news.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42c8 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware///
Effective URL:
https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Submission: On December 16 via api (December 16th 2021, 6:22:17 pm UTC) from US — Scanned from DE

Summary HTTP 76 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 39 IPs in 5 countries across 30 domains to perform 76 HTTP transactions. The main IP is 2a04:fa87:fffd::c000:42c8, located in Ireland and belongs to AUTOMATTIC, US. The main domain is news.sophos.com.
TLS certificate: Issued by R3 on November 22nd 2021. Valid for: 3 months.

This is the only time news.sophos.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 16	2a04:fa87:fff... 2a04:fa87:fffd::c000:42c8	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:5714	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	143.204.98.92 143.204.98.92	16509 (AMAZON-02) (AMAZON-02)
1 3	2a00:1450:400... 2a00:1450:400c:c02::9a	15169 (GOOGLE) (GOOGLE)
1	104.111.229.66 104.111.229.66	16625 (AKAMAI-AS) (AKAMAI-AS)
1 4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba20	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	143.204.98.115 143.204.98.115	16509 (AMAZON-02) (AMAZON-02)
1	199.232.136.157 199.232.136.157	54113 (FASTLY) (FASTLY)
1	151.101.1.2 151.101.1.2	54113 (FASTLY) (FASTLY)
4	3.223.38.51 3.223.38.51	14618 (AMAZON-AES) (AMAZON-AES)
1	143.204.94.161 143.204.94.161	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1288:80:... 2a00:1288:80:800::7001	203220 (YAHOO-DEB) (YAHOO-DEB)
1	35.201.112.186 35.201.112.186	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:82a::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
1	142.250.74.194 142.250.74.194	15169 (GOOGLE) (GOOGLE)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	108.174.10.14 108.174.10.14	14413 (LINKEDIN) (LINKEDIN)
7	108.157.4.54 108.157.4.54	16509 (AMAZON-02) (AMAZON-02)
1	3.224.194.150 3.224.194.150	14618 (AMAZON-AES) (AMAZON-AES)
3	35.186.194.58 35.186.194.58	15169 (GOOGLE) (GOOGLE)
1	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
2	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
2	108.156.252.52 108.156.252.52	16509 (AMAZON-02) (AMAZON-02)
1	143.204.98.86 143.204.98.86	16509 (AMAZON-02) (AMAZON-02)
2 2	52.50.109.234 52.50.109.234	16509 (AMAZON-02) (AMAZON-02)
1 2	143.204.98.23 143.204.98.23	16509 (AMAZON-02) (AMAZON-02)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
3	20.62.48.180 20.62.48.180	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	52.142.114.2 52.142.114.2	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	108.157.4.122 108.157.4.122	16509 (AMAZON-02) (AMAZON-02)
1	18.66.248.113 18.66.248.113	16509 (AMAZON-02) (AMAZON-02)
1	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
76	39

16 2a04:fa87:fffd::c000:42c8 (Ireland) 1 redirects

ASN2635 (AUTOMATTIC, US)

news.sophos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5714 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.92 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-92.fra50.r.cloudfront.net

w.soundcloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400c:c02::9a (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.229.66 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-229-66.deploy.static.akamaitechnologies.com

img03.en25.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00::210:ba20 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-115.fra50.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.136.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.2 (United States)

ASN54113 (FASTLY, US)

a.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.223.38.51 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-223-38-51.compute-1.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.94.161 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-94-161.fra50.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:80:800::7001 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.112.186 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 186.112.201.35.bc.googleusercontent.com

edge.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.74.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.174.10.14 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-10-14.fwd.linkedin.com

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 108.157.4.54 (United States)

ASN16509 (AMAZON-02, US)

widget.sndcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.224.194.150 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-224-194-150.compute-1.amazonaws.com

q.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.186.194.58 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 58.194.186.35.bc.googleusercontent.com

rs.fullstory.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.156.252.52 (United States)

ASN16509 (AMAZON-02, US)

api-widget.soundcloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.86 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-86.fra50.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.50.109.234 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-50-109-234.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.98.23 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-23.fra50.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 20.62.48.180 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

e.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.142.114.2 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.157.4.122 (United States)

ASN16509 (AMAZON-02, US)

wave.sndcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.248.113 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-113.dus51.r.cloudfront.net

i1.sndcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.71.131.137 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	sophos.com 1 redirects news.sophos.com	1 MB
9	sndcdn.com widget.sndcdn.com wave.sndcdn.com i1.sndcdn.com	394 KB
5	clarity.ms 1 redirects e.clarity.ms c.clarity.ms	23 KB
4	linkedin.com 3 redirects px.ads.linkedin.com www.linkedin.com px4.ads.linkedin.com	3 KB
4	fullstory.com edge.fullstory.com rs.fullstory.com	68 KB
4	stackadapt.com tags.srv.stackadapt.com	6 KB
4	bing.com 1 redirects bat.bing.com c.bing.com	12 KB
4	doubleclick.net 1 redirects stats.g.doubleclick.net googleads.g.doubleclick.net	19 KB
3	company-target.com 1 redirects api.company-target.com segments.company-target.com	2 KB
3	soundcloud.com w.soundcloud.com api-widget.soundcloud.com l9bjkkhaycw6f8f4.soundcloud.com Failed	5 KB
2	bidr.io 2 redirects match.prod.bidr.io	1019 B
2	facebook.com www.facebook.com	386 B
2	google.de www.google.de	565 B
2	google.com 1 redirects www.google.com	641 B
2	yimg.com s.yimg.com	7 KB
2	adsrvr.org js.adsrvr.org insight.adsrvr.org	3 KB
2	quora.com a.quora.com q.quora.com	14 KB
2	facebook.net connect.facebook.net	113 KB
2	wp.com stats.wp.com pixel.wp.com	3 KB
2	googletagmanager.com www.googletagmanager.com	88 KB
1	rlcdn.com id.rlcdn.com	66 B
1	t.co t.co	470 B
1	twitter.com analytics.twitter.com	675 B
1	yahoo.com sp.analytics.yahoo.com	714 B
1	googleadservices.com www.googleadservices.com	14 KB
1	ads-twitter.com static.ads-twitter.com	6 KB
1	demandbase.com scripts.demandbase.com	16 KB
1	licdn.com snap.licdn.com	2 KB
1	en25.com img03.en25.com	3 KB
1	jsdelivr.net cdn.jsdelivr.net	9 KB
76	30

	Domain	Requested by
16	news.sophos.com	1 redirects news.sophos.com
7	widget.sndcdn.com	w.soundcloud.com widget.sndcdn.com news.sophos.com
4	tags.srv.stackadapt.com	news.sophos.com tags.srv.stackadapt.com edge.fullstory.com
3	e.clarity.ms	bat.bing.com edge.fullstory.com
3	rs.fullstory.com	edge.fullstory.com
3	bat.bing.com	news.sophos.com bat.bing.com
3	stats.g.doubleclick.net	1 redirects news.sophos.com
2	c.clarity.ms	1 redirects news.sophos.com
2	segments.company-target.com	1 redirects news.sophos.com
2	match.prod.bidr.io	2 redirects
2	api-widget.soundcloud.com	widget.sndcdn.com
2	www.facebook.com	news.sophos.com
2	px.ads.linkedin.com	2 redirects
2	www.google.de	news.sophos.com
2	www.google.com	1 redirects news.sophos.com
2	s.yimg.com	news.sophos.com s.yimg.com
2	connect.facebook.net	news.sophos.com connect.facebook.net
2	www.googletagmanager.com	news.sophos.com www.googletagmanager.com
1	insight.adsrvr.org	js.adsrvr.org
1	i1.sndcdn.com	news.sophos.com
1	wave.sndcdn.com	widget.sndcdn.com
1	c.bing.com	1 redirects
1	id.rlcdn.com	news.sophos.com
1	api.company-target.com	scripts.demandbase.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	t.co	news.sophos.com
1	analytics.twitter.com	static.ads-twitter.com
1	sp.analytics.yahoo.com	news.sophos.com
1	q.quora.com	news.sophos.com
1	px4.ads.linkedin.com	news.sophos.com
1	www.linkedin.com	1 redirects
1	www.googleadservices.com	www.googletagmanager.com
1	edge.fullstory.com	news.sophos.com
1	js.adsrvr.org	www.googletagmanager.com
1	a.quora.com	news.sophos.com
1	static.ads-twitter.com	news.sophos.com
1	scripts.demandbase.com	news.sophos.com
1	snap.licdn.com	news.sophos.com
1	pixel.wp.com	news.sophos.com
1	img03.en25.com	news.sophos.com
1	w.soundcloud.com	news.sophos.com
1	stats.wp.com	news.sophos.com
1	cdn.jsdelivr.net	news.sophos.com
0	l9bjkkhaycw6f8f4.soundcloud.com Failed	widget.sndcdn.com
76	44

This site contains links to these domains. Also see Links.

Domain
ai.sophos.com
nakedsecurity.sophos.com
www.sophos.com
www.shodan.io
hub.sophos.net
secure2.sophos.com
www.facebook.com
twitter.com
www.linkedin.com
secure.ethicspoint.eu

Subject Issuer	Validity	Valid
news.sophos.com R3	`2021-11-22` - `2022-02-20`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-03` - `2022-07-02`	a year	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
*.soundcloud.com GlobalSign GCC R3 DV TLS CA 2020	`2021-01-13` - `2022-02-14`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.en25.com DigiCert SHA2 Secure Server CA	`2021-09-14` - `2022-09-14`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2021-09-30` - `2022-03-30`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-09-25` - `2021-12-24`	3 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2021-10-18` - `2022-10-14`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
quora.com R3	`2021-12-05` - `2022-03-05`	3 months	crt.sh
*.srv.stackadapt.com Amazon	`2021-11-09` - `2022-12-07`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2021-03-18` - `2022-04-19`	a year	crt.sh
*.api.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-11-08` - `2021-12-29`	2 months	crt.sh
edge.fullstory.com GTS CA 1D4	`2021-10-20` - `2022-01-18`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.sndcdn.com GlobalSign GCC R3 DV TLS CA 2020	`2021-01-13` - `2022-02-14`	a year	crt.sh
*.quora.com R3	`2021-12-05` - `2022-03-05`	3 months	crt.sh
*.fullstory.com R3	`2021-11-30` - `2022-02-28`	3 months	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-10-19` - `2022-04-13`	6 months	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.google.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2021-10-20` - `2022-09-26`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh
a.clarity.ms Microsoft RSA TLS CA 01	`2021-07-27` - `2022-07-27`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Frame ID: C36172E20BA9E0C5FA8602CE368188CD
Requests: 62 HTTP requests in this frame

