jQuery112408938560923253118 object| SWG object| adobeDil object| adobe function| Visitor function| DIL object| s_c_il number| s_c_in string| mcxUniqueID function| getCookie string| segmentId string| anonId string| sessionId string| groupId object| mcxCurrentURL object| mcxURLObject string| mcxLastVisitedURL string| mcxCurrentPageURL string| platform object| $jscomp function| MIIScriptCtrl object| gwiq function| udm_ object| ns_p object| COMSCORE function| _mR function| _mD object| pubcid_options object| PianoESPConfig string| TB4M82W string| T645KQG function| __mNPubCidCB object| PublisherCommonId object| ggeac object| googleToken object| googleIMState object| google_js_reporting_queue function| processGoogleToken string| article_platform string| article_edition function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter undefined| google_measure_js_timing number| interceptPath boolean| is_iPad function| isTrueOrNot boolean| inlineCheck object| mcxSiteInterceptParameters undefined| newMcxText function| mcxWarn function| mcxLog object| McxSiteInterceptOnExit object| docCookies object| AllegianceSiteInterceptOnExit object| mcx-site-intercept string| triggers object| MCXPassThroughParameters number| _sf_endpt object| pSUPERFLY_mab object| _cbq object| pSUPERFLY object| pSUPERFLY_video object| _cbv_strategies object| _cbv boolean| jvrklb4fDetect object| jvrkld79Mobile object| jvrkld0d21 object| jvrkld0d2o1 object| jvrkld0d2o2 object| jvrkld0d2o3 object| jvrkld0d22 number| jvrkld0d2d3 object| jvrkld0d24 object| jvrkld0d25 boolean| jvrkl422ij object| __onetag object| __connect number| __google_ad_urls_id number| google_unique_id boolean| jvrkl431Track object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| GoogleGcLKhOms object| ampInaboxPositionObserver object| ampInaboxFrameOverlayManager object| Moat#G26 boolean| Moat#EVA object| MoatSuperV26 object| DOMlessLLDcallback_27826943 object| MoatDataJsonpRequest_27826943 object| cnx_usr_storage object| __IntegralASExec object| google_image_requests object| Adform boolean| __adform_onload function| ADFReload function| ADFCall function| ADFcall

4 Cookies

Domain/Path Name / Value
.demdex.net/ Name: demdex
Value: 78254189166458470720889798111828919160
.reuters.com/ Name: _fbp
Value: fb.1.1597270442724.1248103358
.demdex.net/ Name: dextp
Value: 481-1-1597270442514|601-1-1597270442615|771-1-1597270442716
www.reuters.com/ Name: McxPageVisit
Value: 1

45 Console Messages

Source Level URL
Text
console-api log URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 14)
Message:
Init Bootstrap with config [object Object]
console-api log URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 7)
Message:
BODY ITEMS [object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
console-api log URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 14)
Message:
###### ias setup complete
console-api log URL: https://c.evidon.com/sitenotice/evidon-sitenotice-tag.js(Line 1)
Message:
Evidon -- evidon-notice-link not found on page, cant display the consent link.
