redcanary.com Open in urlscan Pro
104.198.136.223  Public Scan

15 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 34

• https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 302
• https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 307
• https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID HTTP 302
• https://attr.ml-api.io/?domain=redcanary.com&pId=7415731178986241574

Request Chain 45

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1683605351645&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1683605351645%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%252F%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1683605351645&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1683605351645&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&liSync=true&e_ipv6=AQIFl4zWS6Pq1QAAAYf-su9foVqgg3a7WzcVxLeDBPMx71Kpg98Qr2DsPi5O6C0vvWB764E

98 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/	384 KB 63 KB	745ms 296ms	Document text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash 84f13df69337af41751b661499960d8d97fd1212ca84b80ecd72b9bb081c7acf Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control max-age=600, must-revalidate content-encoding br content-security-policy upgrade-insecure-requests content-type text/html; charset=UTF-8 date Tue, 09 May 2023 04:09:10 GMT feature-policy microphone 'none'; geolocation 'none' link <https://redcanary.com/?p=17816>; rel=shortlink referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security "max-age=63072000; includeSubDomains; preload"; vary Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding x-cache HIT: 1 x-cache-group normal x-cacheable SHORT x-content-type-options nosniff x-frame-options deny x-permitted-cross-domain-policies master-only x-powered-by WP Engine x-xss-protection 1; mode=block
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.1/	88 KB 31 KB	131ms 40ms	Script text/javascript	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Mon, 08 May 2023 16:37:25 GMT content-encoding gzip x-content-type-options nosniff age 41505 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31100 x-xss-protection 0 last-modified Thu, 08 Sep 2022 18:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 07 May 2024 16:37:25 GMT
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/	208 KB 69 KB	465ms 216ms	Script application/x-javascript	104.17.74.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status REVALIDATED last-modified Thu, 23 Mar 2023 21:46:36 GMT server cloudflare etag "2fe006b-33e51-5f79835f6a700" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 7c4715e2cf4a921a-FRA expires Tue, 09 May 2023 08:09:11 GMT
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	67 KB 25 KB	172ms 42ms	Script application/x-javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67D4) / Resource Hash 77e3f6afab9d566dcab6aaddaa22d182b339fbe2032b4611b5a56128f6fece6c Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-encoding gzip last-modified Thu, 04 May 2023 18:29:25 GMT server ECS (frb/67D4) age 17446 etag "1fabd65ab67ed91:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript cache-control max-age=86400 accept-ranges bytes content-length 25471
GET H2	200	9416.js Show response script.crazyegg.com/pages/scripts/0096/	6 KB 2 KB	770ms 676ms	Script text/javascript	2606:4700::6813:9408 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0096/9416.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e9a37e332ab45b20bd4c158502a5158bf8c252b18590159a319c6eeeffe1919c Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-encoding gzip cf-cache-status EXPIRED last-modified Tue, 09 May 2023 04:09:11 GMT server cloudflare vary Accept-Encoding content-type text/javascript ce-version 11.5.73 access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin * cf-ray 7c4715e54a1fbb38-FRA content-length 2204
GET H2	200	js Show response www.googletagmanager.com/gtag/	257 KB 86 KB	152ms 58ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash cbb8e86b6dabc810f6b7a9c83046cd3426a8823d020a88dd67dea52256baedc0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 88025 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Tue, 09 May 2023 04:09:11 GMT
GET H2	200	qualified.js Show response js.qualified.com/	309 KB 90 KB	548ms 450ms	Script text/javascript	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 28dfbc10cb34891d8cd19b15659ac7242bc9f093ea7b239f21340bb21091668b Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-encoding gzip via 1.1 spaces-router (e46a9e002bdb) strict-transport-security max-age=63072000; includeSubDomains cf-cache-status MISS x-content-type-options nosniff x-permitted-cross-domain-policies none x-xss-protection 1; mode=block x-request-id 7d71334b-7fa6-3a77-0017-e3b5a7bacc4a pragma no-cache x-runtime 0.017279 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"28dfbc10cb34891d8cd19b15659ac724" x-download-options noopen vary Accept,Accept-Encoding x-frame-options SAMEORIGIN content-type text/javascript; charset=utf-8 cache-control public, max-age=14400 cf-ray 7c4715e54d5bbbe9-FRA expires Tue, 09 May 2023 08:09:11 GMT
GET H/1.1	200 OK	teknkl-formsplus-1.0.5.js Show response s3-us-west-2.amazonaws.com/s.cdpn.io/250687/	41 KB 41 KB	652ms 220ms	Script application/x-js	52.92.251.200 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3-us-west-2.amazonaws.com/s.cdpn.io/250687/teknkl-formsplus-1.0.5.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.92.251.200 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-west-2.amazonaws.com Software AmazonS3 / Resource Hash 731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Date Tue, 09 May 2023 04:09:12 GMT x-amz-version-id OjXdZ5iYdmgpgEuq0ftytCBc_PO35ThO Last-Modified Thu, 26 Apr 2018 08:20:46 GMT Server AmazonS3 x-amz-request-id 1MSRC79HH9FY0SDH ETag "bab0c2b3523f8244564b675fe34db610" Content-Type application/x-js Cache-Control public Accept-Ranges bytes Content-Length 41617 x-amz-id-2 ZP/DRmcDNWIcfue5xnbl8uSR82MoNqXbJKwbBgnuwQ7mcrMOdfnb6oAn+1AD/MyuRar9wd77xSA=
GET H2	200	autoptimize_77f0d0a2f7bba0fe72a675ea39f8f2a6.js Show response redcanary.com/wp-content/cache/autoptimize/js/	299 KB 85 KB	160ms 159ms	Script application/javascript	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_77f0d0a2f7bba0fe72a675ea39f8f2a6.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 0a88509c537582c2f5826d345474dd93d67a9b4efd62ccf1e93e1ac00d5f29b0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Mon, 01 May 2023 16:04:33 GMT server nginx etag W/"644fe311-4adba" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	161ms 64ms	Script application/x-javascript	23.38.53.173 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.38.53.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-38-53-173.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash ef2ca5ac3d9cf4d005d7294562694e44b40efd2c194722721a52743c2f43f1a6 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Date Tue, 09 May 2023 04:09:11 GMT Content-Encoding gzip Last-Modified Wed, 08 Mar 2023 02:09:07 GMT Server AkamaiNetStorage ETag "fefdb331ffca929fc0e661337b64ed4f:1678241347.158405" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Type application/x-javascript Connection keep-alive Accept-Ranges bytes Content-Length 741
GET H2	200	gtm.js Show response www.googletagmanager.com/	270 KB 90 KB	219ms 125ms	Script application/javascript	2a00:1450:4001:831::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash b057809999cde893d5efb25a7730af3887c3e54253d9c649935dbf6dd034f500 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 91582 x-xss-protection 0 last-modified Tue, 09 May 2023 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 09 May 2023 04:09:11 GMT
GET H2	200	6si.min.js Show response j.6sc.co/	33 KB 11 KB	180ms 43ms	Script application/javascript	2.16.187.155 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.187.155 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-187-155.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 12ce92cc3c4eb9d74f48e9a10eb919bdf30bbdc5ccf9843c6543fec302dec54f Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers pragma no-cache date Tue, 09 May 2023 04:09:11 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 04 Apr 2023 21:13:35 GMT server nginx/1.14.0 (Ubuntu) etag "642c92ff-8319" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 10492 expires Tue, 09 May 2023 04:09:11 GMT