Frame: https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/1054614607&color=%23ff5500&auto_play=false&hide_related=true&show_comments=false&show_user=true&show_reposts=false&show_teaser=false
Frame ID: FA850C6B8FF296C45660C6401394953E
Requests: 16 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&upid=ql4fc2b&upv=1.1.0
Frame ID: 0E856F42E2E01EAADE25B24292664720
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

What to expect when you’ve been hit with Avaddon ransomware – Sophos News

Page URL History Show full URLs

https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/// HTTP 301
https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

Alpine.js (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+[^\w-]x-data[^\w-][^<]+
/alpine(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

76
Requests

93 %
HTTPS

33 %
IPv6

30
Domains

44
Subdomains

39
IPs

5
Countries

1895 kB
Transfer

4034 kB
Size

40
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://ai.sophos.com/
Title: AI Research

Search URL Search Domain Scan URL

URL: https://nakedsecurity.sophos.com/
Title: Security News & Tips

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/managed-threat-response/rapid-response.aspx
Title: Sophos Rapid Response

Search URL Search Domain Scan URL

URL: https://www.shodan.io/
Title: Shodan.io

Search URL Search Domain Scan URL

URL: https://hub.sophos.net/departments/departments/marketing/campaigns/global/mtr
Title: Incident Response Guide

Search URL Search Domain Scan URL

URL: https://secure2.sophos.com/en-us/security-news-trends/whitepapers/four-key-tips-from-incident-response-experts.aspx
Title: four top tips for responding to a security incident

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/medialibrary/pdfs/whitepaper/sophos-state-of-ransomware-2021-wp.pdf?cmp=120469
Title: State of Ransomware 2021

Search URL Search Domain Scan URL

URL: http://www.facebook.com/share.php?u=https://news.sophos.com/?p=75410&title=What%20to%20expect%20when%20you%E2%80%99ve%20been%20hit%20with%20Avaddon%20ransomware
Title: Share on Facebook

Search URL Search Domain Scan URL

URL: http://twitter.com/intent/tweet?text=What%20to%20expect%20when%20you%E2%80%99ve%20been%20hit%20with%20Avaddon%20ransomware%20https%3A%2F%2Fnews.sophos.com%2F%3Fp%3D75410
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Title: Share on LinkedIn

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/legal/sophos-website.aspx
Title: Terms

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/legal/sophos-group-privacy-policy.aspx
Title: Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/legal/cookie-information.aspx
Title: Cookies

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/legal.aspx
Title: General

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/legal/modern-slavery-act-transparency-statement.aspx
Title: Modern Slavery Statement

Search URL Search Domain Scan URL

URL: https://secure.ethicspoint.eu/domain/media/en/gui/104916/index.html
Title: Speak Out

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/// HTTP 301
https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 32

https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1221295723&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=What%20to%20expect%20when%20you%E2%80%99ve%20been%20hit%20with%20Avaddon%20ransomware%20%E2%80%93%20Sophos%20News&utmhid=583899951&utmr=-&utmp=%2Fcorpblog%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&utmht=1639678931721&utmac=UA-737537-1&utmcc=__utma%3D1.331150178.1639678932.1639678932.1639678932.1%3B%2B__utmz%3D1.1639678932.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1604679883&utmredir=3&utmu=q1CAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=331150178.1639678932&jid=1604679883&_v=5.7.2dc&z=1221295723 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=331150178.1639678932&jid=1604679883&_v=5.7.2dc&z=1221295723&slf_rd=1&random=327351642

Request Chain 36

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1639678931772&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1639678931772%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-us%252F2021%252F05%252F24%252Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1639678931772&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1639678931772&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&liSync=true&e_ipv6=AQJIOtc5eolGBgAAAX3EevcbKc9jxmCZ83THcp64ufpGj24oolw65lxhNK4FFRphG9z3eLZ1v3Y

Request Chain 55

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
https://segments.company-target.com/log?vendor=choca&user_id=AAh4XE7DdwgAAD6bF72vrQ HTTP 303
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAh4XE7DdwgAAD6bF72vrQ&verifyHash=adc35e16636463db1781f56f977604d1b22fe677

Request Chain 58

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?CtsSyncId=DDB3E7D0F0394CFD92724467AAF27856&RedC=c.clarity.ms&MXFR=3DC4B1F2EBE263323C9BA0FDEFE26DAA HTTP 302
https://c.clarity.ms/c.gif?CtsSyncId=DDB3E7D0F0394CFD92724467AAF27856&MUID=1C8076501D0E68273739675F1CDC69D3

76 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Redirect Chain

https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware///
https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

67 KB
21 KB

354ms
354ms

Document
text/html

2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx / WordPress VIP <https://wpvip.com>

Resource Hash

21fb7062e2c875b095ff5ff0e224206641b288193b0956b7615f9bc47aef4f39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

server: nginx
date: Thu, 16 Dec 2021 18:22:11 GMT
content-type: text/html; charset=UTF-8
x-hacker: If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by: WordPress VIP <https://wpvip.com>
host-header: a9130478a60e5f9135f765b23f26593b
link: <https://news.sophos.com/wp-json/>; rel="https://api.w.org/" <https://news.sophos.com/wp-json/wp/v2/posts/75410>; rel="alternate"; type="application/json" <https://news.sophos.com/?p=75410>; rel=shortlink
x-rq: hhn2 0 2 9980
cache-control: max-age=300, must-revalidate
content-encoding: gzip
age: 0
x-cache: miss
vary: Accept-Encoding
accept-ranges: bytes
strict-transport-security: max-age=31536000

Redirect headers

server: nginx
date: Thu, 16 Dec 2021 18:22:11 GMT
content-type: text/html; charset=UTF-8
location: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
x-hacker: If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by: WordPress VIP <https://wpvip.com>
host-header: a9130478a60e5f9135f765b23f26593b
x-redirect-by: WordPress
x-rq: hhn2 0 2 9980
cache-control: max-age=300, must-revalidate
content-encoding: gzip
age: 0
x-cache: miss
strict-transport-security: max-age=31536000

GET
H2 200 /
news.sophos.com/_static/ 234 KB
38 KB 8ms
7ms Stylesheet
text/css 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/_static/??-eJyNj80OgjAQhF/IshRUwsH4LKVsoLr9CduG9O0t6gHixdvOznzZHViDME5TGpFBM8NoOMJAXj8FmWFRSwaOmbCyxlUlcII98WCwOBqFhBZdPIhAKuMiCCel83948fb6AGnv4paJc/EY2IfZs8OVRVPL7vNkGRv5Q9gkAqXJuHIQY1Clmqyr87vud7Exd3uT17a/dLKV/QufZ2XA

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

29abd4bd1e812838b2a48187c85ba1649629d3fb12a5599dae092a47b9348a54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
x-rq: hhn2 0 2 9980
last-modified: Wed, 15 Dec 2021 12:28:39 GMT
server: nginx
age: 107217
vary: Accept-Encoding
x-cache: hit
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 38895

GET
H2 200 / Show response
news.sophos.com/_static/ 98 KB
34 KB 13ms
13ms Script
application/javascript 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZebmaeXVayjj0+Rbm5melFiSSpUsX2uraGZsaWpoYGZpUkWAK+HIiQ=

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

75839e3ea0cd949a33dc21dd8b0931f396829fea8e0e3148b576b1228f40e469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
x-rq: hhn2 0 2 9980
last-modified: Tue, 14 Dec 2021 19:38:14 GMT
server: nginx
age: 165952
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 34312

GET
H2 200 Category-Icon-Security-Operations@2x_r2.min_.png
news.sophos.com/wp-content/uploads/2021/06/ 27 KB
27 KB 8ms
6ms Image
image/webp 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://news.sophos.com/wp-content/uploads/2021/06/Category-Icon-Security-Operations@2x_r2.min_.png

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

ab027866fcf800aba11e7788a4db4bf79ded8c4b6bcccad828dae74c297e8c0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
x-rq: hhn2 109 88 443
last-modified: Tue, 23 Nov 2021 14:02:47 GMT
server: nginx
etag: "971065d732461abb"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 27166
expires: Wed, 23 Nov 2022 14:02:47 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 131 KB
49 KB 44ms
18ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5a1db9930dac42b80b1641f6de98442d2fadee3a9ffbbb9caf2de4b1fd350894

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: br
vary: *
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49621
x-xss-protection: 0
pragma: no-cache
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 wp-emoji-release.min.js Show response
news.sophos.com/wp-includes/js/ 18 KB
5 KB 8ms
7ms Script
application/javascript 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/wp-includes/js/wp-emoji-release.min.js?ver=5.8.2

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
x-rq: hhn2 0 2 9980
last-modified: Tue, 23 Nov 2021 20:30:58 GMT
server: nginx
age: 1894489
etag: W/"619d4f82-4705"
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 4926
expires: Fri, 16 Dec 2022 18:22:12 GMT

GET
H2 200 Peter-Mackenzie.jpg
news.sophos.com/wp-content/uploads/2019/09/ 4 KB
4 KB 9ms
8ms Image
image/webp 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://news.sophos.com/wp-content/uploads/2019/09/Peter-Mackenzie.jpg?w=200

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

8281d5e3a85e4ea0e28cba5c3c13a28296273440d3168bc8b08baefa635bcbdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
x-rq: hhn2 109 28 443
last-modified: Tue, 23 Nov 2021 18:18:34 GMT
server: nginx
etag: "674b1e47f882b720"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 4392
expires: Wed, 23 Nov 2022 18:18:34 GMT

GET
H2 200 / Show response
news.sophos.com/_static/ 135 KB
38 KB 8ms
7ms Script
application/javascript 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/_static/??-eJyVjFEOwiAQBS8kLGDU9sN4FkI2LSgLYVfr8cX0AiV5X5OZB1tVoZAgCciKGRm41LUw4cbKGXuDxH1dKs+I6uO007YDvQOd+ASHPkJpAzZ+pXk+7u9IvyW+xqvgc/VxoeGw+iaEbbhb/HDyZz165Lu9nqfZmOkypx+gu6BJ

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

a36c1b591e0a043aef36da97ac4da5a313386c35ad3c92eb558e13d0291f8eff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
x-rq: hhn2 0 2 9980
last-modified: Mon, 06 Dec 2021 16:56:07 GMT
server: nginx
age: 700783
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 38988

GET
H2 200 alpine.min.js Show response
cdn.jsdelivr.net/gh/alpinejs/alpine@v2.8.1/dist/ 26 KB
9 KB 60ms
23ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/alpinejs/alpine@v2.8.1/dist/alpine.min.js?ver=2.0.1

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

de9485aee0805fc555984a4286697dccb8a9762fa9240c6a47b4dd478d282e74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4484113
x-jsd-version: 2.8.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by: cache-fra19176-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"6964-M33llwtEtRbUwMPPG0SKpWL3vX8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6be9ef8d9d13535d-FRA