console-api log (Line 1)
Message:
Blocking Ads: No
console-api log (Line 1)
Message:
comscore new global fired
console-api log URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 7)
Message:
us !@!@
console-api log URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 14)
Message:
[object Object]
console-api log URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 7)
Message:
bootstrap getResults: [object Object]
console-api log (Line 1)
Message:
setImmediate$0.40735993830984074$10
console-api log URL: https://www.dianomi.com/js/videofeed-combined.js?id=123(Line 17)
Message:
videoAd id 4729 el [object HTMLDivElement] data [object Object]
console-api log URL: https://www.dianomi.com/js/videofeed-combined.js?id=123(Line 17)
Message:
IO Script Loaded
console-api log URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 14)
Message:
Setup media.net without consent requirement
console-api log (Line 1)
Message:
---destpub-to-parent---canSetThirdPartyCookies|true
console-api log URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 14)
Message:
GPT SET ADMANTX: AccentureAPAC_Negative,Artificial_Intelligence,Barclays,Barclays_2,Boeing_Neg,BofA_Neg,BofA_Neg_Topics,CME_Negative,Cognizant_Coronavirus_3,DIT_Negative_kw1,DWA-Cisco-Coronavirus,Exxon_Negative,FRB,GoldmanSachs,IBM,JPMorgan_Neg,JuliusBaer2020_FinancialPlanning-2,MSFT_Neg,MarcusUSDeposits_1,Mobkoi_FB_Negative,Negative_Keywords_3.2,SaudiAramco_Negative,TradeWeb_AiEx,WorkdayPG_Neg
console-api log URL: https://static.reuters.com/resources_v2/react/cookie-reset-b74/common.bundle.js(Line 14)
Message:
GPT ENABLE SERVICES
console-api log URL: https://siteintercept.allegiancetech.com/dist/tr1si001/MCX_Thomson_Reuters_Modal_Invite.js(Line 47)
Message:
Old Intercept
console-api log (Line 2)
Message:
segment identify user with traits: [object Object]
console-api log (Line 1)
Message:
3PCookieSupported
console-api log URL: https://www.dianomi.com/js/videofeed-combined.js?id=123(Line 17)
Message:
Don't know what it is
console-api log (Line 1)
Message:
[object Object]
console-api info URL: https://cdn.ampproject.org/rtv/012007302351000/amp4ads-v0.js(Line 422)
Message:
Powered by AMP ⚡ HTML – Version 2007302351000 https://www.reuters.com/article/us-cyber-cwt-ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber-criminals-idUSKCN24W25W
console-api log (Line 1)
Message:
MSFAPI#1.2#528472272156#moatframe#1131877734#ping
console-api log (Line 1)
Message:
visibility-changed-0
console-api log (Line 1)
Message:
visibility-changed-0
console-api log (Line 1)
Message:
amp-ini-load
console-api log (Line 1)
Message:
0=goog_provide_mode 4=3092690048 6=4 16=true 29=4 33=1597270443586 24=1597270443994
console-api log (Line 1)
Message:
{"c":"sfchannel4","p":"{\"uid\":\"4\",\"width\":300,\"height\":254}","s":"creative_geometry_update"}
console-api log (Line 1)
Message:
{"messageContent":{"self":{"position":[0,11],"id":"0-11","isMe":true,"isLeaf":false,"adProxies":[{"tagId":"10764","adSafeId":"55b8a3c1-412d-a461-d624-aa86ab3cb2d9"}],"unifiedId":1597270444064,"inbox":[]},"unifiedId":1597270444064},"srcAsid":"55b8a3c1-412d-a461-d624-aa86ab3cb2d9","srcTagId":"10764","srcIsEmbedded":true,"srcIsFriendly":true,"srcBirthdate":1597270444064,"iasCommonId":"11ea","nodeSelector":"[data-integralas-id-55b8a3c1-412d-a461-d624-aa86ab3cb2d9]","positionStr":"1c","version":"0.1","sentTime":1597270444131}
console-api log (Line 1)
Message:
{"requestTop":"isRefreshable"}
console-api log (Line 1)
Message:
{"requestTop":"recordAdSlotImpression","asid":"55b8a3c1-412d-a461-d624-aa86ab3cb2d9","adUnitId":"247866432","cacheId":"ias-339954935"}
console-api log (Line 1)
Message:
MSFAPI#1.2#513943487901#moatframe#311746140#ping
console-api log (Line 1)
Message:
0=goog_provide_mode 4=390661369 6=4 16=true 29=4 33=1597270443577 24=1597270444302
console-api log (Line 1)
Message:
MSFAPI#1.2#830758962039#moatframe#555808152#ping
console-api log (Line 1)
Message:
0=goog_provide_mode 4=2573966859 6=4 16=true 29=4 33=1597270443582 24=1597270444330
console-api log (Line 1)
Message:
{"messageContent":{"self":{"position":[0,9],"id":"0-9","isMe":true,"isLeaf":false,"adProxies":[{"tagId":"10764","adSafeId":"78329595-52b8-8b3e-9736-a2dba96ded7f"}],"unifiedId":1597270444342,"inbox":[]},"unifiedId":1597270444342},"srcAsid":"78329595-52b8-8b3e-9736-a2dba96ded7f","srcTagId":"10764","srcIsEmbedded":true,"srcIsFriendly":true,"srcBirthdate":1597270444342,"iasCommonId":"11ea","nodeSelector":"[data-integralas-id-78329595-52b8-8b3e-9736-a2dba96ded7f]","positionStr":"1a","version":"0.1","sentTime":1597270444373}
console-api log (Line 1)
Message:
{"requestTop":"isRefreshable"}
console-api log (Line 1)
Message:
{"requestTop":"recordAdSlotImpression","asid":"78329595-52b8-8b3e-9736-a2dba96ded7f","adUnitId":"247866432","cacheId":"ias-803177988"}
console-api debug URL: https://static.adsafeprotected.com/sca.17.4.114.js(Line 32)
Message:
a: 0.002197265625ms
console-api log (Line 1)
Message:
{"scaInfoOriginatorASID":"55b8a3c1-412d-a461-d624-aa86ab3cb2d9","cache":{"mvn":{"output":"ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--"},"fsc":{"output":"17.4.114v220002022000220000022002222000022220202020222220222220002222022002222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022202220020222222000220000222202222202222000002002002222222222220022202200222002220222202"},"sd":{"output":"MTcuNC4xMTR2MTIwMHx8MTYwMHx8MXx8MXx8MjR8fDEyMDB8fDB8fDB8fDF8fGxhbmRzY2FwZS1wcmltYXJ5fHwyNHx8NC8zfHw0LzN8fDB8fDE2MDA-"},"no":{"output":"MTcuNC4xMTR2TW96aWxsYXx8TmV0c2NhcGV8fG58fDE2fHxufHwwfHxufHxMaW51eCB4ODZfNjR8fEdlY2tvfHwyMDAzMDEwN3x8LTEyMHx8TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--"},"asp":{"output":"1597270444523||ea7abd996b9bc01a84e2022e37362700||71ff54ebddb1e090fbf173d96e2342c8||966cebcebdfdfac6ea72448eac550e04||29f26a53b1ed2eb80813c98ed55de911||d37fb090e9e93a50e0410a929c4ab5be||b4161bb151e7f84e740ea5190a0265dd||5dc6d770cdd0601fdb46b639391e924b||1576000828"}},"sentTime":1597270444525}
console-api log (Line 1)
Message:
{"messageContent":{"self":{"position":[0,10],"id":"0-10","isMe":true,"isLeaf":false,"adProxies":[{"tagId":"10764","adSafeId":"7dff01c3-41a1-89d6-d214-73e57b44b54e"}],"unifiedId":1597270444393,"inbox":[]},"unifiedId":1597270444393},"srcAsid":"7dff01c3-41a1-89d6-d214-73e57b44b54e","srcTagId":"10764","srcIsEmbedded":true,"srcIsFriendly":true,"srcBirthdate":1597270444393,"iasCommonId":"11ea","nodeSelector":"[data-integralas-id-7dff01c3-41a1-89d6-d214-73e57b44b54e]","positionStr":"1b","version":"0.1","sentTime":1597270444568}
console-api log (Line 1)
Message:
{"requestTop":"isRefreshable"}
console-api log (Line 1)
Message:
{"requestTop":"recordAdSlotImpression","asid":"7dff01c3-41a1-89d6-d214-73e57b44b54e","adUnitId":"247866432","cacheId":"ias-340024628"}
console-api log (Line 1)
Message:
{"scaInfoOriginatorASID":"55b8a3c1-412d-a461-d624-aa86ab3cb2d9","cache":{"mvn":{"output":"ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--"},"fsc":{"output":"17.4.114v220002022000220000022002222000022220202020222220222220002222022002222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022202220020222222000220000222202222202222000002002002222222222220022202200222002220222202"},"sd":{"output":"MTcuNC4xMTR2MTIwMHx8MTYwMHx8MXx8MXx8MjR8fDEyMDB8fDB8fDB8fDF8fGxhbmRzY2FwZS1wcmltYXJ5fHwyNHx8NC8zfHw0LzN8fDB8fDE2MDA-"},"no":{"output":"MTcuNC4xMTR2TW96aWxsYXx8TmV0c2NhcGV8fG58fDE2fHxufHwwfHxufHxMaW51eCB4ODZfNjR8fEdlY2tvfHwyMDAzMDEwN3x8LTEyMHx8TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--"},"asp":{"output":"1597270444523||ea7abd996b9bc01a84e2022e37362700||71ff54ebddb1e090fbf173d96e2342c8||966cebcebdfdfac6ea72448eac550e04||29f26a53b1ed2eb80813c98ed55de911||d37fb090e9e93a50e0410a929c4ab5be||b4161bb151e7f84e740ea5190a0265dd||5dc6d770cdd0601fdb46b639391e924b||1576000828"}},"sentTime":1597270445899}
console-api log (Line 1)
Message:
{"scaInfoOriginatorASID":"55b8a3c1-412d-a461-d624-aa86ab3cb2d9","cache":{"mvn":{"output":"ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--"},"fsc":{"output":"17.4.114v220002022000220000022002222000022220202020222220222220002222022002222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022202220020222222000220000222202222202222000002002002222222222220022202200222002220222202"},"sd":{"output":"MTcuNC4xMTR2MTIwMHx8MTYwMHx8MXx8MXx8MjR8fDEyMDB8fDB8fDB8fDF8fGxhbmRzY2FwZS1wcmltYXJ5fHwyNHx8NC8zfHw0LzN8fDB8fDE2MDA-"},"no":{"output":"MTcuNC4xMTR2TW96aWxsYXx8TmV0c2NhcGV8fG58fDE2fHxufHwwfHxufHxMaW51eCB4ODZfNjR8fEdlY2tvfHwyMDAzMDEwN3x8LTEyMHx8TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--"},"asp":{"output":"1597270444523||ea7abd996b9bc01a84e2022e37362700||71ff54ebddb1e090fbf173d96e2342c8||966cebcebdfdfac6ea72448eac550e04||29f26a53b1ed2eb80813c98ed55de911||d37fb090e9e93a50e0410a929c4ab5be||b4161bb151e7f84e740ea5190a0265dd||5dc6d770cdd0601fdb46b639391e924b||1576000828"}},"sentTime":1597270447734}

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

7cfdd55c1a0273065026975cff5e535f.safeframe.googlesyndication.com
adservice.google.com
adservice.google.de
ap.lijit.com
api.segment.io
balancer.sitebarad.com
beacon.s-onetag.com
beacon.tru.am
c.evidon.com