GET H2	200	css fonts.googleapis.com/	7 KB 1 KB	143ms 50ms	Stylesheet text/css	2a00:1450:4001:806::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 69f4312649bd19850648422ccf2b5a97f2729321d58eefadb8ed2a528d5d04b0 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Tue, 09 May 2023 04:09:11 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Tue, 09 May 2023 04:09:11 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 09 May 2023 04:09:11 GMT
GET H2	200	autoptimize_9d0bd9a306ee68f16da301ad2160b679.css redcanary.com/wp-content/cache/autoptimize/css/	5 MB 254 KB	160ms 159ms	Stylesheet text/css	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_9d0bd9a306ee68f16da301ad2160b679.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 0b920c4bf087af7caa06ab4eee03f6a8fbd1e432afd4a78faf02e1943c1fa31c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Mon, 01 May 2023 16:04:34 GMT server nginx etag W/"644fe312-53ff8d" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5de2ebfe321cc3b353aa22e923fde9cbc2e266cf6309a9b3185c2c0c6b98600b Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c677eb73148157a4ec4d0a2795b7a9728e940f1af8b2ebdaf0c04bb0fe78c519 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	69 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bbf5dd16a1072e7928a65f0a37dc0d41bd517ed908c7c86df49e9b9089d52d1f Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	getForm Show response resource.redcanary.com/index.php/form/	9 KB 2 KB	101ms 101ms	Script application/javascript	104.17.74.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/getForm?munchkinId=003-YRU-314&form=1034&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&callback=jQuery112409115981885517856_1683605351101&_=1683605351102 Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dcb2e661094c55f665ec0e211e7cff937bf7a474d78d412779a4c9b8a3b0d2c5 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-encoding gzip server cloudflare cf-ray 7c4715e4b8da921a-FRA cached true vary Accept-Encoding content-type application/javascript; charset=utf-8
GET H2	200	button-right-arrow-white.svg redcanary.com/wp-content/themes/redcanary/assets/img/	350 B 581 B	430ms 430ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Wed, 27 Feb 2019 15:51:05 GMT server nginx etag W/"5c76b1e9-15e" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	bullet-square.svg redcanary.com/wp-content/themes/redcanary/assets/img/	443 B 616 B	427ms 426ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/bullet-square.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Mon, 23 Aug 2021 16:46:07 GMT server nginx etag W/"6123d0cf-1bb" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	source-sans-pro-v21-latin-regular.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	13 KB 13 KB	427ms 426ms	Font font/woff2	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-regular.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Origin https://redcanary.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Thu, 02 Jun 2022 17:26:25 GMT server nginx etag "6298f2c1-32ec" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 13036
GET H2	200	source-sans-pro-v21-latin-700.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	13 KB 13 KB	427ms 427ms	Font font/woff2	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-700.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Origin https://redcanary.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Thu, 02 Jun 2022 17:26:24 GMT server nginx etag "6298f2c0-327c" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 12924
GET H2	200	source-sans-pro-v21-latin-300.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	13 KB 13 KB	425ms 424ms	Font font/woff2	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-300.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Origin https://redcanary.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Thu, 02 Jun 2022 17:26:22 GMT server nginx etag "6298f2be-329c" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 12956
GET H2	200	source-sans-pro-v21-latin-600.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	13 KB 13 KB	426ms 425ms	Font font/woff2	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-600.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Origin https://redcanary.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Thu, 02 Jun 2022 17:26:23 GMT server nginx etag "6298f2bf-32fc" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 13052
GET H2	200	forms2.css resource.redcanary.com/js/forms2/css/	13 KB 3 KB	220ms 220ms	Stylesheet text/css	104.17.74.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/css/forms2.css Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status REVALIDATED last-modified Thu, 23 Mar 2023 21:46:36 GMT server cloudflare etag "34c0bdc-3437-5f79835f6a700" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 7c4715e56965921a-FRA content-length 2623 expires Tue, 09 May 2023 08:09:11 GMT
GET H2	200	forms2-theme-plain.css resource.redcanary.com/js/forms2/css/	828 B 357 B	212ms 212ms	Stylesheet text/css	104.17.74.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/css/forms2-theme-plain.css Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa Security Headers Name Value Strict-Transport-Security max-age=63113904 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63113904 last-modified Thu, 23 Mar 2023 21:46:36 GMT server cloudflare cf-cache-status REVALIDATED etag "2fe0075-33c-5f79835f6a700" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 7c4715e56968921a-FRA content-length 246 expires Tue, 09 May 2023 08:09:11 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/162/	11 KB 5 KB	51ms 50ms	Script application/x-javascript	23.38.53.173 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/162/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.38.53.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-38-53-173.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Date Tue, 09 May 2023 04:09:11 GMT Content-Encoding gzip Last-Modified Fri, 01 Jul 2022 00:59:12 GMT Server AkamaiNetStorage ETag "75daf56f6191efe42577301908659c29:1656637152.894482" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Type application/x-javascript Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Length 4677 Expires Thu, 17 Aug 2023 04:09:11 GMT
POST H/1.1	200 OK	visitWebPage 003-yru-314.mktoresp.com/webevents/	2 B 318 B	1103ms 183ms	Ping text/plain	192.28.147.68 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1683605351348&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1683605351347-72674&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/162/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.28.147.68 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Date Tue, 09 May 2023 04:09:12 GMT Content-Encoding gzip Server nginx/1.20.1 Transfer-Encoding chunked Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin * Connection keep-alive X-Request-Id a5f92e81-5204-4ee2-a408-6d0c2ddf6877
POST H2	204	collect region1.google-analytics.com/g/	0 252 B	141ms 48ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je3530&_p=885411015&cid=143732634.1683605351&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1683605351&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&dt=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers pragma no-cache date Tue, 09 May 2023 04:09:11 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	uwt.js Show response static.ads-twitter.com/	56 KB 15 KB	144ms 39ms	Script application/javascript	146.75.116.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-encoding gzip last-modified Thu, 27 Oct 2022 16:56:53 GMT etag "32ad004436155ec972bc50e6238b5b67+gzip+gzip" vary Accept-Encoding,Host x-cache HIT, HIT content-type application/javascript; charset=utf-8 p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn FT cache-control no-cache accept-ranges bytes content-length 15375 x-served-by cache-iad-kjyo7100081-IAD, cache-fra-eddf8230112-FRA
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	13 KB 5 KB	145ms 40ms	Script application/x-javascript	2a02:26f0:6c00::210:ba20 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00::210:ba20 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 10 Jan 2023 17:22:56 GMT x-cdn AKAM vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=73119 accept-ranges bytes content-length 4777