GET
H2 200 / Show response
news.sophos.com/_static/ 4 KB
2 KB 7ms
6ms Script
application/javascript 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/_static/??/wp-includes/js/comment-reply.min.js,/wp-includes/js/wp-embed.min.js?m=1639510695j

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

070a9ce02c3219e9eae17eb12ed3944475f206d05e2c4c3ce14868c425d8df13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
x-rq: hhn2 0 2 9980
last-modified: Tue, 14 Dec 2021 19:38:15 GMT
server: nginx
age: 165952
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 1931

GET
H2 200 e-202150.js Show response
stats.wp.com/ 9 KB
3 KB 47ms
16ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202150.js
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-nc: HIT vie
date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: br
server: nginx
etag: W/"6197c5cf-3508"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Sun, 04 Dec 2022 23:50:29 GMT

GET
H2 200 sophos-ransomware-web-banner-1200x628px-option-2.png
news.sophos.com/wp-content/uploads/2021/05/ 166 KB
166 KB 7ms
5ms Image
image/webp 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://news.sophos.com/wp-content/uploads/2021/05/sophos-ransomware-web-banner-1200x628px-option-2.png?w=640

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d93cea00230540bc488dbe3afab54b37f88bd1b65aeb9bb576edaa7b8d0b4035

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
x-rq: hhn2 109 139 443
last-modified: Tue, 23 Nov 2021 13:37:26 GMT
server: nginx
etag: "2170016e5533ed99"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 170202
expires: Wed, 23 Nov 2022 13:37:26 GMT

GET
H2 200 sophos-edr-news-blog-image-838x440px@2x.png
news.sophos.com/wp-content/uploads/2021/05/ 21 KB
21 KB 15ms
12ms Image
image/webp 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://news.sophos.com/wp-content/uploads/2021/05/sophos-edr-news-blog-image-838x440px@2x.png?w=640

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1fa648f58cc0b3ce7d4574578aeb59038d1b5ddc00de3f568655be62a1d5c0ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
x-rq: hhn2 109 30 443
last-modified: Tue, 23 Nov 2021 13:37:26 GMT
server: nginx
etag: "f68a3b6e2975f38e"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 21526
expires: Wed, 23 Nov 2022 13:37:26 GMT

GET
H2 200 sophos-xdr.png
news.sophos.com/wp-content/uploads/2021/05/ 107 KB
107 KB 14ms
12ms Image
image/webp 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://news.sophos.com/wp-content/uploads/2021/05/sophos-xdr.png?w=640

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

56c4c9c31e9c4febdaaed356a15c9566084977d2a7a86842b14e9af3a71f9baa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
x-rq: hhn2 109 140 443
last-modified: Tue, 23 Nov 2021 13:37:26 GMT
server: nginx
etag: "3f36f9096d8e09b7"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 109794
expires: Wed, 23 Nov 2022 13:37:26 GMT

GET
H2 200 SophosSans-Light.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ 25 KB
25 KB 13ms
12ms Font
font/woff2 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Light.woff2

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/_static/??-eJyNj80OgjAQhF/IshRUwsH4LKVsoLr9CduG9O0t6gHixdvOznzZHViDME5TGpFBM8NoOMJAXj8FmWFRSwaOmbCyxlUlcII98WCwOBqFhBZdPIhAKuMiCCel83948fb6AGnv4paJc/EY2IfZs8OVRVPL7vNkGRv5Q9gkAqXJuHIQY1Clmqyr87vud7Exd3uT17a/dLKV/QufZ2XA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://news.sophos.com/_static/??-eJyNj80OgjAQhF/IshRUwsH4LKVsoLr9CduG9O0t6gHixdvOznzZHViDME5TGpFBM8NoOMJAXj8FmWFRSwaOmbCyxlUlcII98WCwOBqFhBZdPIhAKuMiCCel83948fb6AGnv4paJc/EY2IfZs8OVRVPL7vNkGRv5Q9gkAqXJuHIQY1Clmqyr87vud7Exd3uT17a/dLKV/QufZ2XA
Origin: https://news.sophos.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: gzip
vary: X-Mobile-Class
age: 176
x-cache: hit
content-length: 25344
x-rq: hhn2 0 2 9980
last-modified: Tue, 07 Dec 2021 18:14:19 GMT
server: nginx
etag: W/"61afa47b-62e4"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Fri, 16 Dec 2022 18:22:12 GMT

GET
H2 200 SophosSans-Medium.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ 26 KB
26 KB 13ms
12ms Font
font/woff2 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Medium.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://news.sophos.com/_static/??-eJyNj80OgjAQhF/IshRUwsH4LKVsoLr9CduG9O0t6gHixdvOznzZHViDME5TGpFBM8NoOMJAXj8FmWFRSwaOmbCyxlUlcII98WCwOBqFhBZdPIhAKuMiCCel83948fb6AGnv4paJc/EY2IfZs8OVRVPL7vNkGRv5Q9gkAqXJuHIQY1Clmqyr87vud7Exd3uT17a/dLKV/QufZ2XA
Origin: https://news.sophos.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: gzip
vary: X-Mobile-Class
age: 176
x-cache: hit
content-length: 26560
x-rq: hhn2 0 2 9980
last-modified: Tue, 07 Dec 2021 18:14:19 GMT
server: nginx
etag: W/"61afa47b-67a4"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Fri, 16 Dec 2022 18:22:12 GMT

GET
H2 200 SophosSans-Semibold.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ 26 KB
26 KB 13ms
13ms Font
font/woff2 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Semibold.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f927844e8c953560f5a67112c5dfaab926df93df57f3d8cd062028f1ca80b530

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://news.sophos.com/_static/??-eJyNj80OgjAQhF/IshRUwsH4LKVsoLr9CduG9O0t6gHixdvOznzZHViDME5TGpFBM8NoOMJAXj8FmWFRSwaOmbCyxlUlcII98WCwOBqFhBZdPIhAKuMiCCel83948fb6AGnv4paJc/EY2IfZs8OVRVPL7vNkGRv5Q9gkAqXJuHIQY1Clmqyr87vud7Exd3uT17a/dLKV/QufZ2XA
Origin: https://news.sophos.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: gzip
vary: X-Mobile-Class
age: 176
x-cache: hit
content-length: 26692
x-rq: hhn2 0 2 9980
last-modified: Tue, 07 Dec 2021 18:14:19 GMT
server: nginx
etag: W/"61afa47b-6828"
strict-transport-security: max-age=31536000
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Fri, 16 Dec 2022 18:22:12 GMT

GET
H2 200 sophos-ransomware-web-banner-1200x628px-option-2.png
news.sophos.com/wp-content/uploads/2021/05/ 501 KB
502 KB 7ms
7ms Image
image/webp 2a04:fa87:fffd::c000:42c8
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://news.sophos.com/wp-content/uploads/2021/05/sophos-ransomware-web-banner-1200x628px-option-2.png

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

18bd44f43e5a961377c06f7a927599a381d89626c983c599ce0abfabe98da60a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
x-rq: hhn2 109 139 443
last-modified: Tue, 23 Nov 2021 23:02:14 GMT
server: nginx
etag: "565a7bd2ac5e4491"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 513236
expires: Wed, 23 Nov 2022 23:02:14 GMT

GET
H2 200 / Show response
w.soundcloud.com/player/ Frame FA85 1 KB
1 KB 158ms
95ms Document
text/html 143.204.98.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/1054614607&color=%23ff5500&auto_play=false&hide_related=true&show_comments=false&show_user=true&show_reposts=false&show_teaser=false

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.92 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-92.fra50.r.cloudfront.net

Software

am/2 /

Resource Hash

c637abe9692e0eb7164262fa63ad1ad3d5284cf0ef2a7d333a3cecdeb386b00a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/

Response headers

content-type: text/html
via: sssr, 1.1 5ad96647558bd4911f05189f8afefd98.cloudfront.net (CloudFront)
p3p: policyref="https://w.soundcloud.com/player/w3c/p3p.xml", CP="NON DSP COR CUR ADM DEV TAI PSAo PSDo OUR STP CNT"
cache-control: public, max-age=300
date: Thu, 16 Dec 2021 18:22:12 GMT
strict-transport-security: max-age=63072000
server: am/2
content-encoding: gzip
vary: Accept-Encoding
x-cache: Miss from cloudfront
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: FjeHHxsc9zhxyX_rhD02q7r78zOAom-64xIA1ob4nm9_jX-cDGnk6Q==

GET
H2 200 dc.js Show response
stats.g.doubleclick.net/ 45 KB
17 KB 48ms
15ms Script
text/javascript 2a00:1450:400c:c02::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/_static/??-eJyVjFEOwiAQBS8kLGDU9sN4FkI2LSgLYVfr8cX0AiV5X5OZB1tVoZAgCciKGRm41LUw4cbKGXuDxH1dKs+I6uO007YDvQOd+ASHPkJpAzZ+pXk+7u9IvyW+xqvgc/VxoeGw+iaEbbhb/HDyZz165Lu9nqfZmOkypx+gu6BJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c02::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 3694
date: Thu, 16 Dec 2021 17:20:38 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17093
expires: Thu, 16 Dec 2021 19:20:38 GMT

GET
H/1.1 200
OK elqCfg.min.js Show response
img03.en25.com/i/ 6 KB
3 KB 65ms
12ms Script
application/x-javascript 104.111.229.66
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://img03.en25.com/i/elqCfg.min.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.229.66 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-229-66.deploy.static.akamaitechnologies.com

Software

Resource Hash

3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Encoding: gzip
X-Content-Type-Options: nosniff
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Connection: keep-alive
Content-Length: 2183
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Last-Modified: Thu, 14 Oct 2021 00:58:49 GMT
Date: Thu, 16 Dec 2021 18:22:12 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: no-store
ETag: "28352a696c0d71:0"
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow
Expires: Thu, 16 Dec 2021 18:22:12 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
93 B 13ms
12ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A10.4&blog=166161023&post=75410&tz=-5&srv=news.sophos.com&host=news.sophos.com&ref=&fcp=992&rand=0.16668149403825794
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 16 Dec 2021 18:22:12 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 97 KB
39 KB 16ms
15ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-743773256

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

eb5ac950ec1aab49f2099bd08f5ba6578b6a2600b378b6d5e60ce96c449387a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39580
x-xss-protection: 0
last-modified: Thu, 16 Dec 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 16 Dec 2021 18:22:12 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 36 KB
11 KB 56ms
30ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: gzip
last-modified: Fri, 03 Dec 2021 01:53:50 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 58E41844D7DD4B14A150E41AD7D34396 Ref B: FRAEDGE1319 Ref C: 2021-12-16T18:22:12Z
etag: "0cb09ee8e7d71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 10468