capi.connatix.com
cd.connatix.com
cdn.adsafeprotected.com
cdn.ampproject.org
cdn.segment.com
cdn.tinypass.com
cdneu-xch.media.net
cdnjs.cloudflare.com
cds.connatix.com
code.jquery.com
connect.facebook.net
contextual.media.net
cslogger.media.net
dfp-gateway.s-onetag.com
dpm.demdex.net
dt.adsafeprotected.com
experience.tinypass.com
geo.moatads.com
get.s-onetag.com
googleads.g.doubleclick.net
gum.criteo.com
gwiqcdn.globalwebindex.net
img.connatix.com
l.betrad.com
mab.chartbeat.com
metrics-collector.s-onetag.com
onetag-geo-grouping.s-onetag.com
onetag-geo.s-onetag.com
pagead2.googlesyndication.com
ping.chartbeat.net
pipe08.sitebarad.com
pixel.adsafeprotected.com
px.moatads.com
queso-cdn.prod.reuters.tv
reuters.demdex.net
reutersdfpcw319687550988.s.moatpixel.com
s.mnet-ad.net
s.ytimg.com
s0.2mdn.net
s1.adform.net
s3.reutersmedia.net
s4.reutersmedia.net
sb.scorecardresearch.com
securepubads.g.doubleclick.net
siteintercept.allegiancetech.com
sope.prod.reuters.tv
static.adsafeprotected.com
static.chartbeat.com
static.reuters.com
stats.g.doubleclick.net
tpc.googlesyndication.com
track.adform.net
tru.am
usasync01.admantx.com
vid.connatix.com
www.dianomi.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.reuters.com
www.youtube.com
z.moatads.com
104.111.238.139
104.111.252.228
104.18.22.230
104.244.39.20
13.226.145.149
13.226.155.11
13.226.155.115
13.226.155.30
13.226.155.37
13.226.155.49
13.226.155.85
13.226.155.87
13.226.155.90
13.248.131.92
151.101.114.137
18.202.86.190
2.18.235.40
2.18.235.93
2001:4de0:ac19::1:b:2b
216.58.212.130
23.62.140.165
2406:da00:ff00::36eb:b8ea
2600:1f18:624f:b000:1a0c:44be:c431:52fe
2600:9000:2182:3c00:18:1fcd:34e:d2a1
2600:9000:2182:6c00:1e:ef1b:aa40:93a1
2600:9000:2182:6e00:8:48e:53c0:93a1
2600:9000:2182:d000:5:9a4c:9b00:93a1
2606:4700:20::681a:274
2606:4700:20::ac43:4af5
2606:4700::6811:4f6b
2606:4700::6811:b6b1
2a00:1450:4001:802::2001
2a00:1450:4001:806::2006
2a00:1450:4001:814::200e
2a00:1450:4001:815::2008
2a00:1450:4001:818::2001
2a00:1450:4001:819::2001
2a00:1450:4001:819::200e
2a00:1450:4001:81a::2002
2a00:1450:4001:81a::2003
2a00:1450:4001:81c::2002
2a00:1450:4001:81c::2004
2a00:1450:4001:81f::200e
2a00:1450:400c:c00::9a
2a02:2638::1c
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a04:4e42:1b::714
3.10.133.216
3.128.233.190
34.197.178.4
34.218.0.69
35.201.93.216
37.157.2.237
37.157.5.72
46.231.207.224
52.215.102.72
52.49.59.93
52.72.36.5
66.81.204.228
67.221.239.62
72.251.249.14
80.74.154.241
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
0301abe27c75fe3b60eff31ce1d31238c9b84d4f36c037bacf0a8656b6a6fb45
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0541539bf2c978c0ddec342e71cdeeb6c741a149356dcf13a01ae4217d28e46b
05570487bb3f6249f82ffaaf817889dc909225f80ae76d6f0e6c864465b8304f
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
092cb38034e7ba42e8fd1f025a262c74010ee844fc181a13c61ac41787a68756
09367caa70514803713fced8ee4ac247e1fbefe5fb13502fb24f20b46804d826
09c52e5ea3fdb1ac6d74bf9c68a5411ae21355fb33afd30b8b37c434c3338e2a