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	23 KB 8 KB	134ms 46ms	Script application/javascript	2a04:4e42::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash cda252dc01c656d59193d8d696f26c3e95f10b87711e2413e28362532bae984a Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish last-modified Mon, 23 Jan 2023 21:56:14 GMT server snooserv nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} etag "03d5db9dfd00a5719bb4c9261e6fa1bb" x-amz-server-side-encryption AES256 vary Accept-Encoding,Origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} content-type application/javascript cache-control public, max-age=60 accept-ranges bytes content-length 7356
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/	3 KB 2 KB	178ms 84ms	Script text/javascript	2a00:1450:4001:831::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1683605351447&cv=11&fst=1683605351447&bg=ffffff&guid=ON&async=1&gtm=45He3530&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&hn=www.googleadservices.com&frm=0&tiba=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&auid=1337778627.1683605351&uamb=0&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 8db32b99160f593f104ff6d52da8be67825ffae7cafb4fc87000e2057c4ccbb1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers pragma no-cache date Tue, 09 May 2023 04:09:11 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1377 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	bat.js Show response bat.bing.com/	40 KB 12 KB	167ms 66ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash eec5c0b7f3736c064a5c93fb61f419fe7d3f7c1815c81004312fd349fd43be2c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip date Tue, 09 May 2023 04:09:10 GMT last-modified Thu, 20 Apr 2023 19:01:49 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: A0C812F08CFE47AFA764AFBD174B73DC Ref B: FRA31EDGE0114 Ref C: 2023-05-09T04:09:11Z etag "808c558fba73d91:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript cache-control private,max-age=1800 accept-ranges bytes content-length 12036
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	106 KB 28 KB	132ms 40ms	Script application/x-javascript	2a03:2880:f083:9:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 8dcee59828f1423ecefd552dd353e25bd4ac38a9557ee084604ee7c2d41d9b98 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff date Tue, 09 May 2023 04:09:11 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27538 x-fb-rlafr 0 x-xss-protection 0 pragma private x-fb-debug +L6cvoTyTi4Kz8FrnRfRnd6mieogzB4k/yust+OVQUX3OxTaDOgt44LM1FjU4qfPInd/Jpkk0WVjqBWvVYboAQ== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" x-fb-trip-id 1679558926 cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY cache-control private permissions-policy accelerometer=() expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ attr.ml-api.io/ Redirect Chain https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID https://attr.ml-api.io/?domain=redcanary.com&pId=7415731178986241574	0 235 B	309ms 192ms	Image application/json	2600:9000:2251:d400:12:3734:2a40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://attr.ml-api.io/?domain=redcanary.com&pId=7415731178986241574 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Server 2600:9000:2251:d400:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:12 GMT via 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P3 x-cache Miss from cloudfront content-type application/json x-amz-cf-id q5FwW8VeMUIGbMzdbTXhVfc7jxxN2LVYW3Wu5EBfMRys7xq0FWrnsQ== content-length 0 apigw-requestid EowYYhJNoAMEScQ= Redirect headers Date Tue, 09 May 2023 04:09:12 GMT P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Connection keep-alive X-Proxy-Origin 80.255.7.100; 80.255.7.100; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com Content-Length 0 X-XSS-Protection 0 Pragma no-cache AN-X-Request-Uuid 3bb6b7de-fcf1-480f-8061-96e1b880530f Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type text/html; charset=utf-8 Access-Control-Allow-Origin * Location https://attr.ml-api.io/?domain=redcanary.com&pId=7415731178986241574 Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	XDFrame Show response resource.redcanary.com/index.php/form/ Frame E5A2	2 KB 891 B	818ms 818ms	Document text/html	104.17.74.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/XDFrame Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1b12ee272c79786bc266207f27c98ed219d2090d0d605e9c7a9e71f2add176fa Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control max-age=3600 cf-cache-status DYNAMIC cf-ray 7c4715e72aeb921a-FRA content-encoding gzip content-type text/html; charset=utf-8 date Tue, 09 May 2023 04:09:12 GMT server cloudflare vary Accept-Encoding x-content-type-options nosniff
GET H2	200	ipv cdn.bizible.com/m/	43 B 203 B	43ms 43ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=e7c583cf3b3947a2e2fd01f1ee38e004&_biz_s=13e21a&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&_biz_t=1683605351273&_biz_i=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&_biz_n=0&a=redcanary.com&rnd=841105&cdn_o=a&_biz_z=1683605351619 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6760) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers pragma no-cache date Tue, 09 May 2023 04:09:11 GMT last-modified Wed, 03 May 2023 14:12:17 GMT server ECS (frb/6760) age 482214 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	u cdn.bizibly.com/	43 B 304 B	43ms 42ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizibly.com/u?_biz_u=e7c583cf3b3947a2e2fd01f1ee38e004&_biz_s=13e21a&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&_biz_t=1683605351622&_biz_i=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&a=redcanary.com&rnd=67633&cdn_o=a&_biz_z=1683605351622 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6752) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers pragma no-cache date Tue, 09 May 2023 04:09:11 GMT last-modified Sun, 07 May 2023 02:44:12 GMT server ECS (frb/6752) age 177899 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	FW_CTA.png redcanary.com/wp-content/uploads/2021/12/	10 KB 10 KB	152ms 151ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2021/12/FW_CTA.png Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 189ad7a7020dd6c9ea981356dd3984efa36851e4eead327f5c94110e139d08c2 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Tue, 21 Dec 2021 02:58:51 GMT server nginx etag "61c142eb-286e" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 10350
GET H2	200	cta-background.jpg redcanary.com/wp-content/uploads/2018/12/	7 KB 7 KB	153ms 151ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2018/12/cta-background.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash ecf6782eee74878f85da64d073a0707c4965f712d7eec6926ea4c9151228e100 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Mon, 09 Nov 2020 21:51:33 GMT server nginx etag "5fa9b9e5-1a18" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 6680
GET H2	200	Threat-Detection-Square-1954-975x975.jpg redcanary.com/wp-content/uploads/2019/08/	47 KB 47 KB	150ms 149ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2019/08/Threat-Detection-Square-1954-975x975.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 8aecb83292d56a0084fbb59b72a4706c59a65f90ed786db2544403cb93066ba8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Mon, 09 Nov 2020 21:33:18 GMT server nginx etag "5fa9b59e-bad0" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 47824
GET H2	200	Tony-500x500.jpg redcanary.com/wp-content/uploads/2019/06/	38 KB 38 KB	153ms 152ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2019/06/Tony-500x500.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 4932426c8682c7d9546d24e9d6b4b2d61168a70baecb158c983ca05b7a67523c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Mon, 09 Nov 2020 21:36:01 GMT server nginx etag "5fa9b641-9775" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 38773
GET H2	200	Brian-Donohue.jpg redcanary.com/wp-content/uploads/2019/02/	19 KB 19 KB	149ms 148ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2019/02/Brian-Donohue.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 819a9261cf87ff4ca13e08fbbb3e84e7827ea409869fc3d87b75bd8224bbd41d Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Mon, 09 Nov 2020 21:47:50 GMT server nginx etag "5fa9b906-4ad4" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 19156