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 25ms
6ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 25965
x-xss-protection: 0
pragma: public
x-fb-debug: Y1amebJ8xsiO81SxQ37/L4PAeOZea3Xs8CikxZb225440uOURtVghBBGt2mQPwvtpth3T1Gg6biVYHzI8ivPNg==
x-fb-trip-id: 2050670934
x-frame-options: DENY
date: Thu, 16 Dec 2021 18:22:12 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 30ms
11ms Script
application/x-javascript 2a02:26f0:6c00::210:ba20
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:ba20 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 18:22:12 GMT
Content-Encoding: gzip
Last-Modified: Wed, 29 Sep 2021 19:17:49 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=35712
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2036

GET
H2 200 WuEFNglz.min.js Show response
scripts.demandbase.com/ 61 KB
16 KB 399ms
10ms Script
application/javascript 143.204.98.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.demandbase.com/WuEFNglz.min.js
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-115.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 821c1dba392245eac9a9d8709348b2e3dc9245eaeb40233a2f0d608060df20e0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-version-id: LCueR8U3D7lJgwCfemj1Slg2LluSXKrc
content-encoding: gzip
last-modified: Thu, 17 Jun 2021 19:46:43 GMT
server: AmazonS3
age: 896
etag: W/"b068f44152e87ccb66f40491a735aad0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
via: 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
date: Thu, 16 Dec 2021 18:07:25 GMT
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: mVyo9ETqHhpENh6_5hLCXV8jpWzJg4kMwg1_V-EnRiWSdz1jAnco9Q==

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 14 KB
6 KB 78ms
9ms Script
application/javascript 199.232.136.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: gzip
last-modified: Mon, 20 Sep 2021 23:58:10 GMT
etag: "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 5410
x-served-by: cache-iad-kjyo7100152-IAD, cache-hhn11521-HHN

GET
H2 200 qevents.js Show response
a.quora.com/ 39 KB
14 KB 50ms
13ms Script
text/plain 151.101.1.2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://a.quora.com/qevents.js
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.1.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-version-id: s3LlaOWABX1LUjiLldBNr49lVAylKDRo
content-encoding: gzip
etag: "f32ebb1e93a72c0a57add6d07f688510"
age: 6518
x-cache: HIT, HIT, HIT
content-length: 13681
x-amz-id-2: KQSH1lc4OVl+W6GEsa7evVB8ozSQmYlBhIKQAEyV9i3687iQbrGWfvV2Nol7bCIFJKrLhv1e1kE=
x-served-by: cache-bwi5175-BWI, cache-iad-kiad7000036-IAD, cache-fra19161-FRA
last-modified: Fri, 25 Oct 2019 19:28:38 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1572031715/ctime:1572031714/gid:1000000/gname:employee/md5:f32ebb1e93a72c0a57add6d07f688510/mode:33188/mtime:1149709104/uid:1000332/uname:tzhou
x-timer: S1639678932.308635,VS0,VE0
date: Thu, 16 Dec 2021 18:22:12 GMT
vary: Accept-Encoding
x-amz-request-id: YK7QHRJFSRM1NFDZ
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
cache-control: max-age=7200
accept-ranges: bytes
content-type: text/plain
x-cache-hits: 1, 830, 737

GET
H/1.1 200
OK events.js Show response
tags.srv.stackadapt.com/ 13 KB
5 KB 459ms
107ms Script
text/javascript 3.223.38.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.38.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-38-51.compute-1.amazonaws.com
Software: /
Resource Hash: 1da8f3e78aa2cfbb82e6159cc54534d99a63eaca860f3be965c00703683b920c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 16 Dec 2021 18:22:12 GMT
Content-Encoding: gzip
Cache-Control: max-age=30
Content-Length: 4411
Connection: keep-alive
Content-Type: text/javascript

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 43ms
16ms Script
application/x-javascript 143.204.94.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.94.161 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-94-161.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 03:54:32 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Sep 2020 15:15:34 GMT
Server: AmazonS3
Age: 52061
ETag: W/"98d98b3499058b76d58073cf8ede2f10"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 f7b7cf90592cf6a380fd34cc45e9c4b5.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA50-C1
X-Amz-Cf-Id: EFpz2S97Be196R7hFql3LBHJXu_Jz4vcLf2OGj2LHoCBXXoD2H_1og==

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 15 KB
6 KB 30ms
11ms Script
application/javascript 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

759d6f0c1292d86d24d7abe7ad9a2cd1d86df0041260f98186ccfa26c7daab62

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Thu, 16 Dec 2021 18:05:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1019
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 5652
x-amz-id-2: m+CDQ0K5fQksMxwHCkmV4GiebgSqiNKt/ByB5L9vkmvzQ7ZyiDcA8f7NzcSNTE5IByBzJDkcSdw=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Sat, 10 Dec 2022 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Thu, 04 Nov 2021 15:26:13 GMT
server: ATS
etag: "146f99405588b7446958a732612c901d-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: T640KRG7CK54MASB
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: pCmRUUjnQE9zqMEfVdrNnyYpaPAyW8Do
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 fs.js Show response
edge.fullstory.com/s/ 219 KB
66 KB 68ms
25ms Script
application/javascript 35.201.112.186
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://edge.fullstory.com/s/fs.js
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.112.186 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 186.112.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 50a5284de7a0b6a18645b623fe7cd7b193ed75387dc21eeb7b8527775fecae24

Request headers

Referer: https://news.sophos.com/
Origin: https://news.sophos.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 17:36:04 GMT
content-encoding: gzip
age: 2768
x-guploader-uploadid: ADPycdtJKL1Tn2l9psXRTec7yobvN-E6m9rydIqzPA8XaTgph6NKfFFxmTYkGQ6hiZGFj0c-tfvvDn3Xgb-CmG8TEbQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 67347
last-modified: Wed, 15 Dec 2021 19:15:03 GMT
server: UploadServer
etag: "ae62e8f5c7c7587ea691afdd7b461301"
x-goog-hash: crc32c=LKlKNg==, md5=rmLo9cfHWH6mka/de0YTAQ==
x-goog-generation: 1639595703727219
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=3600,no-transform
x-goog-stored-content-length: 67347
accept-ranges: bytes
content-type: application/javascript
expires: Thu, 16 Dec 2021 18:36:04 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1221295723&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=...
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=331150178.1639678932&jid=1604679883&_v=5.7.2dc&z=1221295723
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=331150178.1639678932&jid=1604679883&_v=5.7.2dc&z=1221295723&slf_rd=1&random=327351642

42 B
501 B

72ms
44ms

Image
image/gif

2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=331150178.1639678932&jid=1604679883&_v=5.7.2dc&z=1221295723&slf_rd=1&random=327351642

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 18:22:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 16 Dec 2021 18:22:12 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=331150178.1639678932&jid=1604679883&_v=5.7.2dc&z=1221295723&slf_rd=1&random=327351642
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 __utm.gif
stats.g.doubleclick.net/r/ 35 B
55 B 34ms
17ms Image
image/gif 2a00:1450:400c:c02::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1555776082&utmhn=news.sophos.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=What%20to%20expect%20when%20you%E2%80%99ve%20been%20hit%20with%20Avaddon%20ransomware%20%E2%80%93%20Sophos%20News&utmhid=583899951&utmr=-&utmp=%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&utmht=1639678931726&utmac=UA-737537-53&utmcc=__utma%3D204943247.176844454.1639678932.1639678932.1639678932.1%3B%2B__utmz%3D204943247.1639678932.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1998641529&utmredir=3&utmmt=1&utmu=q1CgAAAAAAAAAAAAAAAAAAgE~

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c02::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 16 Dec 2021 18:22:12 GMT
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 37 KB
14 KB 98ms
43ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-743773256

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

9f4922667f15ec47709504b75c4433e7145f96078261bc9a11e386ca52fa18bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14328
x-xss-protection: 0
server: cafe
etag: 12503521247758841375
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 16 Dec 2021 18:22:12 GMT

GET
H3 200 334990480506518 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 18ms
8ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/334990480506518?v=2.9.48&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2217a8a9d47e4aadd89aeb8dfe59c0bc433b2cb5fcf315d5365e224e7387f3e2

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 88883
x-xss-protection: 0
pragma: public
x-fb-debug: qy2/nRm8GxEhbqNleu4NeM3G6OWEV5M4Ls54aJhk/9LyryaZXjkTxjdUwJb4zHu5StSXwb7dY40rbIyq1UWbyg==
x-frame-options: DENY
date: Thu, 16 Dec 2021 18:22:12 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1639678931772&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1639678931772%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1639678931772&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1639678931772&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware...

0
155 B

331ms
133ms

Image
application/javascript

108.174.10.14
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1639678931772&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&liSync=true&e_ipv6=AQJIOtc5eolGBgAAAX3EevcbKc9jxmCZ83THcp64ufpGj24oolw65lxhNK4FFRphG9z3eLZ1v3Y
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: H2
Server: 108.174.10.14 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-10-14.fwd.linkedin.com
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:13 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
x-li-proto: http/2
x-li-pop: prod-lva1
content-type: application/javascript
content-length: 0
x-li-uuid: wowYX01PwRYAggxSeisAAA==

Redirect headers

date: Thu, 16 Dec 2021 18:22:12 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 36E4CC798568432DAA7838946A171BBC Ref B: FRAEDGE0808 Ref C: 2021-12-16T18:22:12Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1639678931772&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&liSync=true&e_ipv6=AQJIOtc5eolGBgAAAX3EevcbKc9jxmCZ83THcp64ufpGj24oolw65lxhNK4FFRphG9z3eLZ1v3Y
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXTR4BVFQifbyn4d5UhMw==

GET
H2 200 10150886.json Show response
s.yimg.com/wi/config/ 46 B
682 B 26ms
9ms XHR
application/octet-stream 2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10150886.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

b2a1b0d77cb3505f23f6ca96316687b95376336a00822166c18c2808ced160eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:18:13 GMT
x-content-type-options: nosniff
age: 240
x-amz-server-side-encryption: AES256
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: 6V38XA2XP290D48D
x-amz-id-2: NBk5b8YPg55sfoUxBit4q9ZmINjcEQLHVQVG/VK5cXNNFQM3lLCL3Hje8HPAyzEYFeEoM4+RN88=
accept-ranges: bytes
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Fri, 20 Jan 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Wed, 15 Dec 2021 05:54:05 GMT
server: ATS
etag: "3769bd8c10be070cf8c85c08517a8fdc"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
x-amz-version-id: VO4i6Xctkzo3gjHc0HLprUqd6v7sNIpd
access-control-allow-origin: *
x-xss-protection: 1; mode=block
content-length: 46
content-type: application/octet-stream