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11558e1d027dc06afd27bf2613c169508a497d802019b0d97c417097977f00e8
124de9480f0ecb6fb87f250a4a270bc8b44c68fec2b1d198ef1f4954c8fb7b2e
12f71cb993958eefc4bdb41d7dbbda490779a9c7aba448f7be52bb63912e0254
1812b780b33437b1222ebf3f6e7ae84051aa024f36bca24105f8df529d022dc7
187ef47cfc091c4fc645d78e6e4c56951cdd6144e5b9a6adddfacc286f1b1aa6
18c44f4e64c66d0c037bfd7ed0c8fae6f4e25f395135d2a6e06aa233f01173f4
1fb1163d28187416e25e2045924072c9b884118c56dcfc91188e032e5b506669
204e4bc3052ec43891fa672b858f1c5277a0d4f02b3757ca0343fb577ed86aba
245c7bb98e9ec0aaf0712f56ab6738e58bcee55110c6a8d8802efe864d0bdbd0
24cb78b580db1230f6566648f7b20e4ecc308c8fc35ef82f72fdcb708f785968
25adad9ca79b728ee179d70f9f9251b37634f92ddc1421d1e4204b1fbad4e303
2745a25e7c3895caeb5665057bf492a8555d724b959789d840bd2992528066ff
2a7a5100d1b04b40f49ec3661a2ce57d3af5acbd35497cd946e87912a6c9e021
2b8d8ef7fec86e16424f0c6be7f0471a0c29256e074e1336d92876ddb4bc09ff
3054b0161a1a4aa7ad8ef3f4711612a7aa7a196905f30ff61f8c6d87b5b2270f
306725f35f8c44921ea1465a88bedafcbbae5ced866635443189b22b22e1d97b
307f995d0069ac32dfd6595f75dce66f9b152e537b6bf796f7a9849eb0410fa0
31f14d476f00f561b40eaa467c71aeeb5fcdebd2b9f09128ae16b3f536b333b8
3234a9f00027b349b802fae240f760a270d6f4e7f39ecee827e77c3e282f7846
34cdb6307b099bbbbe4bd77a40fc926d20d665f864aa629a060a8348eeb1df58
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
38f82a586c4984fdc89697da37dac16d17ed9c1d619510ed32991778b3e21b26
394415bedb33f0d07d610f1ac10439e12098d7a747aca0510cddabca81a9092d
395da3ca5c327fe1f7ba97e75ecc2be72807f621f9c5406fdb1b0ebfb174a7b4
3c0d27b79bfe51d6abbc99eb79bd7731804fa80823d85bce422ee364185c6126
3c514d4fb8244af230a89d2203522c6a67a55a3f161cfd4fca9f53301c0588ff
3f52c3c54dadb4127c6f861b5f3105d0167c1edaf2fbc001edb2263e4fea72ea
42a2dcedbfef8ef01a17fcf5fcbfed0e6dd7749ec51690e70491c2c5e5b49c6b
45610b21279531a97f9566b0f0f8a1d287a45ae4bc6bc545971af5cd7e393cc6
47b498fc79a4b9d57c126b8ae0769ad842913bf897910c2fdd74801c82f2dc6f
482d82a54d9618d1038baffb214f05b2257d25fae39a68365f97fb1257f9f54a
4dfb7c925e9a341c587ecc6af346f2cf875c63da4609858353eed31324e7ac48
4ed44c518b79ec0c24d13803371365e67d6ca02829631e0dad366850fd466044
5126084b5c3ae3d86a6c314c2cb5dcb31fba636a5ef8faafac6b182a3fcb4a5e
526d41d59fc80ab6862c407300e4f7f7ea1b4e29fdbf6d9201f49598785d35c0
5275e53dca9e7f8cb2741c3e11050df06b6d9167b088dbd8e0ce59052aa97556
52dc24c0429ea6ccc5b579a6da8bb79bf41e471fe5108a62009f3c2e195551c0
54138d578ed166d5381db70b3dd14a16830233553b6e4213402bae2fdb0564b4
575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5b548c55cb99a60bc5d2ed82331220dd5363894f1d0f6a98900b486ce9e85d3b
6088012dda2274a27fa40ed153d9e3a6c96a22af1b177f8a2916368eb3e88bb0
6268b1c20e1456226c8c1f44d691bcee210b83fa7d9d2647bceddcf273980074
62c155232156eb11fcfd2db27dc8304f7c2fd810da25bfa7740ef28b0b156f88
631b052c0fac425fdea5a7a644d5e3554283675424c4c95003960e8fa96f6060
6346ee09058d555984eb04aac881775c926b5d9d4f73ca91493f7cb708ed90df
661ed736aaf54503512d6e477d9a2debdbe91b7eadddbaa3202a693462cd4766