GET H2	200	rp.gif alb.reddit.com/	42 B 157 B	238ms 139ms	Image image/gif	151.101.1.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1683605351642&id=t2_5kac730w&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&uuid=fc489fb7-eaf7-4df8-ba9a-1f08ad5b78b6&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_65e23bc4 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.1.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT via 1.1 varnish server Varnish content-type image/gif cross-origin-resource-policy cross-origin accept-ranges bytes content-length 42 retry-after 0
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/	36 B 374 B	149ms 41ms	XHR application/json	2600:9000:20eb:7000:2:53b2:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/token Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20eb:7000:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://redcanary.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 03:12:57 GMT content-encoding gzip via 1.1 cdcb559c2f25d8ad2ccf0419bee33b02.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C1 age 3374 vary accept-encoding x-cache Hit from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=3600 x-amz-cf-id dOEm3IFUvgkeMBDskii_lpH98jeIMCkPzC1qT_y1irOCwrEEUP8AXA==
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1683605351645&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1683605351645%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fblog... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1683605351645&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&liSync=true https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1683605351645&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&liSync=tr...	0 265 B	283ms 183ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1683605351645&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&liSync=true&e_ipv6=AQIFl4zWS6Pq1QAAAYf-su9foVqgg3a7WzcVxLeDBPMx71Kpg98Qr2DsPi5O6C0vvWB764E Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 3308689A50B14755A9F2212C55A83239 Ref B: DUS30EDGE0815 Ref C: 2023-05-09T04:09:12Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-ltx1 x-li-proto http/2 content-length 0 x-li-uuid AAX7Our7SVy5bgJsqea4+w== Redirect headers date Tue, 09 May 2023 04:09:11 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: E10E7B86775F4E7A969FD2BCFE4CB50D Ref B: FRAEDGE1707 Ref C: 2023-05-09T04:09:12Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1683605351645&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&liSync=true&e_ipv6=AQIFl4zWS6Pq1QAAAYf-su9foVqgg3a7WzcVxLeDBPMx71Kpg98Qr2DsPi5O6C0vvWB764E x-li-proto http/2 content-length 0 x-li-uuid AAX7Our285mVvGJIURwYFQ==
GET H2	200	adsct t.co/i/	43 B 375 B	256ms 156ms	Image image/gif	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?bci=3&eci=2&event_id=61d8cb09-a17b-474b-9577-3821bb7d6e27&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=467cece5-2846-478b-92d5-0709ee1e1338&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers x-response-time 116 date Tue, 09 May 2023 04:09:11 GMT strict-transport-security max-age=0 server tsa_o content-type image/gif;charset=utf-8 x-transaction-id 70110b2d4b005fe9 cache-control no-cache, no-store, max-age=0 perf 7626143928 x-connection-hash 65e4c38199a667d252bc5dd8aa2be856318f7eaa13199c70602b329f534a304a content-length 43
GET H2	200	adsct analytics.twitter.com/i/	43 B 394 B	271ms 153ms	Image image/gif	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=61d8cb09-a17b-474b-9577-3821bb7d6e27&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=467cece5-2846-478b-92d5-0709ee1e1338&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers x-response-time 113 date Tue, 09 May 2023 04:09:11 GMT strict-transport-security max-age=631138519 server tsa_o content-type image/gif;charset=utf-8 x-transaction-id 3f9cba44258c2839 cache-control no-cache, no-store, max-age=0 perf 7626143928 x-connection-hash 9801b15aaee1f47399e6ffc5a644b8aaa357f8bd70a81ebbb323cf2b088fe3cd content-length 43
GET H2	200	/ Show response c.6sc.co/	7 B 200 B	47ms 47ms	XHR text/html	2.16.187.155 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.187.155 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-187-155.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	19 B 306 B	174ms 40ms	XHR text/html	2a02:26f0:6c00::210:bb9b AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00::210:bb9b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 8912320737e38147499c4a1e19c30ca5ba1bdc092378f86d6d18952ec1f61bd7 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers pragma no-cache date Tue, 09 May 2023 04:09:11 GMT vary Origin content-type text/html access-control-allow-origin https://redcanary.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a01:4a0:1338:92::3 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="467668_34651031_336394165_21_807_39_0";dur=1 content-length 19 expires Tue, 09 May 2023 04:09:11 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 200 B	46ms 46ms	XHR text/html	2.16.187.155 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.187.155 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-187-155.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	19 B 307 B	173ms 41ms	XHR text/html	2a02:26f0:6c00::210:bb9b AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00::210:bb9b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 8912320737e38147499c4a1e19c30ca5ba1bdc092378f86d6d18952ec1f61bd7 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers pragma no-cache date Tue, 09 May 2023 04:09:11 GMT vary Origin content-type text/html access-control-allow-origin https://redcanary.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a01:4a0:1338:92::3 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="467668_34651031_336394166_19_852_39_0";dur=1 content-length 19 expires Tue, 09 May 2023 04:09:11 GMT
GET H2	200	1042590016249604 Show response connect.facebook.net/signals/config/	300 KB 87 KB	88ms 86ms	Script application/x-javascript	2a03:2880:f083:9:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1042590016249604?v=2.9.104&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 46c937f49f5cf51e03431dc02462280b7a346b1e43ee9922f062a4f5cef53261 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Tue, 09 May 2023 04:09:11 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug 2mB5GqWICPzKZW1Ls8MvlRMh6Xlqxf5KkLPYj5eGHdr49isaWPHBi3SZq/vNDFXC6aF6dn72Zw5kueIIZTLKxA== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" x-fb-trip-id 1679558926 cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=() expires Sat, 01 Jan 2000 00:00:00 GMT
POST H2	200	admin-ajax.php Show response redcanary.com/wp-admin/	0 665 B	1210ms 1209ms	XHR text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-admin/admin-ajax.php Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; X-Content-Type-Options nosniff, nosniff X-Frame-Options SAMEORIGIN, deny X-Xss-Protection 1; mode=block Request headers Accept */* Referer https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Tue, 09 May 2023 04:09:12 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff, nosniff strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-encoding br x-permitted-cross-domain-policies master-only x-powered-by WP Engine x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin, strict-origin-when-cross-origin server nginx vary Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN, deny content-type text/html; charset=UTF-8 access-control-allow-origin https://redcanary.com cache-control no-cache, must-revalidate, max-age=0, no-store access-control-allow-credentials true feature-policy microphone 'none'; geolocation 'none' x-robots-tag noindex expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	204	56383426.js Show response bat.bing.com/p/action/	0 119 B	182ms 181ms	Script text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/56383426.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 date Tue, 09 May 2023 04:09:10 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 8558D93098A14FCDB2484B167FBADACB Ref B: FRA31EDGE0114 Ref C: 2023-05-09T04:09:11Z x-cache CONFIG_NOCACHE