GET
H2 200 widget-5-5c62e1ffd152.js Show response
widget.sndcdn.com/ Frame FA85 7 KB
3 KB 62ms
10ms Script
application/javascript 108.157.4.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.sndcdn.com/widget-5-5c62e1ffd152.js
Requested by: Host: w.soundcloud.com
URL: https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/1054614607&color=%23ff5500&auto_play=false&hide_related=true&show_comments=false&show_user=true&show_reposts=false&show_teaser=false
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: fa715b659ac04819187bf153e25b5f6230dafc5870bd4ad5a91a93b5c7c264f3

Request headers

Referer: https://w.soundcloud.com/
Origin: https://w.soundcloud.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 13 Jul 2021 13:49:08 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 13494785
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Tue, 13 Jul 2021 13:40:06 GMT
server: AmazonS3
etag: W/"25f9c74db32b990cf8f84283875344e1"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: _MPwL62FKXf7qsD_DBmr_6sctDV5OQf5
via: 1.1 3ac8e795602d9d156b63546d3d0aaad0.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000, immutable
x-amz-cf-pop: DUS51-P2
content-type: application/javascript; charset=utf-8
x-amz-cf-id: n22HgxQutGe5zVI9K71W2lXaNYHrR6v4zqGxuLYVe2w0dfalAvGoAA==

GET
H2 200 widget-8-a8f1d1e4e2a6.js Show response
widget.sndcdn.com/ Frame FA85 2 KB
2 KB 62ms
11ms Script
application/javascript 108.157.4.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.sndcdn.com/widget-8-a8f1d1e4e2a6.js
Requested by: Host: w.soundcloud.com
URL: https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/1054614607&color=%23ff5500&auto_play=false&hide_related=true&show_comments=false&show_user=true&show_reposts=false&show_teaser=false
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d81f0dabc4c67f119a82302eb1e673af07a2f7a5815420e77b437cbfd817caad

Request headers

Referer: https://w.soundcloud.com/
Origin: https://w.soundcloud.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 10:09:05 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 202388
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Tue, 14 Dec 2021 10:04:32 GMT
server: AmazonS3
etag: W/"dfab2010ccd4524ee8dc3dcd02fbc944"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: jva6WHNlGoih3B4Gxm2SfowHoGCTzTJF
via: 1.1 3ac8e795602d9d156b63546d3d0aaad0.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000, immutable
x-amz-cf-pop: DUS51-P2
content-type: application/javascript; charset=utf-8
x-amz-cf-id: lJyAAjNQYJNHSAeRyNGo62UqSqGEUH6lKLn0glGnQojRdwNl4kD7PA==

GET
H2 200 widget-9-96dadee9c811.js Show response
widget.sndcdn.com/ Frame FA85 1 MB
310 KB 62ms
12ms Script
application/javascript 108.157.4.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.sndcdn.com/widget-9-96dadee9c811.js
Requested by: Host: w.soundcloud.com
URL: https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/1054614607&color=%23ff5500&auto_play=false&hide_related=true&show_comments=false&show_user=true&show_reposts=false&show_teaser=false
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 74f3c567fb4769ce0cec9be5e0ae5f9ac2b0265c881c3b04e7dfc4066dae6437

Request headers

Referer: https://w.soundcloud.com/
Origin: https://w.soundcloud.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 10:09:05 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 202388
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Tue, 14 Dec 2021 10:04:32 GMT
server: AmazonS3
etag: W/"15a5c4239be08b70058aa9d686b0a868"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: yI.EiRl8olvkzAZuHOqI7cThDK.0IZY3
via: 1.1 3ac8e795602d9d156b63546d3d0aaad0.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000, immutable
x-amz-cf-pop: DUS51-P2
content-type: application/javascript; charset=utf-8
x-amz-cf-id: W23vT76mJsZci38WQwCrxVS4mrS_JOqb4xizndaOy52bC_pglgIx0A==

GET
H2 200 4015302.js Show response
bat.bing.com/p/action/ 684 B
738 B 312ms
311ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/4015302.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 01a6b7c54e5dab177d5bbb2ca8fe1c37c64d34d9719d48008efcfdcc33f8bb8c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D67EAC7ED9BB428495FFE72F662721A8 Ref B: FRAEDGE1319 Ref C: 2021-12-16T18:22:12Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store,no-cache
content-length: 587

GET
H2 204 0
bat.bing.com/action/ 0
149 B 40ms
39ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=4015302&Ver=2&mid=1a4cbff9-4273-4e31-9692-930923bcbcb1&sid=16408f105e9d11ec8d3cbf5290086215&vid=1640a6705e9d11ec8d9cbbafd16069fd&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=What%20to%20expect%20when%20you%E2%80%99ve%20been%20hit%20with%20Avaddon%20ransomware%20%E2%80%93%20Sophos%20News&p=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&r=&lt=1061&evt=pageLoad&msclkid=N&sv=1&rn=570133
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 18:22:12 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1D932FD5014F4C33BBD3A98222E6328C Ref B: FRAEDGE1319 Ref C: 2021-12-16T18:22:12Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK pixel
q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/ 43 B
421 B 424ms
107ms Image
image/gif 3.224.194.150
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/pixel?j=1&u=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&tag=ViewContent&ts=1639678931791

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.224.194.150 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-224-194-150.compute-1.amazonaws.com

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 18:22:12 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Q-Stat: ,0bbc194f4a5eb6189a27cd4ee62c8004,10.0.0.64,5510,136.243.198.81,,135596835860,1,1639678932.757,0.002,,.,0,0,0.004,0.004,-,0,0,197,189,94,10,26847,,,,,,-,
Content-Type: image/gif

POST
H2 200 page Show response
rs.fullstory.com/rec/ 3 KB
1 KB 463ms
380ms XHR
application/json 35.186.194.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.fullstory.com/rec/page
Requested by: Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.194.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 9b89ae60624eaba3e96596fffde9cfc63875366c879764c50cb28dcf4c4e6af8

Request headers

Referer: https://news.sophos.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: gzip
content-type: application/json; charset=utf-8
access-control-allow-origin: https://news.sophos.com
access-control-allow-credentials: true
alt-svc: clear
content-length: 1187
via: 1.1 google

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
714 B 133ms
37ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Thu%2C%2016%20Dec%202021%2018%3A22%3A11%20GMT&n=0&b=What%20to%20expect%20when%20you%E2%80%99ve%20been%20hit%20with%20Avaddon%20ransomware%20%E2%80%93%20Sophos%20News&.yp=10150886&f=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&enc=UTF-8&yv=1.10.2&tagmgr=gtm

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 18:22:12 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Thu, 16 Dec 2021 18:22:12 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
675 B 153ms
130ms Script
application/javascript 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=6c2be345-c605-4f16-9ad3-88ba940f2f99&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&tpx_cb=twttr.conversion.loadPixels

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 121
pragma: no-cache
last-modified: Thu, 16 Dec 2021 18:22:12 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 58210721b89a5103adf17731bb006e778be394619bb501a4517cff8f5e3a90cd
x-transaction: 2db6d199b00e3024
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
470 B 138ms
115ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=6c2be345-c605-4f16-9ad3-88ba940f2f99&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 107
pragma: no-cache
last-modified: Thu, 16 Dec 2021 18:22:12 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: b1b653077f85c3242c08ce8ecbf3c26d37633cfe7198b1b179b6f255a522e18b
x-transaction: 4695feb498e844bb
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
295 B 34ms
11ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=334990480506518&ev=PageView&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&rl=&if=false&ts=1639678931861&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1639678931860.433362403&it=1639678931770&coo=false&rqm=GET

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Thu, 16 Dec 2021 18:22:12 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/ 3 KB
2 KB 44ms
21ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/?random=1639678931870&cv=9&fst=1639678931870&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oac10&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&tiba=What%20to%20expect%20when%20you%E2%80%99ve%20been%20hit%20with%20Avaddon%20ransomware%20%E2%80%93%20Sophos%20News&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f08c5fd85cde03e4a6ef6bbf69d68b2ea7c4e40a972546249eca95d113c7cef3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1123
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 logo-200x120-3190df52.png
widget.sndcdn.com/assets/images/ Frame FA85 4 KB
4 KB 105ms
23ms Image
image/png 108.157.4.54
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widget.sndcdn.com/assets/images/logo-200x120-3190df52.png
Requested by: Host: w.soundcloud.com
URL: https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/1054614607&color=%23ff5500&auto_play=false&hide_related=true&show_comments=false&show_user=true&show_reposts=false&show_teaser=false
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a9e23dcec7b7d492b11006586bea4e4fe7de01f647f89c6aa84e186567b9da50

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://w.soundcloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 23 Jun 2021 23:32:02 GMT
via: 1.1 b6b3463eedbd4b446fd969736178bf99.cloudfront.net (CloudFront)
age: 15187811
x-cache: Hit from cloudfront
content-length: 3745
last-modified: Wed, 23 Jun 2021 09:05:31 GMT
server: AmazonS3
etag: "a1591e5274b36cfbae3e167dffe49970"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: aFv7dm.QM9IMcVqK5hx4DbvjfyjOX3wq
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
x-amz-cf-pop: DUS51-P2
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: XnYzoarAOCzj-C_XNLBOXveK5P3G7wPCevkvug-06NCeUcxUTXnMpw==

GET
H/1.1 200
OK 959245-796460-2716-619152 Show response
api-widget.soundcloud.com/assignments/ Frame FA85 615 B
1 KB 107ms
58ms XHR
application/json 108.156.252.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-widget.soundcloud.com/assignments/959245-796460-2716-619152?layers=widget_listening&format=json&client_id=LBCcHmRB8XSStWL6wKH2HPACspQlXg2P&app_version=1639476250

Requested by

Host: widget.sndcdn.com
URL: https://widget.sndcdn.com/widget-9-96dadee9c811.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.156.252.52 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

am/2 /

Resource Hash

7057df7121a58ef12735e552238010f9e10fa0ac94e45583cf45ae6807c71688

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://w.soundcloud.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 18:22:12 GMT
Content-Encoding: gzip
x-content-type-options: nosniff
X-Amz-Cf-Pop: DUS51-P2
X-Cache: Miss from cloudfront
access-control-allow-methods: DELETE, GET, PATCH, POST, PUT
Connection: keep-alive
Vary: Origin
Content-Length: 139
access-control-allow-origin: https://w.soundcloud.com
referrer-policy: no-referrer
Server: am/2
x-frame-options: DENY
access-control-max-age: 1728000
strict-transport-security: max-age=63072000
Content-Type: application/json; charset=utf-8
Via: 1.1 9f88eecf68d9192420b110f5f3f14fd7.cloudfront.net (CloudFront)
access-control-expose-headers: Date
Cache-Control: private, max-age=0
access-control-allow-credentials: true
x-robots-tag: noindex
access-control-allow-headers: Authorization, Content-Type, Device-Locale, X-CSRF-Token
X-Amz-Cf-Id: LDZBo4vRu9qX3P1Xq2_ouFi6j1KLYNZbsy6Sa_iKpsgX_YwkletmHg==

GET
H3 200 /
www.google.com/pagead/1p-user-list/743773256/ 42 B
64 B 40ms
22ms Image
image/gif 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/743773256/?random=1639678931870&cv=9&fst=1639677600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oac10&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&tiba=What%20to%20expect%20when%20you%E2%80%99ve%20been%20hit%20with%20Avaddon%20ransomware%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=1789455913&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 18:22:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/743773256/ 42 B
64 B 41ms
24ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/743773256/?random=1639678931870&cv=9&fst=1639677600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oac10&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&tiba=What%20to%20expect%20when%20you%E2%80%99ve%20been%20hit%20with%20Avaddon%20ransomware%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=1789455913&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 18:22:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 424 B
921 B 70ms
50ms XHR
application/json 143.204.98.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&page_title=What%20to%20expect%20when%20you%E2%80%99ve%20been%20hit%20with%20Avaddon%20ransomware%20%E2%80%93%20Sophos%20News&src=tag&key=f2514e2223f271de300b1908c2c90c911bed78d7
Requested by: Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/WuEFNglz.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-86.fra50.r.cloudfront.net
Software: nginx /
Resource Hash: dc1679c66a4039b916f394b61ee2c55ecc2bc181d5c2c3d46951719015f5214e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
request-id: cc802542-5269-409a-afb4-6ade10a332ad
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://news.sophos.com
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 1b73451818d2dd47a574604c0b84f692.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 5eyg2NY-mOpqEoQI8acqo1O6zNde43-_3nuiRQhrzRNSPP6bV0ORCw==
expires: Wed, 15 Dec 2021 18:22:12 GMT

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
https://segments.company-target.com/log?vendor=choca&user_id=AAh4XE7DdwgAAD6bF72vrQ
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAh4XE7DdwgAAD6bF72vrQ&verifyHash=adc35e16636463db1781f56f977604d1b22fe677

26 B
409 B

209ms
208ms

Image
image/gif

143.204.98.23
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAh4XE7DdwgAAD6bF72vrQ&verifyHash=adc35e16636463db1781f56f977604d1b22fe677
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: HTTP/1.1
Server: 143.204.98.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-23.fra50.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 18:22:13 GMT
Via: 1.1 ad46d498157a92ab1076f74db460670d.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA50-C1
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: 54744bb248c7046b
X-Amz-Cf-Id: w5QtSfW-yB7cXV66oOBwngzIdpRPvZkCO_Qjfz6dSwFccHebmZScNQ==

Redirect headers

Date: Thu, 16 Dec 2021 18:22:12 GMT
Via: 1.1 ad46d498157a92ab1076f74db460670d.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA50-C1
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=choca&user_id=AAh4XE7DdwgAAD6bF72vrQ&verifyHash=adc35e16636463db1781f56f977604d1b22fe677
Connection: keep-alive
trace-id: 635679945fd697ac
Content-Length: 0
X-Amz-Cf-Id: zYzljreOoYzKBEERGo_OVOcXNoEh3nlrCY69L7Oao2fnALaHxqbYCg==

GET
H2 451 464526.gif
id.rlcdn.com/ 0
66 B 132ms
49ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
via: 1.1 google
alt-svc: clear
content-length: 0

GET
H2 200 clarity.js Show response
e.clarity.ms/s/0.6.30/ 52 KB
22 KB 346ms
98ms Script
application/javascript 20.62.48.180
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://e.clarity.ms/s/0.6.30/clarity.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/4015302.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.62.48.180 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: c763a7b86f4b8e21741d95bf307b2932555a20d4ad383adc764c99fdbb8e88d8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
content-encoding: br
etag: "1d7ed4598a2cbb1"
last-modified: Thu, 09 Dec 2021 21:42:00 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
accept-ranges: bytes
request-context: appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?CtsSyncId=DDB3E7D0F0394CFD92724467AAF27856&RedC=c.clarity.ms&MXFR=3DC4B1F2EBE263323C9BA0FDEFE26DAA
https://c.clarity.ms/c.gif?CtsSyncId=DDB3E7D0F0394CFD92724467AAF27856&MUID=1C8076501D0E68273739675F1CDC69D3

42 B
368 B

26ms
26ms

Image
image/gif

52.142.114.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?CtsSyncId=DDB3E7D0F0394CFD92724467AAF27856&MUID=1C8076501D0E68273739675F1CDC69D3
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: H2
Server: 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 16 Dec 2021 18:22:12 GMT
last-modified: Fri, 05 Nov 2021 17:19:23 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "f95a3e4769d2d71:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 16 Dec 2021 18:22:12 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 54ABC33C050249D8842EBD4C6C9906C2 Ref B: FRAEDGE1319 Ref C: 2021-12-16T18:22:12Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?CtsSyncId=DDB3E7D0F0394CFD92724467AAF27856&MUID=1C8076501D0E68273739675F1CDC69D3
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H/1.1 200
OK sa.css
tags.srv.stackadapt.com/ 65 B
292 B 106ms
106ms Stylesheet
text/css 3.223.38.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.38.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-38-51.compute-1.amazonaws.com
Software: /
Resource Hash: 4bc6aa7fc277d8a6f7ed10fc0fd090a03fffde642716530b7b04dda65265cd5f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 16 Dec 2021 18:22:12 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 65
Content-Type: text/css

GET
H/1.1 200
OK sa.jpeg Show response
tags.srv.stackadapt.com/ 0
881 B 425ms
107ms Fetch
image/jpeg 3.223.38.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.38.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-38-51.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 16 Dec 2021 18:22:13 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 651
Content-Type: image/jpeg

GET
H2 200 widget-0-3bc7049d0e7c.js Show response
widget.sndcdn.com/ Frame FA85 204 KB
57 KB 13ms
13ms Script
application/javascript 108.157.4.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.sndcdn.com/widget-0-3bc7049d0e7c.js
Requested by: Host: widget.sndcdn.com
URL: https://widget.sndcdn.com/widget-8-a8f1d1e4e2a6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6e1ebc63ddf1e052c283d3db6f344a32a6eb2f0cda7217e5b3ad11437712d542

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://w.soundcloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 14 Dec 2021 10:09:06 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 202387
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Tue, 14 Dec 2021 10:04:31 GMT
server: AmazonS3
etag: W/"0afa772947c406ff9d54831038fcddd0"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: ybtcdoF6yj83sDGbPQEFXBoIJnTvTrsK
via: 1.1 b6b3463eedbd4b446fd969736178bf99.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000, immutable
x-amz-cf-pop: DUS51-P2
content-type: application/javascript; charset=utf-8
x-amz-cf-id: VTvuj-h8404g4w8teWLJG38HFsxiglAfp17WS7_pyKqFL4ir3kKWsA==

GET
H2 200 widget-1-87ac3eb8ed35.js Show response
widget.sndcdn.com/ Frame FA85 20 KB
5 KB 23ms
23ms Script
application/javascript 108.157.4.54
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.sndcdn.com/widget-1-87ac3eb8ed35.js
Requested by: Host: widget.sndcdn.com
URL: https://widget.sndcdn.com/widget-8-a8f1d1e4e2a6.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 15601d86f26ea56f24c1e4e6481391a883ed3de0c7591b2ef12c6fc5613f728c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://w.soundcloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 02 Dec 2021 08:44:26 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 1244267
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Thu, 02 Dec 2021 08:39:32 GMT
server: AmazonS3
etag: W/"cdab4812a741973b313e24b7e900bd36"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: 7FrENhZvMUUY8AbmT7V9EJ1pf6gWWJgu
via: 1.1 b6b3463eedbd4b446fd969736178bf99.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000, immutable
x-amz-cf-pop: DUS51-P2
content-type: application/javascript; charset=utf-8
x-amz-cf-id: IZtAXui-Xy1Nvp9yuySEkCcgWAyE7y38niITjGgL4Trnzijl8UhRWQ==

GET
H/1.1 200
OK resolve Show response
api-widget.soundcloud.com/ Frame FA85 4 KB
3 KB 128ms
128ms XHR
application/json 108.156.252.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api-widget.soundcloud.com/resolve?url=https%3A//api.soundcloud.com/tracks/1054614607&format=json&client_id=LBCcHmRB8XSStWL6wKH2HPACspQlXg2P&app_version=1639476250

Requested by

Host: widget.sndcdn.com
URL: https://widget.sndcdn.com/widget-9-96dadee9c811.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

108.156.252.52 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

am/2 /

Resource Hash

3c80a09fa12ff3fbec1d0bf8ab7e44f87980a216fba2abd7a4fdcfe2d970dd54

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://w.soundcloud.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 18:22:12 GMT
Content-Encoding: gzip
x-content-type-options: nosniff
X-Amz-Cf-Pop: DUS51-P2
X-Cache: Miss from cloudfront
access-control-allow-methods: DELETE, GET, PATCH, POST, PUT
Connection: keep-alive
Vary: Origin
Content-Length: 1791
access-control-allow-origin: https://w.soundcloud.com
referrer-policy: no-referrer
Server: am/2
x-frame-options: DENY
access-control-max-age: 1728000
strict-transport-security: max-age=63072000
Content-Type: application/json; charset=utf-8
Via: 1.1 9f88eecf68d9192420b110f5f3f14fd7.cloudfront.net (CloudFront)
access-control-expose-headers: Date
Cache-Control: private, max-age=0
access-control-allow-credentials: true
x-robots-tag: noindex
access-control-allow-headers: Authorization, Content-Type, Device-Locale, X-CSRF-Token
X-Amz-Cf-Id: 4ijIy8qzBXp-29CJWus90_a51VX-QgpBelrRmolPQvhW-YpjHjiP0w==

GET
H2 200 integrations Show response
rs.fullstory.com/rec/ 0
64 B 129ms
129ms Script
text/javascript 35.186.194.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.fullstory.com/rec/integrations?OrgId=175DB8
Requested by: Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.194.186.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
via: 1.1 google
alt-svc: clear
content-length: 0
content-type: text/javascript; charset=utf-8

GET
H2 200 YjF0VpVU4q5D_m.json Show response
wave.sndcdn.com/ Frame FA85 7 KB
2 KB 44ms
14ms XHR
application/json 108.157.4.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://wave.sndcdn.com/YjF0VpVU4q5D_m.json
Requested by: Host: widget.sndcdn.com
URL: https://widget.sndcdn.com/widget-9-96dadee9c811.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 2da76760ff39ba96d5f84df8f255c58601461b8c9ff77a1ab83322164e2dc526

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://w.soundcloud.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 27 Nov 2021 06:17:49 GMT
content-encoding: gzip
age: 1685063
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=155520000
x-cache: Hit from cloudfront
x-amz-cf-pop: DUS51-P2
access-control-allow-headers: Accept, Accept-Encoding, Authorization, Content-Type, Origin
content-length: 1925
via: 1.1 e4aaaf9d55a242f83ddc793442b0ebe2.cloudfront.net (CloudFront)
x-amz-cf-id: FpRzxUqCFBGnxTbL3H0AfrcUEj3HdptHdmvk_FXkJJoPYKlFipLACg==

GET
H2 200 artworks-IE7JUPsKF8EemywL-qhJ0eg-t200x200.jpg
i1.sndcdn.com/ Frame FA85 10 KB
10 KB 60ms
13ms Image
image/jpeg 18.66.248.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i1.sndcdn.com/artworks-IE7JUPsKF8EemywL-qhJ0eg-t200x200.jpg
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-113.dus51.r.cloudfront.net
Software: /
Resource Hash: 51d216a0206cc18021c9869e34c9bd184cf01e3fc0106ed5b11862f5794d826f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://w.soundcloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 09:08:16 GMT
via: 1.1 8d4901eb4989773bb579fc1597e54ea8.cloudfront.net (CloudFront)
age: 292436
access-control-allow-methods: GET
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public,max-age=3628800
x-amz-cf-pop: DUS51-P1
access-control-allow-headers: Accept, Accept-Encoding, Authorization, Content-Type, Origin
x-amz-cf-id: tE1PrChRUxyH2lW1kCcz2C-w8YOFkUjyvkiBUxIxf2aFmhwVyyeSLw==

GET
DATA 200
OK truncated
/ Frame FA85 812 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00c42bb42c0f51d0b6efd60211b72eb79cd467fc162b3ff643faffa2681295a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame FA85 725 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0110b17fc4f574b960bb8bf1729e64992d215f27ab8a58e169e86e2ca046aec0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 share-4d6d0315.svg
widget.sndcdn.com/assets/images/ Frame FA85 1 KB
1 KB 10ms
10ms Image
image/svg+xml 108.157.4.54
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widget.sndcdn.com/assets/images/share-4d6d0315.svg
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a9124b42036eed86e375c7acfa9bf6756fc829cd36f863d2163523edec375950

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://w.soundcloud.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sun, 31 Oct 2021 11:18:55 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 3999798
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Mon, 25 Oct 2021 16:11:28 GMT
server: AmazonS3
etag: W/"e2febe1dffc89eedc7a4173da09ae49b"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: JtJOhNka8.YxokDCuhMBw9VxHuOHh_Gm
via: 1.1 b6b3463eedbd4b446fd969736178bf99.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000, immutable
x-amz-cf-pop: DUS51-P2
content-type: image/svg+xml
x-amz-cf-id: i9cYDZF2jOdl4dvSfDPZ24V2Y0t2Wbn8HuYp99K1mRRXQrV9AEKDiQ==

GET
DATA 200
OK truncated
/ Frame FA85 43 KB
43 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: be3e74dbd9087c9f65fc9dd5ee31569b89224f667cab7edafd6ba15890201c2d

Request headers

Referer
Origin: https://w.soundcloud.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type: font/woff

POST
H2 200 bundle Show response
rs.fullstory.com/rec/ 29 B
91 B 180ms
179ms XHR
application/json 35.186.194.58
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://rs.fullstory.com/rec/bundle?OrgId=175DB8&UserId=4809302977699840&SessionId=4901201352744960&PageId=6588217966616576&Seq=1&PageStart=1639678932584&PrevBundleTime=0&LastActivity=550&IsNewSession=true
Requested by: Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.194.58 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 58.194.186.35.bc.googleusercontent.com
Software: /
Resource Hash: b7f50682c8a0a20f85741c79cd29bec0fe9de43a547bd7c3ebeb4badca151f81

Request headers

Referer: https://news.sophos.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://news.sophos.com
date: Thu, 16 Dec 2021 18:22:13 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: clear
content-length: 29
content-type: application/json; charset=utf-8

GET
H3 200 /
www.facebook.com/tr/ 44 B
91 B 19ms
8ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=334990480506518&ev=Microdata&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&rl=&if=false&ts=1639678932378&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22What%20to%20expect%20when%20you%E2%80%99ve%20been%20hit%20with%20Avaddon%20ransomware%20%E2%80%93%20Sophos%20News%22%7D&cd[OpenGraph]=%7B%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22What%20to%20expect%20when%20you%E2%80%99ve%20been%20hit%20with%20Avaddon%20ransomware%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F%22%2C%22og%3Adescription%22%3A%22Avaddon%20ransomware%20is%20a%20Ransomware-as-a-Service%20(RaaS)%20that%20combines%20encryption%20with%20data%20theft%20and%20extortion.%20Avaddon%20has%20been%20around%20since%202019%20but%20has%20become%20more%20prominent%20and%20aggressive%20since%20%E2%80%A6%22%2C%22article%3Apublished_time%22%3A%222021-05-24T11%3A52%3A50%2B00%3A00%22%2C%22article%3Amodified_time%22%3A%222021-05-25T15%3A32%3A42%2B00%3A00%22%2C%22og%3Asite_name%22%3A%22Sophos%20News%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fwp-content%2Fuploads%2F2021%2F05%2Fsophos-ransomware-web-banner-1200x628px-option-2.png%3Fw%3D640%22%2C%22og%3Aimage%3Asecure_url%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fwp-content%2Fuploads%2F2021%2F05%2Fsophos-ransomware-web-banner-1200x628px-option-2.png%3Fw%3D640%22%2C%22og%3Aimage%3Awidth%22%3A%22640%22%2C%22og%3Aimage%3Aheight%22%3A%22335%22%2C%22og%3Aimage%3Aalt%22%3A%22%22%2C%22og%3Alocale%22%3A%22en_US%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.48&r=stable&ec=1&o=30&fbp=fb.1.1639678931860.433362403&it=1639678931770&coo=false&es=automatic&tm=3&rqm=GET

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2021/05/24/what-to-expect-when-youve-been-hit-with-avaddon-ransomware/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 16 Dec 2021 18:22:12 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=3,i
expires: Thu, 16 Dec 2021 18:22:12 GMT

GET
H2 200 up Show response
insight.adsrvr.org/track/ Frame 0E85 0
182 B 110ms
38ms Document
text/html 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&upid=ql4fc2b&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/

Response headers

date: Thu, 16 Dec 2021 18:22:13 GMT
content-type: text/html
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1 200
OK saq_pxl Show response
tags.srv.stackadapt.com/ 94 B
397 B 110ms
110ms XHR
text/plain 3.223.38.51
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=uxMvfKEouJZfJzsjwRVn_Q&is_js=true&landing_url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F05%2F24%2Fwhat-to-expect-when-youve-been-hit-with-avaddon-ransomware%2F&t=What%20to%20expect%20when%20you%E2%80%99ve%20been%20hit%20with%20Avaddon%20ransomware%20%E2%80%93%20Sophos%20News&host=https://news.sophos.com&sa_conv_data_css_value=%20%220-f21e9624-232a-4654-4073-08d3778bfffe%22&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9983885cdf12449547bb24265cb0f2f3188f3c651
Requested by: Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.38.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-38-51.compute-1.amazonaws.com
Software: /
Resource Hash: 078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Thu, 16 Dec 2021 18:22:13 GMT
Access-Control-Allow-Methods: GET
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://news.sophos.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 94

POST
H2 204 collect Show response
e.clarity.ms/ 0
70 B 208ms
208ms XHR
text/plain 20.62.48.180
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://e.clarity.ms/collect
Requested by: Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.62.48.180 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://news.sophos.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

access-control-allow-origin: https://news.sophos.com
date: Thu, 16 Dec 2021 18:22:12 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608

POST
H2 204 collect Show response
e.clarity.ms/ 0
48 B 99ms
98ms XHR
text/plain 20.62.48.180
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://e.clarity.ms/collect
Requested by: Host: edge.fullstory.com
URL: https://edge.fullstory.com/s/fs.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.62.48.180 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://news.sophos.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

access-control-allow-origin: https://news.sophos.com
date: Thu, 16 Dec 2021 18:22:13 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:bdfb7149-d2ee-45f0-9a22-f0b1c5035608

POST me
l9bjkkhaycw6f8f4.soundcloud.com/ Frame FA85 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: l9bjkkhaycw6f8f4.soundcloud.com
URL: https://l9bjkkhaycw6f8f4.soundcloud.com/me

Verdicts & Comments Add Verdict or Comment

72 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

40 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.sophos.com/	1970-01-20 03:47:10	Name: CampaignID Value: 70130000001xKqzAAE
.sophos.com/	1970-01-20 01:37:34	Name: _gcl_au Value: 1.1.10977202.1639678932
.sophos.com/	1970-01-20 16:59:10	Name: __utma Value: 1.331150178.1639678932.1639678932.1639678932.1
.sophos.com/	1969-12-31 23:59:59	Name: __utmc Value: 1
.sophos.com/	1970-01-20 03:50:46	Name: __utmz Value: 1.1639678932.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.bing.com/	1970-01-20 08:49:34	Name: MUID Value: 1C8076501D0E68273739675F1CDC69D3
.sophos.com/	1970-01-19 23:27:59	Name: __utmt Value: 1
.sophos.com/	1970-01-19 23:28:00	Name: __utmb Value: 1.1.10.1639678932
.news.sophos.com/	1970-01-20 16:59:10	Name: __utma Value: 204943247.176844454.1639678932.1639678932.1639678932.1
.news.sophos.com/	1969-12-31 23:59:59	Name: __utmc Value: 204943247
.news.sophos.com/	1970-01-20 03:50:46	Name: __utmz Value: 204943247.1639678932.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.news.sophos.com/	1970-01-19 23:27:59	Name: __utmt_news Value: 1
.news.sophos.com/	1970-01-19 23:28:00	Name: __utmb Value: 204943247.1.10.1639678932
.sophos.com/	1970-01-19 23:29:25	Name: _uetsid Value: 16408f105e9d11ec8d3cbf5290086215
.sophos.com/	1970-01-20 08:49:34	Name: _uetvid Value: 1640a6705e9d11ec8d9cbbafd16069fd
.sophos.com/	1970-01-20 01:37:34	Name: _fbp Value: fb.1.1639678931860.433362403
.linkedin.com/	1970-01-20 00:11:10	Name: UserMatchHistory Value: AQLqC8IdiAElCgAAAX3EevXgpU_rxeO4IZSOxkej2TjjGn8TAaULmUkPmZGgwzOI1cK2qfdgTM1XIQ
.linkedin.com/	1970-01-20 00:11:10	Name: AnalyticsSyncHistory Value: AQIFfP3YAeZPJwAAAX3EevXgRB_xaw6ee9igRutGIDGg5S-xGwW1SE6m3lcHksY4DaIjA8Pbn7uww9l6Lcadnw
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 16:59:52	Name: bcookie Value: "v=2&a65ca8b8-2fa2-455c-8796-ce281a6c86d7"
.linkedin.com/	1970-01-19 23:29:25	Name: lidc Value: "b=VGST08:s=V:r=V:a=V:p=V:g=2196:u=1:x=1:i=1639678932:t=1639765332:v=2:sig=AQGyEuNbW5KPLAlHMQGzrd6aboysnJTi"
.doubleclick.net/	1970-01-19 23:27:59	Name: test_cookie Value: CheckForPermission
.yahoo.com/	1970-01-20 08:13:56	Name: A3 Value: d=AQABBNSDu2ECEFvR9zmyTu_0EFEdBzhBUrYFEgEBAQHVvGHFYQAAAAAA_eMAAA&S=AQAAAjiVhg8hpud2mtO4FtsXe8k
.twitter.com/	1970-01-20 16:59:10	Name: personalization_id Value: "v1_8X3BuLkXMDEvyuc+JJM7Fw=="
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 16:59:52	Name: bscookie Value: "v=1&202112161822121b7bacfb-72fa-4a19-8a26-7a1d5f8af9c4AQHICj0vEZ5237q9RCXlBM2dImKJ5fyf"
.linkedin.com/	1970-01-20 16:55:54	Name: li_gc Value: MTswOzE2Mzk2Nzg5MzI7MjswMjHM70n+OJLgjl7WNg8OjaLTKtimBRjnF8yZrlQKGLA3JQ==
tags.srv.stackadapt.com/	1970-01-20 08:13:34	Name: sa-user-id Value: s%3A0-f21e9624-232a-4654-4073-08d3778bfffe.6XYpsg1C1H%2BmNitLD374XtTKL6%2FlfnSphJnM5s6kLW4
.srv.stackadapt.com/	1970-01-20 08:13:34	Name: sa-user-id-v2 Value: s%3A0-f21e9624-232a-4654-4073-08d3778bfffe%24ip%24136.243.198.81.rWAtzDpZIAM%2FH8grnhei%2BiZ92H11Y6dsN5z2SvGiAeQ
.c.bing.com/	1970-01-20 08:49:34	Name: SRM_B Value: 1C8076501D0E68273739675F1CDC69D3
.bidr.io/	1970-01-20 08:56:28	Name: bito Value: AAh4XE7DdwgAAD6bF72vrQ
.bidr.io/	1970-01-20 08:56:28	Name: bitoIsSecure Value: ok
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 08:49:34	Name: MUID Value: 1C8076501D0E68273739675F1CDC69D3
.c.clarity.ms/	1970-01-19 23:27:59	Name: ANONCHK Value: 0
.sophos.com/	1970-01-20 08:13:34	Name: fs_uid Value: rs.fullstory.com#175DB8#4809302977699840:4901201352744960/1671214931
.company-target.com/	1970-01-20 16:59:10	Name: tuuid Value: 114b8175-67eb-41a8-a518-d0822d16c640
.company-target.com/	1970-01-20 16:59:10	Name: tuuid_lu Value: 1639678932
.sophos.com/	1970-01-20 08:13:34	Name: _clck Value: 1o7fmzi\|1\|exb\|0
.sophos.com/	1970-01-19 23:29:25	Name: _clsk Value: 1w60to\|1639678932895\|1\|1\|e.clarity.ms/collect

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://id.rlcdn.com/464526.gif Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.quora.com
analytics.twitter.com
api-widget.soundcloud.com
api.company-target.com
bat.bing.com
c.bing.com
c.clarity.ms
cdn.jsdelivr.net
connect.facebook.net
e.clarity.ms
edge.fullstory.com
googleads.g.doubleclick.net
i1.sndcdn.com
id.rlcdn.com
img03.en25.com
insight.adsrvr.org
js.adsrvr.org
l9bjkkhaycw6f8f4.soundcloud.com
match.prod.bidr.io
news.sophos.com
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
rs.fullstory.com
s.yimg.com
scripts.demandbase.com
segments.company-target.com
snap.licdn.com
sp.analytics.yahoo.com
static.ads-twitter.com
stats.g.doubleclick.net
stats.wp.com
t.co
tags.srv.stackadapt.com
w.soundcloud.com
wave.sndcdn.com
widget.sndcdn.com
www.facebook.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
l9bjkkhaycw6f8f4.soundcloud.com
104.111.229.66
104.244.42.131
104.244.42.197
108.156.252.52
108.157.4.122
108.157.4.54
108.174.10.14
142.250.74.194
143.204.94.161
143.204.98.115
143.204.98.23
143.204.98.86
143.204.98.92
151.101.1.2
18.66.248.113
192.0.76.3
199.232.136.157
20.62.48.180
212.82.100.181
2606:4700::6810:5714
2620:1ec:21::14
2620:1ec:c11::200
2a00:1288:80:800::7001
2a00:1450:4001:80f::2002
2a00:1450:4001:80f::2008
2a00:1450:4001:828::2003
2a00:1450:4001:82a::2004
2a00:1450:400c:c02::9a
2a02:26f0:6c00::210:ba20
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:fa87:fffd::c000:42c8
3.223.38.51
3.224.194.150
35.186.194.58
35.201.112.186
35.244.174.68
35.71.131.137
52.142.114.2
52.50.109.234
0110b17fc4f574b960bb8bf1729e64992d215f27ab8a58e169e86e2ca046aec0
01a6b7c54e5dab177d5bbb2ca8fe1c37c64d34d9719d48008efcfdcc33f8bb8c
070a9ce02c3219e9eae17eb12ed3944475f206d05e2c4c3ce14868c425d8df13
078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
15601d86f26ea56f24c1e4e6481391a883ed3de0c7591b2ef12c6fc5613f728c
18bd44f43e5a961377c06f7a927599a381d89626c983c599ce0abfabe98da60a
1da8f3e78aa2cfbb82e6159cc54534d99a63eaca860f3be965c00703683b920c
1fa648f58cc0b3ce7d4574578aeb59038d1b5ddc00de3f568655be62a1d5c0ec
21fb7062e2c875b095ff5ff0e224206641b288193b0956b7615f9bc47aef4f39
2217a8a9d47e4aadd89aeb8dfe59c0bc433b2cb5fcf315d5365e224e7387f3e2
29abd4bd1e812838b2a48187c85ba1649629d3fb12a5599dae092a47b9348a54
2da76760ff39ba96d5f84df8f255c58601461b8c9ff77a1ab83322164e2dc526
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3c80a09fa12ff3fbec1d0bf8ab7e44f87980a216fba2abd7a4fdcfe2d970dd54
4bc6aa7fc277d8a6f7ed10fc0fd090a03fffde642716530b7b04dda65265cd5f
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
50a5284de7a0b6a18645b623fe7cd7b193ed75387dc21eeb7b8527775fecae24
51d216a0206cc18021c9869e34c9bd184cf01e3fc0106ed5b11862f5794d826f
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
56c4c9c31e9c4febdaaed356a15c9566084977d2a7a86842b14e9af3a71f9baa
5a1db9930dac42b80b1641f6de98442d2fadee3a9ffbbb9caf2de4b1fd350894
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
6e1ebc63ddf1e052c283d3db6f344a32a6eb2f0cda7217e5b3ad11437712d542
7057df7121a58ef12735e552238010f9e10fa0ac94e45583cf45ae6807c71688
74f3c567fb4769ce0cec9be5e0ae5f9ac2b0265c881c3b04e7dfc4066dae6437
75839e3ea0cd949a33dc21dd8b0931f396829fea8e0e3148b576b1228f40e469
759d6f0c1292d86d24d7abe7ad9a2cd1d86df0041260f98186ccfa26c7daab62
821c1dba392245eac9a9d8709348b2e3dc9245eaeb40233a2f0d608060df20e0
8281d5e3a85e4ea0e28cba5c3c13a28296273440d3168bc8b08baefa635bcbdd
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9b89ae60624eaba3e96596fffde9cfc63875366c879764c50cb28dcf4c4e6af8
9f4922667f15ec47709504b75c4433e7145f96078261bc9a11e386ca52fa18bb
a36c1b591e0a043aef36da97ac4da5a313386c35ad3c92eb558e13d0291f8eff
a9124b42036eed86e375c7acfa9bf6756fc829cd36f863d2163523edec375950
a9e23dcec7b7d492b11006586bea4e4fe7de01f647f89c6aa84e186567b9da50
ab027866fcf800aba11e7788a4db4bf79ded8c4b6bcccad828dae74c297e8c0c
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b00c42bb42c0f51d0b6efd60211b72eb79cd467fc162b3ff643faffa2681295a
b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6
b2a1b0d77cb3505f23f6ca96316687b95376336a00822166c18c2808ced160eb
b7f50682c8a0a20f85741c79cd29bec0fe9de43a547bd7c3ebeb4badca151f81
be3e74dbd9087c9f65fc9dd5ee31569b89224f667cab7edafd6ba15890201c2d
c637abe9692e0eb7164262fa63ad1ad3d5284cf0ef2a7d333a3cecdeb386b00a
c763a7b86f4b8e21741d95bf307b2932555a20d4ad383adc764c99fdbb8e88d8
d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe
d81f0dabc4c67f119a82302eb1e673af07a2f7a5815420e77b437cbfd817caad
d93cea00230540bc488dbe3afab54b37f88bd1b65aeb9bb576edaa7b8d0b4035
dc1679c66a4039b916f394b61ee2c55ecc2bc181d5c2c3d46951719015f5214e
de9485aee0805fc555984a4286697dccb8a9762fa9240c6a47b4dd478d282e74
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb5ac950ec1aab49f2099bd08f5ba6578b6a2600b378b6d5e60ce96c449387a5
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f
f08c5fd85cde03e4a6ef6bbf69d68b2ea7c4e40a972546249eca95d113c7cef3
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631
f927844e8c953560f5a67112c5dfaab926df93df57f3d8cd062028f1ca80b530
fa715b659ac04819187bf153e25b5f6230dafc5870bd4ad5a91a93b5c7c264f3
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

news.sophos.com Open in urlscan Pro 2a04:fa87:fffd::c000:42c8 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

76 Requests

93 %HTTPS

33 %IPv6

30 Domains

44 Subdomains

39 IPs

5 Countries

1895 kBTransfer

4034 kBSize

40 Cookies

16 Outgoing links

Page URL History

Redirected requests

76 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

news.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42c8 Public Scan

Screenshot
Live screenshot

Full Image

76
Requests

93 %
HTTPS

33 %
IPv6

30
Domains

44
Subdomains

39
IPs

5
Countries

1895 kB
Transfer

4034 kB
Size

40
Cookies

76 HTTP transactions
3 data transactions