67032371580ed843d5a9460d87afa85e4c02983a1dc620b38020d311308f4e59
67238e3d12ebbeeea890e4e9a67611b31bb21d2a0d22e7179876ffb06a6a8719
68ff86e6a3bc683739e7190e4efaff20bbafe0d89c99c42c1b17163ef5203968
698a0d14189cdfa590d112b056e978324c551080f63a9e0b340b6f1b204af296
6a09f19ac3a6fb7a6db7aa92dc9a888e9f6f169b18171d6d958693399af19c99
6aa7c3edbc1ee1fe66d4db0fea18aa2d0bbe0dfae05d228c9ffeeaeacb6f1c53
6d2fe32d253b1c23c584887a2d05bba8d56ad3b233081d190be436c70209ead2
6e198633e8651d2d219b18b644b77c8fac327d010d3d792be5d741f5bed10ff7
6ec8c9246cb65096ce966d070e6e1284e9cf9d5256bfd2104170f470067c63c3
6f23d93c9b8e3ca26f6fcc6be6a8d087e43a3f5795daa3c61017071642f66f3c
6f4ae319a9f80c61a3c9734248d8be481ae430185443f3b2747bc1b4f617cc8f
70503c92bcbb8105d95ec4de2012f23098c3383586e95323e4b3384b56af4beb
731ebb6e8eb86eb45b6e7269a9374d1ac90533bfca3a81774dfe51f84fee2f92
7464555aae6d8d87b77f7170fba1698ff64f7454ded58627ca1819246e9a9969
74946a6535af619858813a4ba2513c464acc6499631515961c2c2862b515eab8
7592d77fd22fcb2a04f3be99244059bd057440217b74917b2c54a2d3dd7656be
78d7768fb1213eced669894455aac7c1bfb17452b25ef69859ab7617cb85856f
7962dce1427363ac8964c27e8a221d2b6f320fa55f7e32df3508b288d99ff915
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7a093c39bdbf0571cc22c594df90ec9f5b114be57bd9f565a192fa07545562f2
7b1d29ae1792d7b78f057f0043a15ba261c39850cc37da2ce80352b9877585db
7b48a74fa0f94d83ae6d60c772f5e7aa66e7be1b63ccf223ca14e34d3d7b0d22
7ce982087ae44317f0aad7450b6c076b373c33b183833e7808dd6c3d6dcef3cc
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85c45ca12ba3ed0f93ec9c7f2c8a4ee46da8fdadfcb5841234080d7f2454a04e
893df2b9ceb653f94333139d561d363bf4c365e651a0a3ade839d96200942e37
8ac1703c1c34b2be426deda409d39258f82fae17f13e645f377f337a954aedde
8b29fec90a8865477f7dd35ac532823dab44c2ea9480567f491dd61c2bf707bf
90ccdd961b13e4d360559359104a17514700c2f888f2880599170ca377dfcbcb
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
99781410070a5dd4d753fdb8a46f4272082b5be64541dcfcb1b2d3c4aea09c6c
99e0ec85e006482952c415bc44c752871b89bd197b6a2d299144b1fd0311db44
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9e9e2039d789de658a139f9993f8c1809671246f7c9f1b3d5792fc2c8e19e500
9f9104dee58871cdb561e4f139fcf095a2fc1fcb0a7778a964975e6b12059c6a
a0d3ad2bd0bb836d67e587c3b497fc7275294125707b05bc38624cf787086dec
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a34de1a7fa8ea23a916005e590bf982aa4fb0f645a6fa908c4144bd7074148ee
a938823e28bf7fe7d6192a30d952abd9446417d12bffd9047ef5849f56d21df5
ad590c30e8e0ef2b2539b0f1a7e4e4da38a6a7b2a8b3f88048338c22da590253
ad9ae0374e0334d2511e951a2381a164fa87ce86594fc027d25a8624774c3c96
adfa0c7de03bc3bea3de80b4a4514881c8b6296568f43a5acd5cd7a16fffd1c9
ae0a54c57bc625c5af8742f7655f75bc94b148ed3cc638507dff2176f2c8dce8
b13fd23c0effcdc881aa98e5754af4cdefedd4ba4db81a6310850f8635405b82
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b530d2f33467c65e254999ed904332bc40a5aa25c750229790295f6742938b6f
b5771462426214dd38f38352be4e5018e2d479df771d17d87723969efab65a49
b57edf9e12c72fcbdd2385fd05b19a276bf8629efd6765ede37a495f651d7904
ba607af2c8d414ab6d4bac90c526d90a939cb0adf507b6ba063265347479159d
baa066783210ec503c97545b0caeffba83b53c3c4d969a9c5ce94ee3ecb4db00
bb56e9cb6a9934d4d3c871e6aa711d2168e0c74c02cc3388539fe50e57091dca
bd1dc64fac45e75fffefbd76f176c6ea118ab79b88b3efddc5642d4e7c76d4fe
bf3669795bba5ee81c6defbeb24c48986d4693233ce0964138e897363527c3af
bf6f96985d9f9ab3332721601ff06191bfb8630e60fcf414cdde0cdf4e5eb811
c118b64bbb3ed166f68f2f5c02469cd1373f6abff79ab495b1f33726a972f53d
c183c1626bcd7149328ea3ac80731240cca401982a790d89ed973771275f455f
c1acfa727754dab58bedc79995a642e235c6fde6449824c4fba4318fc060c91c
c4715df69ab3c955690ad6d9b24ebe3fec4269ab1632a27f628e727d8ab5294d
c516c523ffceafbf9482017d73bbcea30b998c15ca9de148fc00514561daaf67
c54eabc4e016ac3cd83469766ba68a2d83feb58cf65508bf034baff93071fff0
c8567ea9f657a5f2ea1633ec26b13de309f60f0921a278db2a9be91d2e48984e
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ce075d393fe639efae1669527b65016814f28526ff0b5db916fb760aeba3b3cc
ce2ba098bd8570d95c60d33cc035ee6764193c8ff7e0d7a531d0e1e98e9ad592
cf2306b9feb8c0a2d21afe0d307b1066d3ee5eced9f7f1c23bf84811d8c8ad75
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfd0da29a6d34ea44fb0035a3a1b409a4a66c091fb0f143ea2f73a643c3f8cef
d20fce09ded558cf0c4bac7cb324828ee1ba17624eaed51fbdc53e953ff2686d
d27b59be0fa35fd199035fb3d095a553cf11e6c7b44d583b2942650fc3da5977
d4fa79afcf5a5cc5a0f12dedaf825f11530e6397d723fe7044cd37ba3c248e57
d640ed39630d91dec61dcb107b977293ec29fecbb5e74467e017d872bf76b0db
d7d62426c6b87d35cef5c2c873355aa44edffcf4a7f927f1c51b10694ea4f6ed
db593eacb6cf64edc299e34a7f2602cb9e390f21043e948bbf0ae4f968e1e52a
db9e31fbe599256b6904f9f00a756db056b71cbb2c9ed370d3e238a26cbe4a61
deebd915997d1fc20b8c17b0ac9e57a20b84cb44a54858b18d0ad0ee6ea51f5a
e23e579cc684e3244e0556685034279581cc32f155b8e8bbd481bf92e265560e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e41f07eced66e12809bec654b0a18677a78a7814525dcb6b99934d0b4bcecfc4
e58b5f1ec0b366d5af022fc6580f518062cd5de023870bb4881cc7936cb4da06
e7005c02b5be4507faa3beb9121e27257e69da872075c186cbac15e6ab910c3e
ea1e888e9399dc32e3c68344589b20d11e8ee2532efd971961ab0dd219e39674
eaad44637697425c5c17e2f974faf574cd5d522e2410405fa462331e4b79a313
ebf18dcc16c7de2a8d405ebd3035a852550021021d70b43677b9d5fdeb2b98d2
ed98a8e8e7347f903b4e5fd2108d2c932378f5624fc308217687c62ff1ab5d3a
ee0768f9d2def8b13df284410776f5d755109e77b5c0ca17d8895f65b343a0cd
ee1ed7b578e1ef6fc0b4eac9c4f9eaa16f3301fce096666526e9d08e4956bb5d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f01d25f7a76e0682a7a43230c32bef653eaf28b8a6f7a683ebb88bf8c6aa4f50
f0aca48670c6ddc0797c4b7e29581db9b873a5ce380b374ab99709e1ce0c8c95
f2a4b8eca1da948f9dc47eb9a7eddb441d0c926be47d6dd055bfd43f281c7ed2
f37beed085d2cfdd1386a8942434d8011aa20f2e7afa20d7edfd0d49998da1e7
f46352b7163b3636d127be739e4adca5bba29cb87247098ec04bde2dc5575702
f546cca1ccf7330b7ba05ca0ab0064d979340e169a0ccdd527dd35e3d996b6d2
f77f47058428a1c21dad5a75ac13fbfdeb9858947218fee2112fded5972a0b5d
f9b0def9c2f40e6dd8149a4166a4364fb3c27337e9d3e63bfbc265ecaa1f9058
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955