GET H2	204	0 bat.bing.com/action/	0 286 B	66ms 66ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=56383426&tm=gtm002&Ver=2&mid=34f5b8e7-5fc8-4e21-b0a1-ac01a99965e1&sid=40d0bb80ee1f11ed9a0c1d72f9147474&vid=40d0dd90ee1f11edb65b5d31857e6e73&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&p=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&r=&lt=1802&evt=pageLoad&sv=1&rn=99756 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 09 May 2023 04:09:10 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: A3DDC89CFE2644E1A454CD0894D37252 Ref B: FRA31EDGE0114 Ref C: 2023-05-09T04:09:11Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/759876114/	42 B 455 B	143ms 51ms	Image image/gif	2a00:1450:4001:806::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/759876114/?random=1683605351447&cv=11&fst=1683604800000&bg=ffffff&guid=ON&async=1&gtm=45He3530&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&frm=0&tiba=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&fmt=3&is_vtc=1&random=2764247320&rmt_tld=0&ipr=y Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers pragma no-cache date Tue, 09 May 2023 04:09:11 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/759876114/	42 B 455 B	177ms 60ms	Image image/gif	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/759876114/?random=1683605351447&cv=11&fst=1683604800000&bg=ffffff&guid=ON&async=1&gtm=45He3530&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&frm=0&tiba=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&fmt=3&is_vtc=1&random=2764247320&rmt_tld=1&ipr=y Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers pragma no-cache date Tue, 09 May 2023 04:09:11 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	xdc.js Show response cdn.bizible.com/	116 B 532 B	152ms 152ms	Script text/javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/xdc.js?_biz_u=e7c583cf3b3947a2e2fd01f1ee38e004&_biz_h=-1906410348&cdn_o=a&jsVer=4.23.05.04&a=redcanary.com Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6711) / Resource Hash ec7ce08e0d70fa15c06f525bcdd0df7e6e83dd2a5d96bff5083ad263cea36a82 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-encoding gzip server ECS (frb/6711) etag CAF8802B vary Accept-Encoding p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type text/javascript; charset=utf-8 cache-control private, must-revalidate, max-age=21600 content-length 217
GET H2	200	u cdn.bizible.com/m/	43 B 121 B	40ms 40ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/u?mapType=mkto&mapValue=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1683605351347-72674&_biz_u=e7c583cf3b3947a2e2fd01f1ee38e004&_biz_s=13e21a&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&_biz_t=1683605351622&_biz_i=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&_biz_n=1&a=redcanary.com&rnd=26051&cdn_o=a&_biz_z=1683605351724 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6776) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers pragma no-cache date Tue, 09 May 2023 04:09:11 GMT last-modified Fri, 05 May 2023 00:01:32 GMT server ECS (frb/6776) age 360459 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	globe-white-right.png redcanary.com/wp-content/themes/redcanary/assets/img/	259 KB 260 KB	147ms 146ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/globe-white-right.png Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_9d0bd9a306ee68f16da301ad2160b679.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash d3d589e680bc49f54cb5721723fc2ec1a68d5e8ce3946db7192fb0d207e9b6cf Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_9d0bd9a306ee68f16da301ad2160b679.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Wed, 27 Feb 2019 15:51:11 GMT server nginx etag "5c76b1ef-40da2" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 265634
GET H2	200	search-btn.svg redcanary.com/wp-content/themes/redcanary/assets/img/	161 B 435 B	154ms 153ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/search-btn.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_9d0bd9a306ee68f16da301ad2160b679.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_9d0bd9a306ee68f16da301ad2160b679.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:11 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Wed, 08 Sep 2021 23:08:04 GMT server nginx etag W/"61394254-a1" vary Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	/ www.facebook.com/tr/	0 185 B	146ms 40ms	Image text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&rl=&if=false&ts=1683605351965&sw=1600&sh=1200&v=2.9.104&r=stable&ec=0&o=30&fbp=fb.1.1683605351964.1009274456&it=1683605351691&coo=false&rqm=GET Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Tue, 09 May 2023 04:09:12 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	redcanary.com.json Show response script.crazyegg.com/pages/data-scripts/0096/9416/site/ Frame 38DA	6 KB 2 KB	251ms 168ms	XHR application/json	2606:4700::6813:9408 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0096/9416/site/redcanary.com.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0096/9416.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4ce9bdb61ee1f789c761c5074e4ff59c974169e2188bd726d2e8ebaeff640738 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:12 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 09 May 2023 04:09:12 GMT server cloudflare vary Accept-Encoding content-type application/json ce-version 11.5.73 access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin * cf-ray 7c4715ebbffc9186-FRA content-length 1844
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/ Frame E5A2	208 KB 69 KB	60ms 60ms	Script application/x-javascript	104.17.74.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/index.php/form/XDFrame Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://resource.redcanary.com/index.php/form/XDFrame User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:12 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Thu, 23 Mar 2023 21:46:36 GMT server cloudflare age 1 etag "2fe006b-33e51-5f79835f6a700" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 7c4715ec5fcb921a-FRA expires Tue, 09 May 2023 08:09:12 GMT
GET H2	200	759ced533b68f06bbc5d8a775605b45b.js Show response script.crazyegg.com/pages/versioned/common-scripts/	72 KB 24 KB	49ms 47ms	Script text/javascript	2606:4700::6813:9408 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/common-scripts/759ced533b68f06bbc5d8a775605b45b.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0096/9416.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1857d1bc1fe229e7ca9313cf1270171e6c6e95c82f70820bde5a5a3baa22e30b Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:12 GMT content-encoding gzip cf-cache-status HIT last-modified Mon, 24 Apr 2023 15:32:13 GMT server cloudflare age 31865 vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000, s-maxage=31536000 accept-ranges bytes timing-allow-origin * cf-ray 7c4715ecc92abb38-FRA content-length 24814
POST H2	200	/ Show response www.facebook.com/tr/ Frame C331	0 47 B	40ms 39ms	Document text/plain	2a03:2880:f176:84:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://redcanary.com Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://redcanary.com alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Tue, 09 May 2023 04:09:12 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
GET H/1.1	200 OK	messenger Show response app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame 1A7B	6 KB 3 KB	434ms 137ms	Document text/html	52.70.128.149 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=e40c1e9a-fa79-4db7-a140-84119cb2b62e Requested by Host: js.qualified.com URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.70.128.149 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-70-128-149.compute-1.amazonaws.com Software nginx / Resource Hash 0df85849883e46f46a5b8e0d5ca2b3d929e032209a8d8f26b2387fc52bf9bc02 Security Headers Name Value Content-Security-Policy Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control max-age=0, private, must-revalidate Content-Encoding gzip Content-Length 1783 Content-Security-Policy Content-Type text/html; charset=utf-8 Date Tue, 09 May 2023 04:09:12 GMT Etag W/"0df85849883e46f46a5b8e0d5ca2b3d9" Link <https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css>; rel=preload; as=style; nopush Referrer-Policy strict-origin-when-cross-origin Server nginx Strict-Transport-Security max-age=63072000; includeSubDomains Vary Accept-Encoding Via 1.1 spaces-router (e46a9e002bdb) X-Content-Type-Options nosniff X-Download-Options noopen X-Permitted-Cross-Domain-Policies none X-Request-Id 7920ba0c-e0eb-a97e-984a-12ca58445978 X-Runtime 0.017461 X-Xss-Protection 1; mode=block
GET H2	200	redcanary.com.json Show response script.crazyegg.com/pages/data-scripts/0096/9416/sampling/ Frame 38DA	159 B 208 B	161ms 161ms	XHR application/json	2606:4700::6813:9408 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0096/9416/sampling/redcanary.com.json?t=467668 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/759ced533b68f06bbc5d8a775605b45b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fdaa22e7c198a65ec23fb1fcf2e414331a8b1a9891d0f628e3d0c2456e4aa6a0 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:12 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 09 May 2023 04:09:12 GMT server cloudflare vary Accept-Encoding content-type application/json ce-version 11.5.73 access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin * cf-ray 7c4715ed597e9186-FRA content-length 144
GET H2	200	healthcheck Show response pagestates-tracking.crazyegg.com/ Frame 38DA	19 B 461 B	140ms 39ms	XHR application/json	13.32.27.106 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://pagestates-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/759ced533b68f06bbc5d8a775605b45b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.27.106 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-27-106.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Thu, 06 Apr 2023 11:18:30 GMT via 1.1 b25bc331cb2e5e7e25d9488f5ecdc940.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-C2 age 2825443 x-cache Hit from cloudfront content-length 19 last-modified Fri, 08 Jul 2022 22:25:51 GMT server AmazonS3 etag "d06f04fccf68d0b228a5923187ce1afd" access-control-max-age 31536000 access-control-allow-methods GET, HEAD content-type application/json access-control-allow-origin * access-control-expose-headers Access-Control-Allow-Origin accept-ranges bytes x-amz-cf-id bDAhR4cdiIXLEl8SgtjfQrVS94fJyb3hlIc2v694lrHV2Ez8OPkyRA==
GET H2	200	healthcheck Show response assets-tracking.crazyegg.com/ Frame 38DA	19 B 387 B	132ms 40ms	XHR application/json	18.66.122.74 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/759ced533b68f06bbc5d8a775605b45b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.74 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-74.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Sat, 05 Nov 2022 03:10:02 GMT via 1.1 508d9aac3b0097e502b117c1e7390bb0.cloudfront.net (CloudFront) last-modified Fri, 08 Jul 2022 22:25:51 GMT server AmazonS3 x-amz-cf-pop FRA60-P2 age 15987551 etag "d06f04fccf68d0b228a5923187ce1afd" x-cache Hit from cloudfront content-type application/json access-control-allow-origin * access-control-expose-headers * accept-ranges bytes content-length 19 x-amz-cf-id 81MylYHPnEzstEG8TRa_cLJDqscWwnJw0lJ9DKpp4y1Ib5xrOy2Y0w==
GET BLOB	200 OK	74f411af-5ea4-4e84-b59c-38ef523e0e55 https://redcanary.com/	45 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://redcanary.com/74f411af-5ea4-4e84-b59c-38ef523e0e55 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Length 45 Content-Type text/javascript
GET H2	200	clock Show response tracking.crazyegg.com/ Frame 38DA	28 B 135 B	204ms 85ms	XHR text/plain	99.81.213.245 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?t=1683605352839&tk=40ea43635c9a9388c5f9f97df894a565&s=360154&p=%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&u=969416&v=92d61b7385d9a6b1fa1a099bc745c17f195823bf&f=redcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies&ul=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/759ced533b68f06bbc5d8a775605b45b.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.81.213.245 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-99-81-213-245.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash 306bbd6ca31e90334b4dd1afa56db29df9c0f902a3d919f5c2a2a3d6ab881e67 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers access-control-allow-origin * date Tue, 09 May 2023 04:09:13 GMT cache-control no-store server awselb/2.0 content-length 28 content-type text/plain
GET H2	200	messenger-94e6eccc.chunk.css assets.qualified.com/packs/css/vendors~widget/sandboxed/ Frame 1A7B	35 KB 7 KB	77ms 51ms	Stylesheet text/css	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eb3487cae40a55bf31dc6e6191ab0d88ec8c8f85c62bf28ad25ad0a40c16a611 Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:13 GMT x-amz-version-id CR7RLVOSvN8A59.U_Z8vAhDQbuXMYHqb content-encoding gzip cf-cache-status HIT last-modified Wed, 04 Jan 2023 23:05:35 GMT server cloudflare x-amz-request-id 90FWQHM1YN0C4AZ0 age 1500 etag W/"a788ecf510f83ee517cbaf79306145dd" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 cf-ray 7c4715f03ea5bbe9-FRA x-amz-id-2 rLqAcBUjCR5iItU2BmaSomv6EBclRN5fXi6l55J/N8krCig+rJdq2Kyy59scvA6+BkA5YO2cQj1KXQAiAsBZ5Q== expires Tue, 09 May 2023 08:09:13 GMT
GET H2	200	messenger-84a66aeb.chunk.css assets.qualified.com/packs/css/widget/sandboxed/ Frame 1A7B	5 KB 1 KB	72ms 48ms	Stylesheet text/css	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:13 GMT x-amz-version-id RuQi5GOo1hqbX6GFZui6YyPZ0XQ1C5E6 content-encoding gzip cf-cache-status HIT x-amz-request-id 87WCQR418JZVSXNA age 3875 x-amz-server-side-encryption AES256 x-amz-id-2 iySJJL1mjeoq19kwudTNrL9KoNn+0HpEUspqVSrfJ3TtLUQvqZro1IgTbf/TVZSQMLn9j/zk3qk= last-modified Tue, 14 Mar 2023 23:12:27 GMT server cloudflare etag W/"22d5f23e695250d3c5a5b1e76a015c5e" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 cf-ray 7c4715f03ea4bbe9-FRA expires Tue, 09 May 2023 08:09:13 GMT
GET H2	200	messenger~runtime-02cee4cb80a02bcd80c9.js Show response assets.qualified.com/packs/js/widget/sandboxed/ Frame 1A7B	2 KB 1 KB	66ms 49ms	Script application/javascript	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget/sandboxed/messenger~runtime-02cee4cb80a02bcd80c9.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=e40c1e9a-fa79-4db7-a140-84119cb2b62e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f17508baf35219ef8cfefd18da38c280a376b3efd28c7e478c177849e31c19fc Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:13 GMT x-amz-version-id QHZGD7OZx865gjIanb1nZfDjB46neUvi content-encoding gzip cf-cache-status HIT x-amz-request-id C4PPE6ZX9FK39015 age 1829 x-amz-server-side-encryption AES256 x-amz-id-2 avsvEPEcIWPuAP86Vvq7b9OvyJHjd4QQBYMBIT4jR8VajmLx1uCr0L2HUIIX0M122rQLAWfcCHQ= last-modified Sat, 06 May 2023 01:16:01 GMT server cloudflare etag W/"2fbbfad603f171ea75f5596e00804914" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 7c4715f03ea8bbe9-FRA expires Tue, 09 May 2023 08:09:13 GMT
GET H2	200	messenger-464dab066b937a48f3ed.chunk.js Show response assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/ Frame 1A7B	1 MB 342 KB	75ms 58ms	Script application/javascript	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-464dab066b937a48f3ed.chunk.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=e40c1e9a-fa79-4db7-a140-84119cb2b62e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 572ba336728c230a70ec05b3585d3d1946e0211f67fe285af3c4fef4040a7909 Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:13 GMT x-amz-version-id CS598eVFsWmxqiqMlnqcT5XPmOwvFx3F content-encoding gzip cf-cache-status HIT x-amz-request-id CGSVXR80B9VBY0PK age 5421 x-amz-server-side-encryption AES256 x-amz-id-2 UOKbHmypQfS6joXuNSXP/hKJcdDT0WCfcXn5yctidxeSGmhL3WflEJ9dzNxfzBOVjjCUEDABLIY= last-modified Thu, 04 May 2023 00:08:35 GMT server cloudflare etag W/"16b5dd09367c2d0708ce5aa5c39a31a0" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 7c4715f03ea7bbe9-FRA expires Tue, 09 May 2023 08:09:13 GMT
GET H2	200	messenger-61694358ff28934d48a0.chunk.js Show response assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/ Frame 1A7B	576 KB 154 KB	78ms 77ms	Script application/javascript	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/messenger-61694358ff28934d48a0.chunk.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=e40c1e9a-fa79-4db7-a140-84119cb2b62e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 26751b0a456860de17d1f8e19913c6c6bf8154fe823e75737cfb0b9c6fae4448 Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:13 GMT x-amz-version-id HZ7_ynWO_pYQiues04gbtlALmnKj1tzU content-encoding gzip cf-cache-status HIT x-amz-request-id C4PGSQ10FAR89ZJ6 age 1829 x-amz-server-side-encryption AES256 x-amz-id-2 I0+W09a8rkbT9LH8INYjIZyiv8pMTgtMu+tPqE3UE7rZ5I9kq/EwwXCYerpc4YZh+8kj1EnQvT0= last-modified Sat, 06 May 2023 01:16:02 GMT server cloudflare etag W/"06dad36412ab3f8b061d5ab874e36f6b" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 7c4715f08f1dbbe9-FRA expires Tue, 09 May 2023 08:09:13 GMT
GET H2	200	Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2 assets.qualified.com/packs/media/fonts/inter/ Frame 1A7B	97 KB 97 KB	153ms 50ms	Font font/woff2	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/media/fonts/inter/Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2 Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=e40c1e9a-fa79-4db7-a140-84119cb2b62e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6 Request headers Referer https://app.qualified.com/ Origin https://app.qualified.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:13 GMT x-amz-version-id Ts0p7fbKsZIFu_VEk6HOvm9iYpTRKuos cf-cache-status HIT x-amz-request-id A014AXCH5HAYN619 age 13055171 content-length 98868 x-amz-id-2 IJ/hVgCs33ecZmS06+Ka+dHvpugbE2eU1ZCcp0I9amPp9Dk45jvq9GOwp+V0XScoH+qD8bPUljc= last-modified Thu, 08 Dec 2022 23:17:25 GMT server cloudflare etag "dc131113894217b5031000575d9de002" access-control-max-age 3600 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control public, max-age=31557600 accept-ranges bytes cf-ray 7c4715f0bee39143-FRA expires Wed, 08 May 2024 10:09:13 GMT
GET H2	200	Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2 assets.qualified.com/packs/media/fonts/inter/ Frame 1A7B	103 KB 104 KB	198ms 95ms	Font font/woff2	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/media/fonts/inter/Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2 Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=e40c1e9a-fa79-4db7-a140-84119cb2b62e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5 Request headers Referer https://app.qualified.com/ Origin https://app.qualified.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:13 GMT x-amz-version-id ePBeoMCujYBxKBCWHO9COs36tHcpJSw9 cf-cache-status HIT x-amz-request-id A01B2QDFTMXZH5PS age 13055171 content-length 105804 x-amz-id-2 QrEATIdRG82StQ9vuCskL/XEsQIIMY+OzO15MGNTQIYZKmPGvaIhnxUF1uCukz9/QAqZn2UpPyU= last-modified Thu, 08 Dec 2022 23:17:25 GMT server cloudflare etag "007ad31a53f4ab3f58ee74f2308482ce" access-control-max-age 3600 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control public, max-age=31557600 accept-ranges bytes cf-ray 7c4715f0bee59143-FRA expires Wed, 08 May 2024 10:09:13 GMT
GET BLOB	200 OK	012393df-e581-4e13-aef6-0b6a5bfc5178 https://redcanary.com/	241 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://redcanary.com/012393df-e581-4e13-aef6-0b6a5bfc5178 Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash d484d62c91fbda4843c3ca664c112ddbbfac9d944acbf48346fd58188242d9ac Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Length 241 Content-Type text/javascript
POST H/1.1	200 OK	/ Show response sentry.io/api/1332833/envelope/ Frame 1A7B	2 B 442 B	588ms 148ms	Fetch application/json	35.188.42.15 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sentry.io/api/1332833/envelope/?sentry_key=b5158ee3382d49b28a864fb2b91bcaaf&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.11.1 Requested by Host: assets.qualified.com URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-464dab066b937a48f3ed.chunk.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.42.15 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 15.42.188.35.bc.googleusercontent.com Software nginx / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://app.qualified.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Tue, 09 May 2023 04:09:13 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload Server nginx vary origin,access-control-request-method,access-control-request-headers Content-Type application/json access-control-allow-origin * access-control-expose-headers x-sentry-error,x-sentry-rate-limits,retry-after x-envoy-upstream-service-time 5 Connection keep-alive Content-Length 2
GET H2	200	/ Show response c.6sc.co/	7 B 200 B	41ms 40ms	XHR text/html	2.16.187.155 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.187.155 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-187-155.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:13 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	19 B 307 B	41ms 41ms	XHR text/html	2a02:26f0:6c00::210:bb9b AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00::210:bb9b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 8912320737e38147499c4a1e19c30ca5ba1bdc092378f86d6d18952ec1f61bd7 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers pragma no-cache date Tue, 09 May 2023 04:09:13 GMT vary Origin content-type text/html access-control-allow-origin https://redcanary.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a01:4a0:1338:92::3 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="467668_34651031_336396868_13_714_39_0";dur=1 content-length 19 expires Tue, 09 May 2023 04:09:13 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	232ms 230ms	Image image/gif	2.16.187.155 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=900e14fa-4a06-42cf-8946-5c0f77263bfe&session=1b083b8a-c55f-4695-808f-2cdbb6e4f903&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2009%20May%202023%2004%3A09%3A11%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2009%20May%202023%2004%3A09%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22565ffb1efc5e75f417d1fe1c2134f835%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2009%20May%202023%2004%3A09%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2009%20May%202023%2004%3A09%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20used%20Vssadmin%20to%20delete%20shadow%20copies%20during%20a%202019%20ransomware%20incident%20involving%20Kaseya%20IT%20management%20software.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&pageViewId=551afad2-09ba-404e-8c48-033e01d898ec Requested by Host: redcanary.com URL: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-deletes-the-shadow-copies/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.187.155 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-187-155.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:13 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	optimize.js Show response www.google-analytics.com/gtm/	115 KB 45 KB	144ms 55ms	Script application/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/optimize.js?id=GTM-KJTKFT3 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash f22bec5fe52615c48a79b89fb4b67478d22965c47a96f6a5dfe0850973dd6d28 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:13 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 45947 x-xss-protection 0 last-modified Tue, 09 May 2023 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 09 May 2023 04:09:13 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	239ms 239ms	Image image/gif	2.16.187.155 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=900e14fa-4a06-42cf-8946-5c0f77263bfe&session=1b083b8a-c55f-4695-808f-2cdbb6e4f903&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A3%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20used%20Vssadmin%20to%20delete%20shadow%20copies%20during%20a%202019%20ransomware%20incident%20involving%20Kaseya%20IT%20management%20software.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&pageViewId=551afad2-09ba-404e-8c48-033e01d898ec Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.187.155 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-187-155.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:13 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	details Show response epsilon.6sense.com/v3/company/	726 B 570 B	286ms 202ms	XHR application/json	35.156.45.170 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.156.45.170 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-156-45-170.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 0fe30a881b9d89d4dc8bf8100a8e5550ce4a09232f1cb4c109f105307f77b93b Request headers Referer https://redcanary.com/ accept-language de-DE,de;q=0.9 Authorization Token 5056c3929c3198270386ced81b434006bcef81be User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:13 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json access-control-allow-origin https://redcanary.com access-control-allow-credentials true content-length 387
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	136ms 42ms	Preflight	35.156.45.170 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.156.45.170 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-156-45-170.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization Access-Control-Request-Method GET Origin https://redcanary.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization access-control-allow-methods OPTIONS,GET access-control-allow-origin https://redcanary.com access-control-max-age 1800 date Tue, 09 May 2023 04:09:13 GMT server nginx
GET H2	200	analytics.js Show response www.google-analytics.com/	51 KB 20 KB	46ms 46ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Tue, 09 May 2023 03:05:00 GMT last-modified Mon, 17 Apr 2023 22:36:01 GMT server Golfe2 age 3853 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20737 expires Tue, 09 May 2023 05:05:00 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	4 B 180 B	47ms 47ms	XHR text/plain	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j100&a=885411015&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&ul=en-us&de=UTF-8&dt=It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABQAAAACAAI~&jid=1592522292&gjid=462119180&cid=143732634.1683605351&tid=UA-52702906-1&_gid=1328721393.1683605354&_r=1&_slc=1&gtm=45He3530n81PXWC8JW&cd18=null&z=1808967739 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 09 May 2023 04:09:13 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 347 B	146ms 48ms	XHR text/plain	2a00:1450:400c:c0c::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-52702906-1&cid=143732634.1683605351&jid=1592522292&gjid=462119180&_gid=1328721393.1683605354&_u=YADAAEAAQAAAACAAI~&z=242072867 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Tue, 09 May 2023 04:09:13 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	56ms 55ms	Image image/gif	2a00:1450:4001:806::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-52702906-1&cid=143732634.1683605351&jid=1592522292&_u=YADAAEAAQAAAACAAI~&z=402701342 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers pragma no-cache date Tue, 09 May 2023 04:09:13 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	51ms 51ms	Image image/gif	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-52702906-1&cid=143732634.1683605351&jid=1592522292&_u=YADAAEAAQAAAACAAI~&z=402701342 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers pragma no-cache date Tue, 09 May 2023 04:09:13 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame 1A7B	13 KB 13 KB	391ms 136ms	Image image/png	52.217.69.48 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://qualified-production.s3.us-east-1.amazonaws.com/uploads/d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.69.48 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-east-1-r-w.amazonaws.com Software AmazonS3 / Resource Hash 9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381 Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Date Tue, 09 May 2023 04:09:15 GMT Last-Modified Thu, 20 Oct 2022 23:47:27 GMT Server AmazonS3 x-amz-request-id MCEV8DS4G7BNB197 ETag "fd481ec600c1b3fad6f9e29aa732a946" x-amz-server-side-encryption AES256 Content-Type image/png Cache-Control Cache-Control: public, max-age=31536000 Accept-Ranges bytes Content-Length 12932 x-amz-id-2 ckTzNu26EmBZAKleYOAfpmjjL6RqrvzHURhDuJh9rufcwtanEbGeqL45IGEfRrsIWwX2kdLso6s=
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	232ms 231ms	Image image/gif	2.16.187.155 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=900e14fa-4a06-42cf-8946-5c0f77263bfe&session=1b083b8a-c55f-4695-808f-2cdbb6e4f903&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2009%20May%202023%2004%3A09%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2009%20May%202023%2004%3A09%3A11%20GMT%22%2C%22timeSpent%22%3A%223056%22%2C%22totalTimeSpent%22%3A%223056%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20used%20Vssadmin%20to%20delete%20shadow%20copies%20during%20a%202019%20ransomware%20incident%20involving%20Kaseya%20IT%20management%20software.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&pageViewId=551afad2-09ba-404e-8c48-033e01d898ec Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.187.155 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-187-155.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:14 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame 1A7B	13 KB 13 KB	126ms 126ms	Image image/png	52.217.69.48 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://qualified-production.s3.us-east-1.amazonaws.com/uploads/b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.217.69.48 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-east-1-r-w.amazonaws.com Software AmazonS3 / Resource Hash 00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Date Tue, 09 May 2023 04:09:15 GMT Last-Modified Thu, 20 Oct 2022 23:48:08 GMT Server AmazonS3 x-amz-request-id MCERPPBA9D0JPN8Q ETag "7797b96a7f999ac42de528bede3329af" x-amz-server-side-encryption AES256 Content-Type image/png Cache-Control Cache-Control: public, max-age=31536000 Accept-Ranges bytes Content-Length 13099 x-amz-id-2 0CYE81IrGvgBExcgqU0tVOX337cf3h2g4lvDLiTBaVghhM7KobvYfGIGi/CEBO7X6yTq92nP41k=
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	245ms 245ms	Image image/gif	2.16.187.155 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=900e14fa-4a06-42cf-8946-5c0f77263bfe&session=1b083b8a-c55f-4695-808f-2cdbb6e4f903&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2009%20May%202023%2004%3A09%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2009%20May%202023%2004%3A09%3A14%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224057%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20used%20Vssadmin%20to%20delete%20shadow%20copies%20during%20a%202019%20ransomware%20incident%20involving%20Kaseya%20IT%20management%20software.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&pageViewId=551afad2-09ba-404e-8c48-033e01d898ec Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.187.155 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-187-155.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:15 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	230ms 230ms	Image image/gif	2.16.187.155 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=900e14fa-4a06-42cf-8946-5c0f77263bfe&session=1b083b8a-c55f-4695-808f-2cdbb6e4f903&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2009%20May%202023%2004%3A09%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2009%20May%202023%2004%3A09%3A15%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225058%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20used%20Vssadmin%20to%20delete%20shadow%20copies%20during%20a%202019%20ransomware%20incident%20involving%20Kaseya%20IT%20management%20software.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&pageViewId=551afad2-09ba-404e-8c48-033e01d898ec Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.187.155 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-187-155.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:16 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	258ms 258ms	Image image/gif	2.16.187.155 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=900e14fa-4a06-42cf-8946-5c0f77263bfe&session=1b083b8a-c55f-4695-808f-2cdbb6e4f903&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2009%20May%202023%2004%3A09%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2009%20May%202023%2004%3A09%3A16%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226059%22%7D&isIframe=false&m=%7B%22description%22%3A%22Adversaries%20used%20Vssadmin%20to%20delete%20shadow%20copies%20during%20a%202019%20ransomware%20incident%20involving%20Kaseya%20IT%20management%20software.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22It%E2%80%99s%20all%20fun%20and%20games%20until%20ransomware%20deletes%20the%20shadow%20copies%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fits-all-fun-and-games-until-ransomware-deletes-the-shadow-copies%2F&pageViewId=551afad2-09ba-404e-8c48-033e01d898ec Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.16.187.155 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-187-155.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 09 May 2023 04:09:17 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT