cisomag.eccouncil.org Open in urlscan Pro
2606:4700::6812:15fb Public Scan

Go To Rescan
Add Verdict Report

URL:
https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/
Submission: On March 24 via api (March 24th 2022, 2:09:49 am UTC) from US — Scanned from DE

Summary HTTP 213 Redirects Links 31 Behaviour Indicators

Summary

This website contacted 43 IPs in 7 countries across 35 domains to perform 213 HTTP transactions. The main IP is 2606:4700::6812:15fb, located in United States and belongs to CLOUDFLARENET, US. The main domain is cisomag.eccouncil.org.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on September 16th 2021. Valid for: a year.

This is the only time cisomag.eccouncil.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
78	2606:4700::68... 2606:4700::6812:15fb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
3	151.101.0.176 151.101.0.176	54113 (FASTLY) (FASTLY)
4	2a03:2880:f00... 2a03:2880:f008:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
3	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
16	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
3	2606:4700::68... 2606:4700::6812:14fb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2620:1ec:27::... 2620:1ec:27::cafe:2154	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
1	52.218.241.113 52.218.241.113	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:440... 2606:4700:440e::ac40:9c1a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
1 10	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
4	20.96.88.162 20.96.88.162	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f10... 2a03:2880:f108:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	167.71.57.196 167.71.57.196	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2	54.187.159.182 54.187.159.182	16509 (AMAZON-02) (AMAZON-02)
1	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
2 7	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
2	2600:9000:223... 2600:9000:223e:e200:19:7d10:bd80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c02::9d	15169 (GOOGLE) (GOOGLE)
1	34.211.187.4 34.211.187.4	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	204.141.42.49 204.141.42.49	2639 (ZOHO-AS) (ZOHO-AS)
1	64.225.42.52 64.225.42.52	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3	138.68.235.115 138.68.235.115	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
10	2a00:1450:400... 2a00:1450:4001:801::2001	15169 (GOOGLE) (GOOGLE)
1 2	2620:116:800d... 2620:116:800d:21:fcb8:22d2:d390:5f1b	16509 (AMAZON-02) (AMAZON-02)
2 2	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
2	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
4 4	192.82.242.209 192.82.242.209	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8100:8701:aae2:1118:ca9	16509 (AMAZON-02) (AMAZON-02)
3	185.29.132.242 185.29.132.242	30419 (MEDIAMATH...) (MEDIAMATH-INC)
1	144.76.91.199 144.76.91.199	24940 (HETZNER-AS) (HETZNER-AS)
1	104.79.88.164 104.79.88.164	16625 (AKAMAI-AS) (AKAMAI-AS)
3	136.243.149.243 136.243.149.243	24940 (HETZNER-AS) (HETZNER-AS)
4	37.157.4.41 37.157.4.41	198622 (ADFORM) (ADFORM)
1 1	3.126.56.108 3.126.56.108	16509 (AMAZON-02) (AMAZON-02)
2 2	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
14	37.157.2.248 37.157.2.248	198622 (ADFORM) (ADFORM)
1 2	52.142.114.2 52.142.114.2	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a00:1450:400... 2a00:1450:4001:829::2006	15169 (GOOGLE) (GOOGLE)
213	43

78 2606:4700::6812:15fb (United States)

ASN13335 (CLOUDFLARENET, US)

cisomag.eccouncil.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.0.176 (United States)

ASN54113 (FASTLY, US)

js.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f008:8:face:b00c:0:1 (Milan, Italy)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:14fb (United States)

ASN13335 (CLOUDFLARENET, US)

www.eccouncil.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:27::cafe:2154 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.218.241.113 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2-r-w.amazonaws.com

edm-image.s3.us-west-2.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:440e::ac40:9c1a (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 20.96.88.162 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

k.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f108:83:face:b00c:0:25de (Milan, Italy)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 167.71.57.196 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)

cdn.webpushr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.187.159.182 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-187-159-182.stripe.com

q.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:223e:e200:19:7d10:bd80:93a1 (United States)

ASN16509 (AMAZON-02, US)

m.stripe.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c02::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.211.187.4 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-211-187-4.us-west-2.compute.amazonaws.com

m.stripe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 204.141.42.49 (United States)

ASN2639 (ZOHO-AS, US)

crm.zoho.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.225.42.52 (Santa Clara, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

bot.webpushr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 138.68.235.115 (Santa Clara, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

analytics.webpushr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:fcb8:22d2:d390:5f1b (United States) 1 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.215.191 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.82.242.209 (United States) 4 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.173.144.139 (Frankfurt am Main, Germany) 2 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8100:8701:aae2:1118:ca9 (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.29.132.242 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)

tags.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 144.76.91.199 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.199.91.76.144.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.79.88.164 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-79-88-164.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 136.243.149.243 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.243.149.243.136.clients.your-server.de

hal900030.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.157.4.41 (Denmark)

ASN198622 (ADFORM, DK)

track.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.126.56.108 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-108.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 37.157.2.248 (Denmark)

ASN198622 (ADFORM, DK)

s1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.142.114.2 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
81	eccouncil.org cisomag.eccouncil.org www.eccouncil.org	2 MB
22	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 90 tpc.googlesyndication.com — Cisco Umbrella Rank: 122	358 KB
20	doubleclick.net 1 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 38 stats.g.doubleclick.net — Cisco Umbrella Rank: 68 cm.g.doubleclick.net — Cisco Umbrella Rank: 176	63 KB
18	adform.net track.adform.net — Cisco Umbrella Rank: 3334 s1.adform.net — Cisco Umbrella Rank: 8028	175 KB
9	google.com 2 redirects adservice.google.com — Cisco Umbrella Rank: 57 www.google.com — Cisco Umbrella Rank: 2	2 KB
7	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 916 k.clarity.ms — Cisco Umbrella Rank: 2851 c.clarity.ms — Cisco Umbrella Rank: 547	25 KB
6	webpushr.com cdn.webpushr.com — Cisco Umbrella Rank: 24987 bot.webpushr.com — Cisco Umbrella Rank: 38172 analytics.webpushr.com — Cisco Umbrella Rank: 31122	26 KB
6	stripe.com js.stripe.com — Cisco Umbrella Rank: 894 q.stripe.com — Cisco Umbrella Rank: 5856 m.stripe.com — Cisco Umbrella Rank: 854	71 KB
5	google.de adservice.google.de — Cisco Umbrella Rank: 8832 www.google.de — Cisco Umbrella Rank: 6433	2 KB
4	redintelligence.net hal9000.redintelligence.net — Cisco Umbrella Rank: 28803 hal900030.redintelligence.net — Cisco Umbrella Rank: 184522	6 KB
4	mathtag.com tags.mathtag.com — Cisco Umbrella Rank: 2892 pixel.mathtag.com — Cisco Umbrella Rank: 1093	3 KB
4	pubmatic.com 4 redirects image6.pubmatic.com — Cisco Umbrella Rank: 571	2 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 31	20 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 124	197 KB
3	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 101 partner.googleadservices.com — Cisco Umbrella Rank: 716	17 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 54	164 KB
2	rlcdn.com 2 redirects id.rlcdn.com — Cisco Umbrella Rank: 565	888 B
2	rubiconproject.com 2 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 289	920 B
2	openx.net rtb.openx.net — Cisco Umbrella Rank: 1359	415 B
2	addthis.com 2 redirects e.dlx.addthis.com — Cisco Umbrella Rank: 1530	1 KB
2	quantserve.com 1 redirects cms.quantserve.com — Cisco Umbrella Rank: 929	793 B
2	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 147	73 KB
2	stripe.network m.stripe.network — Cisco Umbrella Rank: 948	16 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 96	315 B
1	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 246	46 KB
1	bing.com 1 redirects c.bing.com — Cisco Umbrella Rank: 193	557 B
1	agkn.com 1 redirects d.agkn.com — Cisco Umbrella Rank: 492	759 B
1	innovid.com ag.innovid.com — Cisco Umbrella Rank: 1391	296 B
1	zoho.com crm.zoho.com — Cisco Umbrella Rank: 40093	4 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 620	21 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1207	5 KB
1	amazonaws.com edm-image.s3.us-west-2.amazonaws.com	10 KB
1	gravatar.com secure.gravatar.com — Cisco Umbrella Rank: 1619	2 KB
1	gstatic.com fonts.gstatic.com	44 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	2 KB
213	35

	Domain	Requested by
78	cisomag.eccouncil.org	cisomag.eccouncil.org static.cloudflareinsights.com
14	s1.adform.net	track.adform.net s1.adform.net cisomag.eccouncil.org
12	pagead2.googlesyndication.com	cisomag.eccouncil.org pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com
10	cm.g.doubleclick.net	cisomag.eccouncil.org googleads.g.doubleclick.net
10	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
9	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net
7	www.google.com	2 redirects cisomag.eccouncil.org googleads.g.doubleclick.net tpc.googlesyndication.com
4	track.adform.net	hal900030.redintelligence.net s1.adform.net
4	image6.pubmatic.com	4 redirects
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com cisomag.eccouncil.org
4	k.clarity.ms	www.clarity.ms k.clarity.ms
4	connect.facebook.net	cisomag.eccouncil.org connect.facebook.net
3	hal900030.redintelligence.net	hal9000.redintelligence.net hal900030.redintelligence.net
3	tags.mathtag.com	googleads.g.doubleclick.net tags.mathtag.com
3	analytics.webpushr.com	cdn.webpushr.com
3	www.google.de	cisomag.eccouncil.org
3	www.eccouncil.org	cisomag.eccouncil.org
3	www.googletagmanager.com	cisomag.eccouncil.org www.googletagmanager.com
3	js.stripe.com	cisomag.eccouncil.org js.stripe.com
2	c.clarity.ms	1 redirects
2	id.rlcdn.com	2 redirects
2	pixel.rubiconproject.com	2 redirects
2	rtb.openx.net	googleads.g.doubleclick.net
2	e.dlx.addthis.com	2 redirects
2	cms.quantserve.com	1 redirects googleads.g.doubleclick.net
2	www.googletagservices.com	googleads.g.doubleclick.net
2	m.stripe.network	js.stripe.com m.stripe.network
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	q.stripe.com	cisomag.eccouncil.org
2	cdn.webpushr.com	cisomag.eccouncil.org
2	www.facebook.com	cisomag.eccouncil.org
2	www.googleadservices.com	www.googletagmanager.com www.googleadservices.com
1	s0.2mdn.net	s1.adform.net
1	c.bing.com	1 redirects
1	d.agkn.com	1 redirects
1	pixel.mathtag.com	tags.mathtag.com
1	hal9000.redintelligence.net	cisomag.eccouncil.org
1	ag.innovid.com	googleads.g.doubleclick.net
1	bot.webpushr.com	cdn.webpushr.com
1	crm.zoho.com	edm-image.s3.us-west-2.amazonaws.com
1	maxcdn.bootstrapcdn.com	edm-image.s3.us-west-2.amazonaws.com
1	m.stripe.com	m.stripe.network
1	stats.g.doubleclick.net	www.google-analytics.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	static.cloudflareinsights.com	cisomag.eccouncil.org
1	edm-image.s3.us-west-2.amazonaws.com	cisomag.eccouncil.org
1	secure.gravatar.com	cisomag.eccouncil.org
1	fonts.gstatic.com	fonts.googleapis.com
1	www.clarity.ms	cisomag.eccouncil.org
1	fonts.googleapis.com	cisomag.eccouncil.org
213	51

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
www.linkedin.com
events.cisomag.com
iclass.eccouncil.org
www.eccu.edu
ciso.eccouncil.org
www.eccouncil.org
twitter.com
plus.google.com
pinterest.com
expresso.pt
therecord.media
amedia.no
api.whatsapp.com
reddit.com
www.attivonetworks.com
www.instagram.com
www.youtube.com
www.webpushr.com

Subject Issuer	Validity	Valid
cisomag.eccouncil.org Cloudflare Inc ECC CA-3	`2021-09-16` - `2022-09-15`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA	`2022-01-26` - `2022-05-04`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-12-31` - `2022-03-31`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
eccouncil.org Cloudflare Inc ECC CA-3	`2021-09-23` - `2022-09-22`	a year	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2022-02-27` - `2023-02-27`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
*.s3-us-west-2.amazonaws.com Amazon	`2021-12-17` - `2022-11-29`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-06-11` - `2022-06-10`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
a.clarity.ms Microsoft RSA TLS CA 01	`2021-07-27` - `2022-07-27`	a year	crt.sh
*.webpushr.com Sectigo RSA Domain Validation Secure Server CA	`2021-05-17` - `2022-05-17`	a year	crt.sh
*.stripe.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-11` - `2022-06-09`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1	`2022-01-11` - `2022-05-04`	4 months	crt.sh
*.zoho.com Sectigo RSA Domain Validation Secure Server CA	`2021-05-14` - `2022-05-14`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.innovid.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2022-03-15` - `2023-04-15`	a year	crt.sh
*.mathtag.com DigiCert SHA2 Secure Server CA	`2020-04-15` - `2022-04-22`	2 years	crt.sh
redintelligence.net R3	`2022-01-27` - `2022-04-27`	3 months	crt.sh
pixel.mathtag.com DigiCert SHA2 Secure Server CA	`2021-06-29` - `2022-07-07`	a year	crt.sh
track.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2021-09-06` - `2022-10-07`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-02-28` - `2022-05-23`	3 months	crt.sh

This page contains 17 frames:

Primary Page: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/
Frame ID: 89F4F0DD5B522ABED791507DC3DDD52C
Requests: 133 HTTP requests in this frame

Frame: https://edm-image.s3.us-west-2.amazonaws.com/Forms/CISOMAG/Subscribe_Newsletter.html
Frame ID: 77E562886C6A3AE07780184F43C5FCD8
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20190131/zrt_lookup.html
Frame ID: BD9AA44F62E70C974575065BCE1C2484
Requests: 1 HTTP requests in this frame

Frame: https://js.stripe.com/v3/m-outer-9fe86c29346daf61dc2cc0586b4fad18.html
Frame ID: EC6B2EBA557354E1C2F5A32DB63ADAFB
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5389645983523610&output=html&adk=1812271804&adf=3025194257&lmt=1648087782&plat=1%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648087781935&bpp=4&bdt=624&idt=259&shv=r20220317&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=920607142486&frm=20&pv=2&ga_vid=1897234737.1648087782&ga_sid=1648087782&ga_hid=1917416453&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C21066435&oid=2&pvsid=1823385132476362&pem=654&tmod=805977650&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=278
Frame ID: 5D982E278FFDDA0D48CE646C3503B23C
Requests: 1 HTTP requests in this frame

Frame: https://m.stripe.network/inner.html
Frame ID: 6F6E4D18845432326C2B6C72BEADDEF2
Requests: 4 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 5D2E495AC9D7399A49561DBE98B3F13E
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5389645983523610&output=html&h=600&adk=595182048&adf=572165612&pi=t.aa~a.2242084310~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1648087783&rafmt=1&to=qs&pwprc=1353055134&psa=0&format=300x600&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648087783147&bpp=3&bdt=1835&idt=3&shv=r20220317&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D54a2b546abe038e9-22a9422963cd0063%3AT%3D1648087783%3ART%3D1648087783%3AS%3DALNI_MZBsL2ywRIPRIM4lxzm3l0DC0GJVg&prev_fmts=0x0&nras=2&correlator=920607142486&frm=20&pv=1&ga_vid=1897234737.1648087782&ga_sid=1648087782&ga_hid=1917416453&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=991&ady=1565&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C21066435&oid=2&pvsid=1823385132476362&pem=654&tmod=805977650&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=0BAjZ7FgDq&p=https%3A//cisomag.eccouncil.org&dtd=25
Frame ID: 5C4363403B8BA92893738B35C2085EF2
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1
Frame ID: A5C70A192B2C0B553B185AFBA27D301A
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 41C3FC4EDB3D06B47A684A8DFC4F105F
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 2EFBB0A03CA46DAE2D4EEA5BD071F1F3
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Guojae3EGYR4c8nOY3QAJp6N_HyMY3qMC8IMY_l3vL8.js
Frame ID: 30562820A1F848839EB88D2157DA93F4
Requests: 1 HTTP requests in this frame

Frame: https://hal900030.redintelligence.net/request_content.php?s=89055100012235204380388011908030&a=b7ec1e84
Frame ID: 6B1811D6C8EDD88456DB403FE32BA334
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 76E419E84124D0014188C274E6FC0FA6
Requests: 9 HTTP requests in this frame

Frame: https://s1.adform.net/Banners/Elements/Files/160090/10998790/10998790.js?ADFassetID=10998790&bv=258
Frame ID: 85D4D8EA847BF4EC431FC08EF902247C
Requests: 13 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 182FC83F173C06F8D29279A2D18C2D08
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: CF733F65579588BD2485EF0514278FE6
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Lapsus$ Ransomware Targets Media Firms in Portugal

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

Stripe (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

js\.stripe\.com

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

213
Requests

94 %
HTTPS

50 %
IPv6

35
Domains

51
Subdomains

43
IPs

7
Countries

2975 kB
Transfer

7235 kB
Size

56
Cookies

31 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/CISOMAG/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/ciso-mag/

Search URL Search Domain Scan URL

URL: https://events.cisomag.com/
Title: Upcoming Events

Search URL Search Domain Scan URL

URL: https://events.cisomag.com/E-Events/E-Events.html
Title: E-Events

Search URL Search Domain Scan URL

URL: https://iclass.eccouncil.org/live-course-schedule/
Title: Masterclass

Search URL Search Domain Scan URL

URL: https://www.eccu.edu/?utm_source=CISOMAG&utm_medium=Homepage

Search URL Search Domain Scan URL

URL: https://ciso.eccouncil.org/?utm_source=CISOMag&utm_medium=Referral&utm_campaign=CCISO_Banner

Search URL Search Domain Scan URL

URL: https://www.eccouncil.org/campaigns/ceh/certified-ethical-hacking-wahs/?utm_source=ceh-wahs&utm_medium=organic&utm_campaign=ceh-wahs-promotion2021

Search URL Search Domain Scan URL

URL: https://iclass.eccouncil.org/web-application-hacking-and-security/?utm_source=cisomag&utm_medium=banner

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Lapsus%24+Ransomware+Targets+Media+Firms+in+Portugal&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&via=CISOMAG
Title: Twitter

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/button/?url=https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/&media=https://cisomag.eccouncil.org/wp-content/uploads/2021/12/MicrosoftTeams-image-44.png

Search URL Search Domain Scan URL

URL: https://expresso.pt/expresso/um-site-provisorio-e-uma-promessa-liberdadeparainformar/
Title: release

Search URL Search Domain Scan URL

URL: https://therecord.media/lapsus-ransomware-gang-hits-sic-portugals-largest-tv-channel/
Title: reportedly

Search URL Search Domain Scan URL

URL: https://amedia.no/aktuelt/nyheter/item/amedia-utsatt-for-et-alvorlig-dataangrep
Title: news release

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?via=CISOMAG&text=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&title=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal%20https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F

Search URL Search Domain Scan URL

URL: https://reddit.com/submit?url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&title=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal

Search URL Search Domain Scan URL

URL: https://www.attivonetworks.com/product/adassessor/?utm_source=cisomag&utm_medium=publisher&utm_campaign=adassessor&utm_content=banner

Search URL Search Domain Scan URL

URL: https://www.facebook.com/CISOMAG

Search URL Search Domain Scan URL

URL: https://twitter.com/CISOMAG

Search URL Search Domain Scan URL

URL: https://www.instagram.com/cisomag/?hl=en

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/64258501/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCiWa1jcQfB-wQT7U1M8lVmA

Search URL Search Domain Scan URL

URL: https://www.eccouncil.org/terms-of-use/
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.eccouncil.org/privacy-statement/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.eccouncil.org/privacy-statement
Title: privacy policy

Search URL Search Domain Scan URL

URL: https://www.webpushr.com/
Title: Webpushr

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 114

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/663406144/?random=1772130356&cv=9&fst=1648087782138&num=1&value=0&label=0U39CI6Zv-cBEMCMq7wC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&tiba=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal&auid=247296780.1648087782&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=59I7Ys7kA-DH7_UP3OaNmAI&sscte=1&crd=&eitems=ChEI8IrrkQYQu8HowrjHjonYARIdAFyJ0g-IFC7Fq5ELVI1oFLxvAesnIruI6dSfjag HTTP 302
https://www.google.com/pagead/1p-conversion/663406144/?random=1772130356&cv=9&fst=1648087782138&num=1&value=0&label=0U39CI6Zv-cBEMCMq7wC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&tiba=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal&auid=247296780.1648087782&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=59I7Ys7kA-DH7_UP3OaNmAI&cid=CAQSKQCNIrLMz909mbscsdK-Pq0QIFHagYNIyfAhZlXF34HhheI-Phx48Fy-&eitems=ChEI8IrrkQYQu8HowrjHjonYARIdAFyJ0g8-YW9faf6Moa5OOrH9jb0lPua6AnKnreo&random=3078726978&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-conversion/663406144/?random=1772130356&cv=9&fst=1648087782138&num=1&value=0&label=0U39CI6Zv-cBEMCMq7wC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&tiba=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal&auid=247296780.1648087782&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=59I7Ys7kA-DH7_UP3OaNmAI&cid=CAQSKQCNIrLMz909mbscsdK-Pq0QIFHagYNIyfAhZlXF34HhheI-Phx48Fy-&eitems=ChEI8IrrkQYQu8HowrjHjonYARIdAFyJ0g8-YW9faf6Moa5OOrH9jb0lPua6AnKnreo&random=3078726978&resp=GooglemKTybQhCsO&ipr=y&prhg=0

Request Chain 138

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPK3DQPMhwBskfsfEaXG2p3jxFmaxKznmRB_MP2VZuWkuq98jy_cnkUzhVRM059G5DeE5cUv5jzVjxsQvBlpeJyWPOoihoZW&google_gid=CAESENGnjleLDZmQR8ZlKVwdPH4&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPK3DQPMhwBskfsfEaXG2p3jxFmaxKznmRB_MP2VZuWkuq98jy_cnkUzhVRM059G5DeE5cUv5jzVjxsQvBlpeJyWPOoihoZW&google_gid=CAESENGnjleLDZmQR8ZlKVwdPH4&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAzMjQwMjA5NDQwMDAzMzYwODI2MTY4NA%3D%3D&google_push=AYg5qPK3DQPMhwBskfsfEaXG2p3jxFmaxKznmRB_MP2VZuWkuq98jy_cnkUzhVRM059G5DeE5cUv5jzVjxsQvBlpeJyWPOoihoZW

Request Chain 140

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEEjZqM9btGdjEdoDtIozKS4&google_cver=1&google_push=AYg5qPJdS6u5IUfQ2B2f-N8ZcH3DDFk6bWqYnBMpRvNN61i7yZqbQyb7PR5QGXD9ZLu643RIOfwvBka57j1bK5z8Qy2RN11dTp-GbQ HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEEjZqM9btGdjEdoDtIozKS4&google_cver=1&google_push=AYg5qPJdS6u5IUfQ2B2f-N8ZcH3DDFk6bWqYnBMpRvNN61i7yZqbQyb7PR5QGXD9ZLu643RIOfwvBka57j1bK5z8Qy2RN11dTp-GbQ&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=hqWg6X58QhybsoQi71_M7A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJdS6u5IUfQ2B2f-N8ZcH3DDFk6bWqYnBMpRvNN61i7yZqbQyb7PR5QGXD9ZLu643RIOfwvBka57j1bK5z8Qy2RN11dTp-GbQ

Request Chain 141

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEGQrQ-znpmzoAXevz-GOXT0&google_cver=1&google_push=AYg5qPKrUeQGkrZKClI8L-fI1kmU_ZtT_fRv5lCjoGJNdnyNvgX7IGihRuoqgmHzDksUQmYc2mXyjMi1P9F5-OvbfYP3Z_6hY2x5BA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDE0Q1dYMkYtNi00U0tB&google_push=AYg5qPKrUeQGkrZKClI8L-fI1kmU_ZtT_fRv5lCjoGJNdnyNvgX7IGihRuoqgmHzDksUQmYc2mXyjMi1P9F5-OvbfYP3Z_6hY2x5BA

Request Chain 142

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1

Request Chain 145

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 166

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENF6GpEfVfpteea5PlBhAc8&google_cver=1&google_push=AYg5qPL7Dk63LTSEMyTM6IFK7N9a70uXVTbS9mpM0tfSSQOza06Dwe0C0SWr02zoBsnzvHD8mymdSK7qC6F9qDq8KyraQfoaM8Q HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPL7Dk63LTSEMyTM6IFK7N9a70uXVTbS9mpM0tfSSQOza06Dwe0C0SWr02zoBsnzvHD8mymdSK7qC6F9qDq8KyraQfoaM8Q&google_hm=hSPdnUdu8r9OPIaQQHIpyw

Request Chain 167

https://d.agkn.com/pixel/2175/?google_gid=CAESEEUaEnUJ0rhwY8IZAHPYPi4&google_cver=1&google_push=AYg5qPLvGBQGYE7x3vvfRkMlAxK3xfaaIRB7G5tJmT2hLp5cixabUXL1AznCtjOy3N1FOcOlx4_LQfN-LiH2krQmLdrelNGUhc4e HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLvGBQGYE7x3vvfRkMlAxK3xfaaIRB7G5tJmT2hLp5cixabUXL1AznCtjOy3N1FOcOlx4_LQfN-LiH2krQmLdrelNGUhc4e&google_hm=Q0FFU0VFVWFFblVKMHJod1k4SVpBSFBZUGk0

Request Chain 168

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPJhLme5ZAB4KZMWDDHKXKsHDX9MKyhsb3HXcRaTrC8ozs4XbkRtBPFx3KHcDGx68IqxX7CUNln1apmP9XIeUoKLCjHzSoUz&google_gid=CAESEEX4ON6Gw5vC-NFFvsig4dg&google_cver=1 HTTP 307
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCOil75EGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BWWc1cVBKaExtZTVaQUI0S1pNV0RESEtYS3NIRFg5TUt5aHNiM0hYY1JhVHJDOG96czRYYmtSdEJQRngzS0hjREd4NjhJcXhYN0NVTmxuMWFwbVA5WEllVW9LTENqSHpTb1V6 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwU21EWVpaV1Y2OEpVQlFwTEpZeWRQVUNycW5qV1FSNlZXdGcxVUd3MUV5aw==&google_push

Request Chain 170

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEEjZqM9btGdjEdoDtIozKS4&google_cver=1&google_push=AYg5qPLrXyHv_FvKTWqWFrHoX0aRPY0wOadvzoJ8Gn6Mm_913NRjVXhirnX0_35uMQJU7beDAzZ1aPXBW_kVPZb6gMh8Pb6vt5SK HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEEjZqM9btGdjEdoDtIozKS4&google_cver=1&google_push=AYg5qPLrXyHv_FvKTWqWFrHoX0aRPY0wOadvzoJ8Gn6Mm_913NRjVXhirnX0_35uMQJU7beDAzZ1aPXBW_kVPZb6gMh8Pb6vt5SK&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=LFhfxxk4QS2AYP6Hm7r9pg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLrXyHv_FvKTWqWFrHoX0aRPY0wOadvzoJ8Gn6Mm_913NRjVXhirnX0_35uMQJU7beDAzZ1aPXBW_kVPZb6gMh8Pb6vt5SK

Request Chain 171

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEGQrQ-znpmzoAXevz-GOXT0&google_cver=1&google_push=AYg5qPLRdFn6gGr4qKx64STjGj1CvCYxAXvZBx368ntfWwh4QM9avXpl-ycMN6IkMBW-A-Zjc3o1wMGYZ-WK-24b7Ir8GNCgqYpr HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDE0Q1dYREMtMVEtNFVIMQ==&google_push=AYg5qPLRdFn6gGr4qKx64STjGj1CvCYxAXvZBx368ntfWwh4QM9avXpl-ycMN6IkMBW-A-Zjc3o1wMGYZ-WK-24b7Ir8GNCgqYpr

Request Chain 172

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1

Request Chain 180

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?CtsSyncId=6346B796BC0947DF893E86D242639494&RedC=c.clarity.ms&MXFR=32B4E06AD2E667CF14D2F11BD6E669F1 HTTP 302
https://c.clarity.ms/c.gif?CtsSyncId=6346B796BC0947DF893E86D242639494&MUID=3AF6E30D6E6E6D093109F27C6FBC6CDB

213 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/ 202 KB
39 KB 1155ms
1121ms Document
text/html 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a13e32124150faa27576464b1c089cb0d080e8acb4b0a885958b31af7cb3d5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Thu, 24 Mar 2022 02:09:41 GMT
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
expires: Thu, 19 Nov 1981 08:52:00 GMT
link: <https://cisomag.eccouncil.org/?p=25728>; rel=shortlink
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
ki-cache-type: None
ki-cf-cache-status: BYPASS
ki-edge: v=17.2
ki-edge-o2o: yes
pragma: no-cache
referrer-policy: strict-origin
x-content-type-options: nosniff
x-edge-location-klb: 1
x-frame-options: SAMEORIGIN
x-kinsta-cache: MISS
x-xss-protection: 1; mode=block
server: cloudflare
cf-ray: 6f0bddb65bc86903-FRA
content-encoding: br

GET
H2 200 style.min.css
cisomag.eccouncil.org/wp-includes/css/dist/block-library/ 77 KB
11 KB 30ms
29ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-includes/css/dist/block-library/style.min.css?ver=5.9

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b6fef0a63424245b31b293b1a3bfd074c9da482e28fb9e920e1cf306e54e8a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2999438
vary: Accept-Encoding
ki-edge-o2o: yes
last-modified: Thu, 17 Feb 2022 08:31:02 GMT
server: cloudflare
etag: W/"620e07c6-1357b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd79636903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 unslider.css
cisomag.eccouncil.org/wp-content/plugins/advanced-ads-slider/public/assets/css/ 573 B
300 B 33ms
31ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/advanced-ads-slider/public/assets/css/unslider.css?ver=1.4.6

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0b779ad590272d25a6b625b33f3d117b71ab8b77efa8266cf2ebcd90bd76764

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2042307
vary: Accept-Encoding
last-modified: Fri, 01 May 2020 07:23:19 GMT
server: cloudflare
etag: W/"5eabce67-23d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd79656903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 slider.css
cisomag.eccouncil.org/wp-content/plugins/advanced-ads-slider/public/assets/css/ 633 B
384 B 29ms
26ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/advanced-ads-slider/public/assets/css/slider.css?ver=1.4.6

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ba97ba1c19f2b4c430ab98de4ff03de245d37d94bb79df1839922c543754fee4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 4987983
vary: Accept-Encoding
ki-edge-o2o: yes
last-modified: Fri, 01 May 2020 07:23:19 GMT
server: cloudflare
etag: W/"5eabce67-279"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd79676903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 amazonpolly-public.css
cisomag.eccouncil.org/wp-content/plugins/amazon-polly/public/css/ 1 KB
482 B 29ms
26ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/amazon-polly/public/css/amazonpolly-public.css?ver=1.0.0

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e5166861862f7dca0bae810d00a45407760215b70b90696b74b485e27938948d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2373379
vary: Accept-Encoding
last-modified: Fri, 25 Jun 2021 05:31:22 GMT
server: cloudflare
etag: W/"60d56a2a-417"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd79696903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 cookie-law-info-public.css
cisomag.eccouncil.org/wp-content/plugins/cookie-law-info/public/css/ 3 KB
1010 B 30ms
27ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=2.1.1

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 1958896
vary: Accept-Encoding
last-modified: Tue, 01 Mar 2022 09:56:31 GMT
server: cloudflare
etag: W/"621dedcf-c22"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd796a6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 cookie-law-info-gdpr.css
cisomag.eccouncil.org/wp-content/plugins/cookie-law-info/public/css/ 27 KB
5 KB 36ms
33ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.1.1

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.1
age: 527540
vary: Accept-Encoding
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Tue, 01 Mar 2022 09:56:31 GMT
server: cloudflare
etag: W/"621dedcf-6a71"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: None
cf-ray: 6f0bddbd796b6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 edd.min.css
cisomag.eccouncil.org/wp-content/plugins/easy-digital-downloads/templates/ 19 KB
4 KB 31ms
28ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/easy-digital-downloads/templates/edd.min.css?ver=2.11.5

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab50f8066522a61b5d0a09db2469e41ae60f7461936f8e32283cc8f8bfd93ce2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2042307
vary: Accept-Encoding
ki-edge-o2o: yes
last-modified: Tue, 01 Feb 2022 09:36:38 GMT
server: cloudflare
etag: W/"61f8ff26-4d8a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd796d6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 style.css
cisomag.eccouncil.org/wp-content/plugins/td-api-plugin/css/ 3 KB
625 B 38ms
35ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/td-api-plugin/css/style.css?ver=5.9

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccc1920ce012472744e6a3ffa7284d794088f3133f839be088c426d35a31b091

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2999438
vary: Accept-Encoding
ki-edge-o2o: yes
last-modified: Mon, 07 Oct 2019 13:23:29 GMT
server: cloudflare
etag: W/"5d9b3c51-b96"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd796e6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 style.min.css
cisomag.eccouncil.org/wp-content/plugins/edd-free-downloads/assets/css/ 2 KB
860 B 26ms
24ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/edd-free-downloads/assets/css/style.min.css?ver=2.3.10

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

24ef39cf7f17ee8fa232e3c50c5f93f7c695b046ef58ad45c32c01c5085b8ac8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 4988128
vary: Accept-Encoding
last-modified: Mon, 08 Mar 2021 05:54:10 GMT
server: cloudflare
etag: W/"6045bc02-835"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd796f6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 styles.css
cisomag.eccouncil.org/wp-content/plugins/edd-recurring/assets/css/ 255 B
253 B 27ms
24ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/edd-recurring/assets/css/styles.css?ver=2.11.6

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d43ffb22deff8ce9564230837e4c37889fbc4aaa93bca189b9b0bc6de0e88535

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 3088752
vary: Accept-Encoding
ki-edge-o2o: yes
last-modified: Wed, 16 Feb 2022 07:36:48 GMT
server: cloudflare
etag: W/"620ca990-ff"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd79706903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 css
fonts.googleapis.com/ 23 KB
2 KB 135ms
47ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A300%2C400%2C600%2C700%7CRoboto+Condensed%3A300%2C300italic%2C400%2C400italic%2C700%2C700italic&ver=4.0

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9684120c94e7edc0d21be2fa3eae6ef577a1b73df8a3708e830bc033d2496ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 24 Mar 2022 02:09:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 24 Mar 2022 02:09:42 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 24 Mar 2022 02:09:42 GMT

GET
H2 200 sassy-social-share-public.css
cisomag.eccouncil.org/wp-content/plugins/sassy-social-share/public/css/ 9 KB
2 KB 29ms
26ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/sassy-social-share/public/css/sassy-social-share-public.css?ver=3.3.39

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87e1ed8c94d134e4e068a17891d3dad0d122ee052bf061da0ca0e87b3da75069

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.0
age: 669598
vary: Accept-Encoding
last-modified: Wed, 16 Mar 2022 08:05:41 GMT
server: cloudflare
etag: W/"62319a55-25e4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: CDN
cf-ray: 6f0bddbd89716903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 js_composer.min.css
cisomag.eccouncil.org/wp-content/plugins/js_composer/assets/css/ 451 KB
46 KB 35ms
33ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=5.2

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

68365b839627184be94436665af992cc018cd9b54d642036ae490f82c7629fea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2042307
vary: Accept-Encoding
ki-edge-o2o: yes
last-modified: Mon, 07 Oct 2019 13:23:53 GMT
server: cloudflare
etag: W/"5d9b3c69-70db0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd89726903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 style.css
cisomag.eccouncil.org/wp-content/themes/Newsmag/ 712 KB
87 KB 40ms
38ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/themes/Newsmag/style.css?ver=4.0

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b568b710853272aca9b7edde1eafaec680e6aa1ba58b503e214b4aca75ed300d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 5078987
vary: Accept-Encoding
ki-edge-o2o: yes
last-modified: Mon, 07 Oct 2019 13:23:11 GMT
server: cloudflare
etag: W/"5d9b3c3f-b1fdf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd89736903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 jquery.min.js Show response
cisomag.eccouncil.org/wp-includes/js/jquery/ 87 KB
31 KB 30ms
28ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2367136
vary: Accept-Encoding
last-modified: Tue, 24 Aug 2021 08:43:32 GMT
server: cloudflare
etag: W/"6124b134-15db1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd89746903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 jquery-migrate.min.js Show response
cisomag.eccouncil.org/wp-includes/js/jquery/ 11 KB
4 KB 32ms
31ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2336932
vary: Accept-Encoding
last-modified: Fri, 25 Jun 2021 05:33:02 GMT
server: cloudflare
etag: W/"60d56a8e-2bd8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd89766903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 unslider.min.js Show response
cisomag.eccouncil.org/wp-content/plugins/advanced-ads-slider/public/assets/js/ 6 KB
2 KB 34ms
32ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/advanced-ads-slider/public/assets/js/unslider.min.js?ver=1.4.6

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9bcfcdf3913076194efc851a76c4686fd0f4c336ee09e5739ab31590eb13eaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 5078987
vary: Accept-Encoding
ki-edge-o2o: yes
last-modified: Fri, 01 May 2020 07:23:19 GMT
server: cloudflare
etag: W/"5eabce67-1754"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd89776903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 jquery.event.move.js Show response
cisomag.eccouncil.org/wp-content/plugins/advanced-ads-slider/public/assets/js/ 14 KB
4 KB 28ms
27ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/advanced-ads-slider/public/assets/js/jquery.event.move.js?ver=1.4.6

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

99e5c1acabc069482cebd649fbf00052363f2b735d3cc409b30280513631a975

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2042307
vary: Accept-Encoding
last-modified: Fri, 01 May 2020 07:23:19 GMT
server: cloudflare
etag: W/"5eabce67-3680"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd89786903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 jquery.event.swipe.js Show response
cisomag.eccouncil.org/wp-content/plugins/advanced-ads-slider/public/assets/js/ 3 KB
1 KB 30ms
29ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/advanced-ads-slider/public/assets/js/jquery.event.swipe.js?ver=1.4.6

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e11dab3cfc05ecc63598d96f74d91ee015bc2636a28b12fc0a4e465f717fca6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2336899
vary: Accept-Encoding
last-modified: Fri, 01 May 2020 07:23:19 GMT
server: cloudflare
etag: W/"5eabce67-d6d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd89796903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 amazonpolly-public.js Show response
cisomag.eccouncil.org/wp-content/plugins/amazon-polly/public/js/ 210 B
227 B 38ms
37ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/amazon-polly/public/js/amazonpolly-public.js?ver=1.0.0

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d28401c309de2ee15d69288f6d8a89bba4a5491d094aca5822a2e7033d5b40a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2373379
vary: Accept-Encoding
last-modified: Fri, 25 Jun 2021 05:31:22 GMT
server: cloudflare
etag: W/"60d56a2a-d2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbd897a6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 wp-emoji-release.min.js Show response
cisomag.eccouncil.org/wp-includes/js/ 18 KB
5 KB 21ms
21ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-includes/js/wp-emoji-release.min.js?ver=5.9

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2999437
vary: Accept-Encoding
last-modified: Tue, 24 Aug 2021 08:43:32 GMT
server: cloudflare
etag: W/"6124b134-4705"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbde9ce6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 cookie-law-info-public.js Show response
cisomag.eccouncil.org/wp-content/plugins/cookie-law-info/public/js/ 34 KB
8 KB 25ms
24ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=2.1.1

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c106f968e6dae4cc1049fd8205860cbd57eba3b59803c5688a1f417b57d9b65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.1
age: 419885
vary: Accept-Encoding
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Tue, 01 Mar 2022 09:56:31 GMT
server: cloudflare
etag: W/"621dedcf-88fd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: None
cf-ray: 6f0bddbe9a566903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 cookie-law-info-ccpa.js Show response
cisomag.eccouncil.org/wp-content/plugins/cookie-law-info/admin/modules/ccpa/assets/js/ 7 KB
2 KB 23ms
21ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/cookie-law-info/admin/modules/ccpa/assets/js/cookie-law-info-ccpa.js?ver=2.1.1

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

08a25c504f8eff948a2911d660c1b12ef89c3fb8f3d57216facebebd6303b75e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 1958896
vary: Accept-Encoding
ki-edge-o2o: yes
last-modified: Tue, 01 Mar 2022 09:56:31 GMT
server: cloudflare
etag: W/"621dedcf-1ca0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbe9a576903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 advanced.min.js Show response
cisomag.eccouncil.org/wp-content/plugins/advanced-ads/public/assets/js/ 10 KB
4 KB 25ms
24ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/advanced-ads/public/assets/js/advanced.min.js?ver=1.32.0

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f5ef63bcd883c3e6ecca9a17785b10ee897b51aec76328706887ceb220742d71

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.0
age: 1276536
vary: Accept-Encoding
last-modified: Wed, 09 Mar 2022 05:31:44 GMT
server: cloudflare
etag: W/"62283bc0-29e9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: CDN
cf-ray: 6f0bddbe9a596903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 conditions.min.js Show response
cisomag.eccouncil.org/wp-content/plugins/advanced-ads-pro/modules/advanced-visitor-conditions/inc/ 1 KB
549 B 35ms
34ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/advanced-ads-pro/modules/advanced-visitor-conditions/inc/conditions.min.js?ver=2.16.1

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a095d43a6cb207c855ca0b8d70d314f6454e5358b1cf4cf2e9dae378e33e3c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.0
age: 1276536
vary: Accept-Encoding
last-modified: Wed, 09 Mar 2022 05:31:47 GMT
server: cloudflare
etag: W/"62283bc3-475"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: None
cf-ray: 6f0bddbe9a5a6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 / Show response
js.stripe.com/v3/ 287 KB
68 KB 54ms
8ms Script
application/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/?ver=v3

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

8c605f66a0310731c5322544cb0a5e52f1c9bf52b83f73dbe772f7f72bd89d46

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 33
x-cache: HIT
content-length: 69482
etag: "c87c9303c52f7eddd6d54396169b563b"
x-request-id: 2f85e8f4-327d-4f22-9609-e09e246b2a2d
x-served-by: cache-hhn4057-HHN
access-control-allow-origin: *
last-modified: Wed, 23 Mar 2022 19:06:03 GMT
server: Fastly
date: Thu, 24 Mar 2022 02:09:42 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 1

GET
H2 200 sdk.js Show response
connect.facebook.net/en_GB/ 3 KB
2 KB 49ms
16ms Script
application/x-javascript 2a03:2880:f008:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/sdk.js

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f008:8:face:b00c:0:1 Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

033364ca2f218c52b61b1fa024ddfdbcc837b186cf51b0169e03ccd23ad08241

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://cisomag.eccouncil.org/
Origin: https://cisomag.eccouncil.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: YSpNTwdeuPFB9eMrJGxUSA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
expires: Thu, 24 Mar 2022 02:11:24 GMT
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 1685
x-fb-rlafr: 0
x-fb-debug: njCSQ59HemsiaG+i0nNACS5Vy6V64I7P6u6kcwGh0Wc98CCJVkpc1TMmQG0gRkpBxULKal9aDTosFTqfDA82hg==
x-fb-trip-id: 19638678
x-fb-content-md5: 922a72d24125b8b82e87949bcbd01388
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Thu, 24 Mar 2022 02:09:42 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "35724e28c491c17ecbdbfc469dfdacde"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 100 KB
40 KB 138ms
53ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-663406144

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d5ad9bc33b3dd6ba0c9bd9239e3db5bdff0e38da468e445871b2a2af39e92602

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40662
x-xss-protection: 0
last-modified: Thu, 24 Mar 2022 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 24 Mar 2022 02:09:42 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 157 KB
54 KB 168ms
66ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5389645983523610

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

10a61bfe990a105dbc8d0d0112db142f8ab6d241b7152ac27ec9561063aabe62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cisomag.eccouncil.org/
Origin: https://cisomag.eccouncil.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54810
x-xss-protection: 0
server: cafe
etag: 4519311019414692113
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 24 Mar 2022 02:09:42 GMT

GET
H2 200 CISOMAG-logo-web-01.png
cisomag.eccouncil.org/wp-content/uploads/2020/05/ 2 KB
2 KB 23ms
19ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2020/05/CISOMAG-logo-web-01.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0107265e0f85bb9a3c2f2b2bc23504054c4765ab9d2fcaeb071031d08bd2fcf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.0
age: 1601545
cf-polished: origFmt=png, origSize=3146
content-disposition: inline; filename="CISOMAG-logo-web-01.webp"
vary: Accept
content-length: 1554
last-modified: Tue, 26 May 2020 07:30:23 GMT
server: cloudflare
etag: "5eccc58f-c4a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddbf2ac16903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 CISOMAG-logo-mobile-01-1.png
cisomag.eccouncil.org/wp-content/uploads/2020/05/ 1 KB
2 KB 33ms
28ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2020/05/CISOMAG-logo-mobile-01-1.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9bd0c27bb3606a8810394992e283c170264b7ccea383b9e106d8b6e1c7da7b98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2297008
cf-polished: origFmt=png, origSize=3118
content-disposition: inline; filename="CISOMAG-logo-mobile-01-1.webp"
vary: Accept
content-length: 1510
last-modified: Tue, 26 May 2020 07:33:34 GMT
server: cloudflare
etag: "5eccc64e-c2e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddbf2ac26903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 MicrosoftTeams-image-32-180x135.png
cisomag.eccouncil.org/wp-content/uploads/2021/09/ 30 KB
30 KB 33ms
29ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2021/09/MicrosoftTeams-image-32-180x135.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f88dfe831ccc016202ea3d7dd889f7a8d25a69697b9cd6833b5d77fb5ad4a045

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.0
age: 761946
cf-polished: origFmt=png, origSize=46098
content-disposition: inline; filename="MicrosoftTeams-image-32-180x135.webp"
vary: Accept
content-length: 30962
ki-edge-o2o: yes
last-modified: Thu, 23 Sep 2021 09:58:45 GMT
server: cloudflare
etag: "614c4fd5-b412"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddbf2ac36903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 MicrosoftTeams-image-67-180x135.png
cisomag.eccouncil.org/wp-content/uploads/2022/01/ 29 KB
29 KB 34ms
30ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2022/01/MicrosoftTeams-image-67-180x135.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

294186e196b3b12bc2e593d33af7eea7a27f9b6d4a08633ea80a6f23d6ae3db4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.1
age: 393050
cf-polished: origFmt=png, origSize=38526
content-disposition: inline; filename="MicrosoftTeams-image-67-180x135.webp"
vary: Accept
content-length: 29618
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Tue, 11 Jan 2022 13:48:26 GMT
server: cloudflare
etag: "61dd8aaa-967e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddbf2ac56903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 MicrosoftTeams-image-68-180x135.png
cisomag.eccouncil.org/wp-content/uploads/2022/01/ 15 KB
16 KB 31ms
27ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2022/01/MicrosoftTeams-image-68-180x135.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

16a5e055995684816b73c0b147ccdea1386297a26e364f4f61823576dee24373

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2043889
cf-polished: origFmt=png, origSize=27309
content-disposition: inline; filename="MicrosoftTeams-image-68-180x135.webp"
vary: Accept
content-length: 15850
ki-edge-o2o: yes
last-modified: Tue, 18 Jan 2022 12:51:30 GMT
server: cloudflare
etag: "61e6b7d2-6aad"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddbf2ac76903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 MicrosoftTeams-image-64-180x135.png
cisomag.eccouncil.org/wp-content/uploads/2022/01/ 31 KB
32 KB 38ms
33ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2022/01/MicrosoftTeams-image-64-180x135.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2517ed987b0f85e3960214d2ec118e8560c8e27118d8c7edf88442c8fad20666

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.1
age: 156850
cf-polished: origFmt=png, origSize=49041
content-disposition: inline; filename="MicrosoftTeams-image-64-180x135.webp"
vary: Accept
content-length: 32064
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Tue, 04 Jan 2022 11:29:48 GMT
server: cloudflare
etag: "61d42fac-bf91"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddbf2ac96903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 Untitled-design_page-0001-180x135.jpg
cisomag.eccouncil.org/wp-content/uploads/2021/08/ 7 KB
7 KB 27ms
23ms Image
image/jpeg 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2021/08/Untitled-design_page-0001-180x135.jpg

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea7d15d7ef0e6ed4931f4affb4435f0b9841aedf7921b3062fc164366709d6b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2043889
cf-polished: origSize=7465, status=webp_bigger
vary: Accept-Encoding
content-length: 7329
last-modified: Mon, 09 Aug 2021 11:06:05 GMT
server: cloudflare
etag: "61110c1d-1d29"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddbf2aca6903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 MicrosoftTeams-image-44-640x414.png
cisomag.eccouncil.org/wp-content/uploads/2021/12/ 474 KB
474 KB 1310ms
1306ms Image
image/png 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2021/12/MicrosoftTeams-image-44-640x414.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7bf30893ab2583b731daf314725d1826f17ab53f79692aa4341dfd73dd837cf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:43 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
ki-edge: v=17.2
vary: Accept-Encoding
content-length: 484910
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Wed, 29 Dec 2021 12:05:02 GMT
server: cloudflare
etag: "61cc4eee-7662e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddbf2acb6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:43 GMT

GET
H2 200 MicrosoftTeams-image-32-238x178.png
cisomag.eccouncil.org/wp-content/uploads/2021/09/ 49 KB
49 KB 35ms
31ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2021/09/MicrosoftTeams-image-32-238x178.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5473a164aafa7ecc5f460aa98783c9dbb93a4ee14b26ae67371b35b3e80ecd77

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.0
age: 1504788
cf-polished: origFmt=png, origSize=74501
content-disposition: inline; filename="MicrosoftTeams-image-32-238x178.webp"
vary: Accept
content-length: 50074
last-modified: Thu, 23 Sep 2021 09:58:45 GMT
server: cloudflare
etag: "614c4fd5-12305"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 6f0bddbf2acc6903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 shutterstock_614528966-238x178.jpg
cisomag.eccouncil.org/wp-content/uploads/2019/09/ 6 KB
6 KB 872ms
868ms Image
image/jpeg 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2019/09/shutterstock_614528966-238x178.jpg

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f2dec2e920659c69349f62714f6787d276a678e4c6abd5ffd0358b3e63822b89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:43 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
ki-edge: v=17.2
vary: Accept-Encoding
content-length: 6050
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Mon, 07 Oct 2019 13:18:31 GMT
server: cloudflare
etag: "5d9b3b27-17a2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddbf2acd6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:43 GMT

GET
H2 200 remote-working-238x178.jpg
cisomag.eccouncil.org/wp-content/uploads/2020/06/ 11 KB
11 KB 1089ms
1085ms Image
image/jpeg 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2020/06/remote-working-238x178.jpg

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f5d3fca890c5088c347837a3d7a81a789f5355c9311d822d74b2ce5ae0188a5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:43 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
ki-edge: v=17.2
vary: Accept-Encoding
content-length: 11084
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Fri, 26 Jun 2020 12:58:39 GMT
server: cloudflare
etag: "5ef5f0ff-2b4c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddbf2ace6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:43 GMT

GET
H2 200 AD-Security-Assessment_250x250.png
cisomag.eccouncil.org/wp-content/uploads/2022/02/ 39 KB
39 KB 1305ms
1302ms Image
image/png 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2022/02/AD-Security-Assessment_250x250.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

89d4f658329103c87d0a7947554eeca3a1870ad6553aebf803cc3ba95c8df900

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:43 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
ki-edge: v=17.2
vary: Accept-Encoding
content-length: 39746
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Sun, 06 Feb 2022 07:52:54 GMT
server: cloudflare
etag: "61ff7e56-9b42"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddbf2acf6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:43 GMT

GET
H2 200 telegram-2.png
www.eccouncil.org/wp-content/uploads/2021/01/ 3 KB
3 KB 62ms
29ms Image
image/webp 2606:4700::6812:14fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.eccouncil.org/wp-content/uploads/2021/01/telegram-2.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:14fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

283c7fca0fd51ba6a039bc52964d9437d6c70d5acbbe5914ed03baf862ebb33f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2044215
cf-polished: origFmt=png, origSize=7417
content-disposition: inline; filename="telegram-2.webp"
vary: Accept
content-length: 3002
last-modified: Wed, 20 Jan 2021 09:46:18 GMT
server: cloudflare
etag: "6007fbea-1cf9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddbf59929950-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 signal.png
www.eccouncil.org/wp-content/uploads/2021/01/ 4 KB
5 KB 63ms
30ms Image
image/webp 2606:4700::6812:14fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.eccouncil.org/wp-content/uploads/2021/01/signal.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:14fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e4186ff3ad26e431005946d778ce135cae8848aa9dd5b9621088c7d9a1d240f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.1
age: 530948
cf-polished: origFmt=png, origSize=11105
content-disposition: inline; filename="signal.webp"
vary: Accept
content-length: 4420
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Wed, 20 Jan 2021 08:06:34 GMT
server: cloudflare
etag: "6007e48a-2b61"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddbf59949950-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 Industrial-cybersecurity-341x220.jpg
cisomag.eccouncil.org/wp-content/uploads/2017/12/ 22 KB
22 KB 23ms
19ms Image
image/jpeg 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2017/12/Industrial-cybersecurity-341x220.jpg

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4d2e71a0ad264f5771dcb6b62a0881a13b8f5816773736acc81c97dfb4e113cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2397559
cf-polished: origSize=32856, status=webp_bigger
vary: Accept-Encoding
content-length: 22064
last-modified: Mon, 07 Oct 2019 13:21:54 GMT
server: cloudflare
etag: "5d9b3bf2-8058"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddbf2ad16903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 Dta-breah-80x60.jpg
cisomag.eccouncil.org/wp-content/uploads/2017/11/ 2 KB
2 KB 34ms
30ms Image
image/jpeg 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2017/11/Dta-breah-80x60.jpg

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

047cbba843c378da640821f15d741ef2798bfb234561b821ffd0af0451fb984a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2297009
cf-polished: origSize=11382, status=webp_bigger
vary: Accept-Encoding
content-length: 2287
last-modified: Mon, 07 Oct 2019 13:22:00 GMT
server: cloudflare
etag: "5d9b3bf8-2c76"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddbf2ad46903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 Messaging-80x60.jpg
cisomag.eccouncil.org/wp-content/uploads/2017/10/ 2 KB
3 KB 22ms
19ms Image
image/jpeg 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2017/10/Messaging-80x60.jpg

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d713e38998ee7560803152a137b6d4fddc4ebf3c1d722682f704296c396213f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.1
age: 384784
cf-polished: origSize=10460, status=webp_bigger
vary: Accept-Encoding
content-length: 2293
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Mon, 07 Oct 2019 13:22:17 GMT
server: cloudflare
etag: "5d9b3c09-28dc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddbf2ad76903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 Kaspersky-80x60.jpg
cisomag.eccouncil.org/wp-content/uploads/2017/10/ 2 KB
2 KB 25ms
22ms Image
image/jpeg 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2017/10/Kaspersky-80x60.jpg

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

158b085cf5649aeab1a6eebc3e36622220a89b73d3c9e4636d2d1f0b7a143de5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2399337
cf-polished: status=not_needed
vary: Accept-Encoding
content-length: 2280
last-modified: Mon, 07 Oct 2019 13:22:17 GMT
server: cloudflare
etag: "5d9b3c09-8e8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddbf2ada6903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 shutterstock_665858467-80x60.jpg
cisomag.eccouncil.org/wp-content/uploads/2019/05/ 2 KB
2 KB 28ms
25ms Image
image/jpeg 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2019/05/shutterstock_665858467-80x60.jpg

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a51c9ce1efb20a3dc89036e6c4b25cca908f28534fffbba1248815049f8d66ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2913354
cf-polished: status=not_needed
vary: Accept-Encoding
content-length: 1971
last-modified: Mon, 07 Oct 2019 13:19:14 GMT
server: cloudflare
etag: "5d9b3b52-7b3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddbf2adb6903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 MicrosoftTeams-image-32-100x75.png
cisomag.eccouncil.org/wp-content/uploads/2021/09/ 11 KB
11 KB 25ms
22ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2021/09/MicrosoftTeams-image-32-100x75.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

320eb1bf4d98037277d8146477dfad0b3bb19a8a690fe9b3d97605829848f811

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.0
age: 1192955
cf-polished: origFmt=png, origSize=16472
content-disposition: inline; filename="MicrosoftTeams-image-32-100x75.webp"
vary: Accept
content-length: 11512
last-modified: Thu, 23 Sep 2021 09:58:45 GMT
server: cloudflare
etag: "614c4fd5-4058"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
ki-cache-type: CDN
accept-ranges: bytes
cf-ray: 6f0bddbf2add6903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 MicrosoftTeams-image-67-100x75.png
cisomag.eccouncil.org/wp-content/uploads/2022/01/ 13 KB
13 KB 23ms
21ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2022/01/MicrosoftTeams-image-67-100x75.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e50a033612979635c9fffef9a64c41e260471d4d0cf3e17416466549b8211e6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2043889
cf-polished: origFmt=png, origSize=16154
content-disposition: inline; filename="MicrosoftTeams-image-67-100x75.webp"
vary: Accept
content-length: 13034
last-modified: Tue, 11 Jan 2022 13:48:25 GMT
server: cloudflare
etag: "61dd8aa9-3f1a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddbf2ade6903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 MicrosoftTeams-image-68-100x75.png
cisomag.eccouncil.org/wp-content/uploads/2022/01/ 6 KB
6 KB 30ms
27ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2022/01/MicrosoftTeams-image-68-100x75.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e426eb2679335b3474f1afb08c5413329d9cf00ee607c0d80e63a2f40e36928

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.1
age: 516069
cf-polished: origFmt=png, origSize=10589
content-disposition: inline; filename="MicrosoftTeams-image-68-100x75.webp"
vary: Accept
content-length: 6018
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Tue, 18 Jan 2022 12:51:30 GMT
server: cloudflare
etag: "61e6b7d2-295d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddbf2adf6903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 MicrosoftTeams-image-64-100x75.png
cisomag.eccouncil.org/wp-content/uploads/2022/01/ 18 KB
18 KB 1078ms
1076ms Image
image/png 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2022/01/MicrosoftTeams-image-64-100x75.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cb2e72c0113261872a070ac9a80ddf18e79c88f5dab37c389659047339ffe415

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:43 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
ki-edge: v=17.2
vary: Accept-Encoding
content-length: 18124
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Tue, 04 Jan 2022 11:29:48 GMT
server: cloudflare
etag: "61d42fac-46cc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddbf3ae66903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:43 GMT

GET
H2 200 shutterstock_614528966-100x75.jpg
cisomag.eccouncil.org/wp-content/uploads/2019/09/ 2 KB
2 KB 28ms
26ms Image
image/jpeg 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2019/09/shutterstock_614528966-100x75.jpg

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9bc1390aab3dc237db61d65ee187f0ce80390b040289ebb3f99e909005a26aee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2397559
cf-polished: status=not_needed
vary: Accept-Encoding
content-length: 1940
last-modified: Mon, 07 Oct 2019 13:18:31 GMT
server: cloudflare
etag: "5d9b3b27-794"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddbf3ae76903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 CISOMAG-Logo.png
cisomag.eccouncil.org/wp-content/uploads/2020/05/ 2 KB
2 KB 35ms
33ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2020/05/CISOMAG-Logo.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

06d0aabd08299b17ba9f3d2c0d764ef04203d5bb91abdf8c9afea54506c8cc4e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2043000
cf-polished: origFmt=png, origSize=3087
content-disposition: inline; filename="CISOMAG-Logo.webp"
vary: Accept
content-length: 1624
ki-edge-o2o: yes
last-modified: Tue, 26 May 2020 07:36:35 GMT
server: cloudflare
etag: "5eccc703-c0f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddbf3ae96903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 email-decode.min.js Show response
cisomag.eccouncil.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
830 B 9ms
8ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 21 Mar 2022 14:13:59 GMT
server: cloudflare
etag: W/"62388827-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6f0bddbeda836903-FRA
vary: Accept-Encoding
expires: Sat, 26 Mar 2022 02:09:42 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 164 KB
60 KB 169ms
105ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KK9FGHN

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cc07c6aa8bd99f3ecbbd42a343876f4112ba870744c300d4e38694345720b14f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 61804
x-xss-protection: 0
last-modified: Thu, 24 Mar 2022 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 24 Mar 2022 02:09:42 GMT

GET
H2 200 48pbph9uo8 Show response
www.clarity.ms/tag/ 1 KB
1 KB 217ms
138ms Script
application/x-javascript 2620:1ec:27::cafe:2154
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/48pbph9uo8
Requested by: Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:27::cafe:2154 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 40a2ad629fb927a5b9ad0a0a1cb9171767d1eb2dec4b53b6a0f1ba1a2256a8db

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-powered-by: ASP.NET
x-azure-ref: 05tI7YgAAAAApvlK+iEILSJohmGZ1gs81Uk9NMzBFREdFMDcxOAA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
expires: -1
cache-control: no-cache, no-store
request-context: appId=cid-v1:e97341f6-8fff-46a6-9229-fbbfe0892c78

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
27 KB 52ms
17ms Script
application/x-javascript 2a03:2880:f008:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f008:8:face:b00c:0:1 Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3e18d0e3dd548e9745884578e3cd9f0a492ddbb6f3b797db364b45bb16cadfb3

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26320
x-xss-protection: 0
pragma: public
x-fb-debug: gW1rcR4OQE+W1jnekf2ra2ee6iEU6JL8VoAPoDkhQ94GNDKsdkGzSQjIwtG2ShMiuOkatmYrDPm2+yF3z8adLg==
x-fb-trip-id: 19638678
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Thu, 24 Mar 2022 02:09:42 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 newsmag.woff
cisomag.eccouncil.org/wp-content/themes/Newsmag/images/icons/ 14 KB
10 KB 32ms
30ms Font
application/font-woff 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/themes/Newsmag/images/icons/newsmag.woff?12

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/wp-content/themes/Newsmag/style.css?ver=4.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a63e53abfd30cc5be7558678f3137aaa45dfe79e3577299ad027f259b81d50f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cisomag.eccouncil.org/wp-content/themes/Newsmag/style.css?ver=4.0
Origin: https://cisomag.eccouncil.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2336898
vary: Accept-Encoding
ki-edge-o2o: yes
last-modified: Mon, 07 Oct 2019 13:23:19 GMT
server: cloudflare
etag: W/"5d9b3c47-36dc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddbf4afb6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 sdk.js Show response
connect.facebook.net/en_GB/ 283 KB
81 KB 16ms
15ms Script
application/x-javascript 2a03:2880:f008:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/sdk.js?hash=3bf85dba450f250d6fcf2e8dda0fc744

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f008:8:face:b00c:0:1 Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

121821e0a9fc4f76a3363ee0bb163acc739778c131796cacd4db91fe213d5863

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://cisomag.eccouncil.org/
Origin: https://cisomag.eccouncil.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: R2rMp5l4zJZJAVEOC+GOQA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
expires: Fri, 24 Mar 2023 00:51:18 GMT
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 82679
x-fb-rlafr: 0
x-fb-debug: SYl/UEOBFr2YsmSKrbF/LUGb3ZiQpU82pS7bYuI2ejzHhoMlDeGC7FHK2uiSWk6Bd0/1Y1DARfXvZvHG7VyCOQ==
x-fb-trip-id: 19638678
x-fb-content-md5: 441aa137e871deacb321a4bcf6c9b62c
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Thu, 24 Mar 2022 02:09:42 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "fdef4e4314ce4fe70c70d918300c8655"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v28/ 44 KB
44 KB 123ms
37ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v28/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A300%2C400%2C600%2C700%7CRoboto+Condensed%3A300%2C300italic%2C400%2C400italic%2C700%2C700italic&ver=4.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://cisomag.eccouncil.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 22 Mar 2022 22:45:07 GMT
x-content-type-options: nosniff
age: 98675
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44656
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 22:03:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Mar 2023 22:45:07 GMT

GET
H2 200 elements.png
cisomag.eccouncil.org/wp-content/themes/Newsmag/images/sprite/ 5 KB
5 KB 860ms
859ms Image
image/png 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/themes/Newsmag/images/sprite/elements.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/wp-content/themes/Newsmag/style.css?ver=4.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b31639b1784eda51185ea2f620d531c1654d00790ce5ac16f333a88e23785d44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/wp-content/themes/Newsmag/style.css?ver=4.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:43 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
ki-edge: v=17.2
vary: Accept-Encoding
content-length: 4875
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Mon, 07 Oct 2019 13:23:17 GMT
server: cloudflare
etag: "5d9b3c45-130b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddbffbb86903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:43 GMT

GET
H2 200 c4f890a429ef48bd19a7300d8907cd2d
secure.gravatar.com/avatar/ 1 KB
2 KB 28ms
6ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/c4f890a429ef48bd19a7300d8907cd2d?s=96&d=mm&r=g
Requested by: Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 67f565f25c1bb8ae629cfca60c71766232073a0c905e0387e45895657b4ae3e7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Thu, 24 Mar 2022 02:09:42 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="c4f890a429ef48bd19a7300d8907cd2d.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/c4f890a429ef48bd19a7300d8907cd2d?s=96&d=mm&r=g>; rel="canonical"
content-length: 1528
expires: Thu, 24 Mar 2022 02:14:42 GMT

GET
H/1.1 200
OK Subscribe_Newsletter.html Show response
edm-image.s3.us-west-2.amazonaws.com/Forms/CISOMAG/ Frame 77E5 10 KB
10 KB 933ms
189ms Document
text/html 52.218.241.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://edm-image.s3.us-west-2.amazonaws.com/Forms/CISOMAG/Subscribe_Newsletter.html
Requested by: Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.218.241.113 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-west-2-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 33a75ecf080349c89c1db47ced291d404c84222defbd7cf4882529bd4e2e0a89

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/

Response headers

x-amz-id-2: AEB3i3UAxm5cNG6aUwt2+x+IVGkNlQNzk/Pa4OmzO7s63gNH53kT6JMkRUQOzeZgTuz6isJEgX8=
x-amz-request-id: H9PWZ2CFRAHAR209
Date: Thu, 24 Mar 2022 02:09:44 GMT
Last-Modified: Tue, 15 Dec 2020 06:48:40 GMT
ETag: "87a54b2fc9d58ee37612fca173209c33"
x-amz-meta-sha256: 33a75ecf080349c89c1db47ced291d404c84222defbd7cf4882529bd4e2e0a89
x-amz-meta-s3b-last-modified: 20201215T064823Z
Accept-Ranges: bytes
Content-Type: text/html
Server: AmazonS3
Content-Length: 10237

GET
H3 200 602260080361950 Show response
connect.facebook.net/signals/config/ 307 KB
87 KB 91ms
74ms Script
application/x-javascript 2a03:2880:f008:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/602260080361950?v=2.9.57&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f008:8:face:b00c:0:1 Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7436c03d88ecc34823dc52f9ca7f42001e22fc9b98f62fe251f44d89ae30ad0e

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: ceD9d2rHhHgFC7lBI0HGqi4X0N6nC1hKy2MriGqh0uthrrnp6b9uM0OrAuzdcD+mK/pdJhdf/6gevlPKQS1hRQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 24 Mar 2022 02:09:42 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 Whatsapp-form-banner-bg.jpg
www.eccouncil.org/wp-content/uploads/2020/09/ 19 KB
19 KB 16ms
16ms Image
image/webp 2606:4700::6812:14fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.eccouncil.org/wp-content/uploads/2020/09/Whatsapp-form-banner-bg.jpg

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:14fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9733263ec42a91a96f3e3c92136dc6f8d5e04008a257eb898258e31078552fd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.1
age: 184920
cf-polished: origFmt=jpeg, origSize=53379
content-disposition: inline; filename="Whatsapp-form-banner-bg.webp"
vary: Accept
content-length: 19628
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Wed, 09 Sep 2020 18:35:05 GMT
server: cloudflare
etag: "5f592059-d083"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddc09a819950-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 MicrosoftTeams-image-32-300x160.png
cisomag.eccouncil.org/wp-content/uploads/2021/09/ 55 KB
55 KB 24ms
23ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2021/09/MicrosoftTeams-image-32-300x160.png

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

795d0e0a8e07f46c426e332229226ef1511dd296b16d04f36e5bf8d8af5be7f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2043889
cf-polished: origFmt=png, origSize=84270
content-disposition: inline; filename="MicrosoftTeams-image-32-300x160.webp"
vary: Accept
content-length: 56208
last-modified: Thu, 23 Sep 2021 09:58:46 GMT
server: cloudflare
etag: "614c4fd6-1492e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:42 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddc0dc646903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 cookie-law-info-table.css
cisomag.eccouncil.org/wp-content/plugins/cookie-law-info/public/css/ 6 KB
2 KB 24ms
24ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-table.css?ver=2.1.1

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e2f2336b5e6698b628afc75fa9a24c67b73d5872c1d4af99ca436064f636ee0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 1958896
vary: Accept-Encoding
last-modified: Tue, 01 Mar 2022 09:56:31 GMT
server: cloudflare
etag: W/"621dedcf-17e1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddc0ec666903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 shortcodes.css
cisomag.eccouncil.org/wp-content/plugins/shortcodes-ultimate/includes/css/ 45 KB
8 KB 23ms
22ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/shortcodes-ultimate/includes/css/shortcodes.css?ver=5.12.0

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

568de4a237f78930c495806b9302c91df36f7212ee5af1cc6d9f4abc3ff03b38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 4411426
vary: Accept-Encoding
ki-edge-o2o: yes
last-modified: Tue, 25 Jan 2022 12:22:47 GMT
server: cloudflare
etag: W/"61efeb97-b202"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddc0ec6c6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 magnific-popup.css
cisomag.eccouncil.org/wp-content/plugins/shortcodes-ultimate/vendor/magnific-popup/ 7 KB
2 KB 25ms
24ms Stylesheet
text/css 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/shortcodes-ultimate/vendor/magnific-popup/magnific-popup.css?ver=1.1.0

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a44e537eb0dfe0dfdb3a7ab134b25790c6f99e33436bf603e879598ec164a9fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 16397359
vary: Accept-Encoding
last-modified: Wed, 18 Aug 2021 05:43:12 GMT
server: cloudflare
etag: W/"611c9df0-1b26"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddc0ec6d6903-FRA
x-edge-location-klb: MX0Wo5kYdYrjb5DKwJQxavN89cbd7364e29f4d4c1ed3b0712c97b732
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 edd-ajax.min.js Show response
cisomag.eccouncil.org/wp-content/plugins/easy-digital-downloads/assets/js/ 11 KB
3 KB 33ms
32ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/easy-digital-downloads/assets/js/edd-ajax.min.js?ver=2.11.5

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

15baaac08e167c266f986bc1045fa6945ea8b81c7d8d0330bdb8d2218aaefaa3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 4378524
vary: Accept-Encoding
last-modified: Tue, 01 Feb 2022 09:36:38 GMT
server: cloudflare
etag: W/"61f8ff26-2b5a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddc0ec6e6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 script.js Show response
cisomag.eccouncil.org/wp-content/plugins/advanced-ads-responsive/public/assets/js/ 3 KB
1 KB 35ms
33ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/advanced-ads-responsive/public/assets/js/script.js?ver=1.10.2

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5841eb6d1895c740317d98a4cd9e5aeced865f5c50182647401afc3d303367e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 16397358
vary: Accept-Encoding
last-modified: Thu, 15 Jul 2021 05:53:38 GMT
server: cloudflare
etag: W/"60efcd62-b92"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddc0ec6f6903-FRA
x-edge-location-klb: MX0Wo5kYdYrjb5DKwJQxavN8dd71fb4a2a9c4be2723068eaffdf3043
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 sticky.js Show response
cisomag.eccouncil.org/wp-content/plugins/advanced-ads-sticky-ads/public/assets/js/ 6 KB
2 KB 33ms
32ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/advanced-ads-sticky-ads/public/assets/js/sticky.js?ver=1.8.3

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8503c041e7f21942aa95fcd5992a29989cb49116d3cb3bf096455658498417a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.2
age: 19306
vary: Accept-Encoding
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Tue, 01 Mar 2022 09:56:28 GMT
server: cloudflare
etag: W/"621dedcc-171a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: None
cf-ray: 6f0bddc0ec706903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 isMobile.min.js Show response
cisomag.eccouncil.org/wp-content/plugins/edd-free-downloads/assets/js/ 1 KB
703 B 35ms
32ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/edd-free-downloads/assets/js/isMobile.min.js

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6fb48fb14effad0669f76a000a143d22e573dfa4135844fc8b20faac9869c359

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2336898
vary: Accept-Encoding
ki-edge-o2o: yes
last-modified: Mon, 08 Mar 2021 05:54:10 GMT
server: cloudflare
etag: W/"6045bc02-542"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddc0ec716903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 edd-free-downloads.min.js Show response
cisomag.eccouncil.org/wp-content/plugins/edd-free-downloads/assets/js/ 12 KB
3 KB 21ms
19ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/edd-free-downloads/assets/js/edd-free-downloads.min.js?ver=2.3.10

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

40d2dfa80fa7e4f556716c48267ced327c7282f4fd1c064d08ca192afa916ce6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.1
age: 527539
vary: Accept-Encoding
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Mon, 08 Mar 2021 05:54:10 GMT
server: cloudflare
etag: W/"6045bc02-31f7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: None
cf-ray: 6f0bddc0ec726903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 advanced-ads-pro.min.js Show response
cisomag.eccouncil.org/wp-content/plugins/advanced-ads-pro/assets/js/ 6 KB
2 KB 33ms
31ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/advanced-ads-pro/assets/js/advanced-ads-pro.min.js?ver=2.16.1

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

308c252b2381b887baf74268990c582643dbdaad9e9b332d158112745e2c65ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.0
age: 1276535
vary: Accept-Encoding
ki-edge-o2o: yes
last-modified: Wed, 09 Mar 2022 05:31:47 GMT
server: cloudflare
etag: W/"62283bc3-1620"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: None
cf-ray: 6f0bddc0ec746903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 tagdiv_theme.min.js Show response
cisomag.eccouncil.org/wp-content/themes/Newsmag/js/ 198 KB
48 KB 25ms
23ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/themes/Newsmag/js/tagdiv_theme.min.js?ver=4.0

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e06b5eee99f8b2417fab514f4d881ec0c604da462047b3393c6b864cf4a5f281

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2042306
vary: Accept-Encoding
last-modified: Mon, 07 Oct 2019 13:23:12 GMT
server: cloudflare
etag: W/"5d9b3c40-319cd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddc0ec756903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 sassy-social-share-public.js Show response
cisomag.eccouncil.org/wp-content/plugins/sassy-social-share/public/js/ 119 KB
40 KB 28ms
26ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/sassy-social-share/public/js/sassy-social-share-public.js?ver=3.3.39

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a28f7b51eecc453bfa4b7794290a3d75918d3983ec835f0089b5a92d90ba9961

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.0
age: 669597
vary: Accept-Encoding
last-modified: Wed, 16 Mar 2022 08:05:41 GMT
server: cloudflare
etag: W/"62319a55-1dbb3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: CDN
cf-ray: 6f0bddc0ec776903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 base.min.js Show response
cisomag.eccouncil.org/wp-content/plugins/advanced-ads-pro/assets/js/ 71 KB
24 KB 24ms
22ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/advanced-ads-pro/assets/js/base.min.js?ver=2.16.1

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d674e200ded2c7f1e23125a7400f7a9b5426ca81cff20301d2298ff33e32d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.0
age: 1276535
vary: Accept-Encoding
ki-edge-o2o: yes
last-modified: Wed, 09 Mar 2022 05:31:47 GMT
server: cloudflare
etag: W/"62283bc3-11dd7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: None
cf-ray: 6f0bddc0ec786903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 tracking.min.js Show response
cisomag.eccouncil.org/wp-content/plugins/advanced-ads-tracking/public/assets/js/dist/ 9 KB
3 KB 19ms
18ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/advanced-ads-tracking/public/assets/js/dist/tracking.min.js?ver=2.2.0

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d13be2720157b939b505b2b217e9caf2ed4c20d831c47add20497c2fafe81bc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2373378
vary: Accept-Encoding
last-modified: Tue, 08 Feb 2022 06:33:49 GMT
server: cloudflare
etag: W/"62020ecd-24f5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddc0ec796903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 delayed.min.js Show response
cisomag.eccouncil.org/wp-content/plugins/advanced-ads-tracking/public/assets/js/dist/ 877 B
510 B 17ms
16ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/advanced-ads-tracking/public/assets/js/dist/delayed.min.js?ver=2.2.0

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

68de28ccd005c586a59c9a5c0653400886add03ab352219edb4b8651782d5e09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2336898
vary: Accept-Encoding
last-modified: Tue, 08 Feb 2022 06:33:49 GMT
server: cloudflare
etag: W/"62020ecd-36d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddc0ec7a6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 magnific-popup.js Show response
cisomag.eccouncil.org/wp-content/plugins/shortcodes-ultimate/vendor/magnific-popup/ 20 KB
7 KB 21ms
20ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/shortcodes-ultimate/vendor/magnific-popup/magnific-popup.js?ver=1.1.0

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc7109dd6428c821842660a87bda6494e52c0f4ecad22105a1aed87e440ee0b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 4984432
vary: Accept-Encoding
last-modified: Tue, 30 Nov 2021 09:01:02 GMT
server: cloudflare
etag: W/"61a5e84e-4f29"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddc0ec7d6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 index.js Show response
cisomag.eccouncil.org/wp-content/plugins/shortcodes-ultimate/includes/js/shortcodes/ 12 KB
4 KB 21ms
20ms Script
application/javascript 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/plugins/shortcodes-ultimate/includes/js/shortcodes/index.js?ver=5.12.0

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

860d562b0a45cb007e7a669dc845cc85bec45a5229c67ddc3b11534ff54a9947

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2373378
vary: Accept-Encoding
last-modified: Tue, 25 Jan 2022 12:22:47 GMT
server: cloudflare
etag: W/"61efeb97-2fa3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=315360000
cf-ray: 6f0bddc0ec7e6903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:42 GMT

GET
H2 200 v652eace1692a40cfa3763df669d7439c1639079717194 Show response
static.cloudflareinsights.com/beacon.min.js/ 14 KB
5 KB 79ms
43ms Script
text/javascript 2606:4700:440e::ac40:9c1a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by: Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:440e::ac40:9c1a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Referer: https://cisomag.eccouncil.org/
Origin: https://cisomag.eccouncil.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: gzip
last-modified: Thu, 09 Dec 2021 19:55:17 GMT
server: cloudflare
etag: W/2021.12.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 6f0bddc128e59049-FRA

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 39 KB
15 KB 147ms
58ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-663406144

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

00359d552170386e0f9dc362a2a48ad8da908f6263810b28eb26348073b70bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14884
x-xss-protection: 0
server: cafe
etag: 4198181851688197673
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 24 Mar 2022 02:09:42 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203170101/ 297 KB
107 KB 117ms
70ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203170101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-5389645983523610&plah=cisomag.eccouncil.org

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5389645983523610

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

44a86990defb06123c1ece0ce9cc6acfd9a774e0c7de45044740782c63faab4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 109609
x-xss-protection: 0
server: cafe
etag: 6761351631689794261
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 24 Mar 2022 02:09:42 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220317/r20190131/ Frame BD9A 10 KB
5 KB 125ms
38ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220317/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5389645983523610

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ce5fc08d0f617e71e1d61bcd79fc7cc1855f4221945b0c09ac774685fe7f52c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4502
x-xss-protection: 0
date: Wed, 23 Mar 2022 23:16:13 GMT
expires: Wed, 06 Apr 2022 23:16:13 GMT
cache-control: public, max-age=1209600
age: 10409
etag: 4044455266028820542
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 clarity.js Show response
k.clarity.ms/s/0.6.31/ 52 KB
23 KB 522ms
96ms Script
application/javascript 20.96.88.162
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://k.clarity.ms/s/0.6.31/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/48pbph9uo8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.96.88.162 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b2d2f11eb78159e31bce4355ffd5e696717de4270a77ba1d2038e066462008ad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
etag: "1d83d55ecb15000"
last-modified: Mon, 21 Mar 2022 19:00:26 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
accept-ranges: bytes
request-context: appId=cid-v1:e97341f6-8fff-46a6-9229-fbbfe0892c78

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 172 KB
63 KB 100ms
56ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-F0G4XCSHDL&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-663406144

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e67d55911edfcdd789d23e24d733d3aa2c59d05833ce7bc9247cebc5dcfdc932

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64678
x-xss-protection: 0
expires: Thu, 24 Mar 2022 02:09:42 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 127ms
38ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KK9FGHN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 296
date: Thu, 24 Mar 2022 02:04:46 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 24 Mar 2022 04:04:46 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 49ms
17ms Image
image/gif 2a03:2880:f108:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=602260080361950&ev=PageView&dl=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&rl=&if=false&ts=1648087782012&sw=1600&sh=1200&v=2.9.57&r=stable&ec=0&o=30&fbp=fb.1.1648087782010.1311288717&it=1648087781815&coo=false&rqm=GET

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f108:83:face:b00c:0:25de Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Thu, 24 Mar 2022 02:09:42 GMT

GET
H2 200 app.min.js Show response
cdn.webpushr.com/ 39 KB
12 KB 34ms
8ms Script
application/javascript 167.71.57.196
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.webpushr.com/app.min.js
Requested by: Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 167.71.57.196 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: 39e3b7a575958736f4307accdfc7243a4aac7f0342bd12bb0743e7a0932546df

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: gzip
last-modified: Sat, 01 Jan 2022 18:51:18 GMT
server: nginx/1.16.1
etag: W/"61d0a2a6-9bef"
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/javascript
x-gg-cache-status: HIT, HIT
cache-control: max-age=86400
expires: Fri, 25 Mar 2022 02:09:42 GMT

GET
H2 200 m-outer-9fe86c29346daf61dc2cc0586b4fad18.html Show response
js.stripe.com/v3/ Frame EC6B 240 B
550 B 7ms
7ms Document
text/html 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/m-outer-9fe86c29346daf61dc2cc0586b4fad18.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/?ver=v3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

1dda2cecb8f0322c2b59a817ac9d9fa234b3792ff094b1a401b3862d3cf157dc

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; base-uri 'none'; form-action 'none'; connect-src 'self' https://r.stripe.com; script-src 'self'; style-src 'self'; frame-src https://m.stripe.network; img-src https://q.stripe.com; font-src 'none'; media-src 'none'; object-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/

Response headers

last-modified: Fri, 11 Mar 2022 19:55:40 GMT
etag: "9fe86c29346daf61dc2cc0586b4fad18"
cache-control: max-age=31536000
content-type: text/html; charset=utf-8
content-security-policy: default-src 'self'; base-uri 'none'; form-action 'none'; connect-src 'self' https://r.stripe.com; script-src 'self'; style-src 'self'; frame-src https://m.stripe.network; img-src https://q.stripe.com; font-src 'none'; media-src 'none'; object-src 'none'; report-uri https://q.stripe.com/csp-report
strict-transport-security: max-age=31556926; includeSubDomains; preload
x-content-type-options: nosniff
access-control-allow-origin: *
server: Fastly
content-encoding: br
accept-ranges: bytes
date: Thu, 24 Mar 2022 02:09:42 GMT
via: 1.1 varnish
age: 613763
x-request-id: cc8b0b65-74c7-48d5-a23b-e94d365d6bac
x-served-by: cache-hhn4057-HHN
x-cache: HIT
x-cache-hits: 286571
vary: Accept-Encoding
timing-allow-origin: *
content-length: 140

POST
H2 200 csp-report
q.stripe.com/ Frame EC6B 0
358 B 533ms
180ms Other
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://q.stripe.com/csp-report
Requested by: Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ip-54-187-159-182.stripe.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://js.stripe.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 24 Mar 2022 02:09:43 GMT
server: nginx
access-control-max-age: 3600
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://js.stripe.com
access-control-expose-headers: Server, Range, Content-Type
x-envoy-upstream-service-time: 12
access-control-allow-headers: Authorization, Content-Type, Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since, Range, X-Stripe-Csrf-Token
content-length: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/663406144/ 2 KB
1 KB 96ms
50ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/663406144/?random=1648087782093&cv=9&fst=1648087782093&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&tiba=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50db2fcba1fd4bc39fd9d6775ef218de3ddd7ff91295bd01de8f3915b605dab0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1084
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/663406144/ 2 KB
1 KB 316ms
72ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/663406144/?random=1648087782138&cv=9&fst=1648087782138&num=1&value=0&label=0U39CI6Zv-cBEMCMq7wC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&tiba=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal&auid=247296780.1648087782&hn=www.googleadservices.com&bttype=purchase&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

249038a22111db8b37283b8339cd4e702170a872a7ee2df525069b5d3711766b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1262
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 234 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0d7cd639c89358f19d898c0f407c362e22f9f3efb8f419bb35ede15d184daa71

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf8

GET
H2 200 m-outer-7345858512d328389831b5c353d30a99.js Show response
js.stripe.com/v3/fingerprinted/js/ Frame EC6B 1 KB
772 B 9ms
9ms Script
application/javascript 151.101.0.176
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.stripe.com/v3/fingerprinted/js/m-outer-7345858512d328389831b5c353d30a99.js

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/m-outer-9fe86c29346daf61dc2cc0586b4fad18.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.0.176 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Fastly /

Resource Hash

990a970d0b13f02acfecc901ef01c6d8fd87b05fbb7173e2a1ecb5ffbc3ef514

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/v3/m-outer-9fe86c29346daf61dc2cc0586b4fad18.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 18
x-cache: HIT
content-length: 645
etag: "d0c7e21ec457b6a134a496f107c3ca93"
x-request-id: 9483504e-6769-4333-8b20-b2a9647cf418
x-served-by: cache-hhn4057-HHN
access-control-allow-origin: *
last-modified: Mon, 07 Mar 2022 20:10:26 GMT
server: Fastly
date: Thu, 24 Mar 2022 02:09:42 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: max-age=60
accept-ranges: bytes
timing-allow-origin: *
x-cache-hits: 7

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 217 B
647 B 233ms
47ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=cisomag.eccouncil.org&callback=_gfp_s_&client=ca-pub-5389645983523610

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203170101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-5389645983523610&plah=cisomag.eccouncil.org

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

eabcac7f7b9de0c0f82c410a6f26c23883d3a658c910235310f39423b2e832f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 203
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 230ms
49ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=cisomag.eccouncil.org

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 24 Mar 2022 02:09:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 226ms
45ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cisomag.eccouncil.org

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 24 Mar 2022 02:09:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 232ms
232ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&tn=DIV&id=cookie-law-info-bar&ign=false&pw=1600&ph=1200&x=0&y=1130.4

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5D98 126 KB
38 KB 720ms
716ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5389645983523610&output=html&adk=1812271804&adf=3025194257&lmt=1648087782&plat=1%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648087781935&bpp=4&bdt=624&idt=259&shv=r20220317&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=920607142486&frm=20&pv=2&ga_vid=1897234737.1648087782&ga_sid=1648087782&ga_hid=1917416453&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C21066435&oid=2&pvsid=1823385132476362&pem=654&tmod=805977650&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=278

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9664afe7a28d034336503942719c574e7de56f24c4960348a6ac8583ce9cc8ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 24 Mar 2022 02:09:43 GMT
server: cafe
content-length: 38857
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 24 Mar 2022 02:09:43 GMT
cache-control: private

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 88ms
44ms Ping
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-F0G4XCSHDL&gtm=2oe3e0&_p=1917416453&sr=1600x1200&ul=en-us&cid=1897234737.1648087782&_s=1&dl=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&dt=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal&sid=1648087781&sct=1&seg=0&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-F0G4XCSHDL&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:42 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cisomag.eccouncil.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 72ms
43ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1917416453&t=pageview&_s=1&dl=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&ul=en-us&de=UTF-8&dt=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAAC~&jid=656245385&gjid=2049256707&cid=1897234737.1648087782&tid=UA-102314306-1&_gid=1479648601.1648087782&_r=1&gtm=2wg3e0KK9FGHN&z=1994677760

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cisomag.eccouncil.org/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cisomag.eccouncil.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/663406144/ 42 B
548 B 182ms
52ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/663406144/?random=1648087782093&cv=9&fst=1648087200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&tiba=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal&async=1&fmt=3&is_vtc=1&random=1540538636&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/663406144/ 42 B
548 B 177ms
48ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/663406144/?random=1648087782093&cv=9&fst=1648087200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&tiba=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal&async=1&fmt=3&is_vtc=1&random=1540538636&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 inner.html Show response
m.stripe.network/ Frame 6F6E 930 B
2 KB 56ms
8ms Document
text/html 2600:9000:223e:e200:19:7d10:bd80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/inner.html

Requested by

Host: js.stripe.com
URL: https://js.stripe.com/v3/fingerprinted/js/m-outer-7345858512d328389831b5c353d30a99.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:e200:19:7d10:bd80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudfront /

Resource Hash

a5f27af9c0c6f37979ebafcac22eb3a613841a3d4e728f4577baf94e64d42f35

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://js.stripe.com/

Response headers

content-type: text/html; charset=utf-8
content-length: 930
last-modified: Thu, 17 Mar 2022 19:03:12 GMT
accept-ranges: bytes
server: Cloudfront
strict-transport-security: max-age=31556926; includeSubDomains; preload
timing-allow-origin: *
x-content-type-options: nosniff
content-security-policy: base-uri 'none'; connect-src https://m.stripe.network https://m.stripe.com; default-src 'none'; font-src https://m.stripe.network https://fonts.gstatic.com; form-action 'none'; frame-src https://m.stripe.network https://js.stripe.com; img-src https://m.stripe.network https://m.stripe.com https://b.stripecdn.com; script-src https://m.stripe.network 'sha256-e/Jqu4k9Gk1ZCWO6StAsfhF3i7qgIwfuitaD1g9DyvE='; style-src https://m.stripe.network; report-uri https://q.stripe.com/csp-report
date: Thu, 24 Mar 2022 02:07:02 GMT
cache-control: max-age=300, public
etag: "fc2e029628f163bb59adc6fa5a31161c"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 934706f40ffde6f857deae8d024c1192.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
x-amz-cf-id: z2OXlnHmppDJR5j4ILj_I6dPApfN2yqsrdi5BVyQHdEWsENnLpwyhA==
age: 163

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
445 B 60ms
18ms XHR
text/plain 2a00:1450:400c:c02::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-102314306-1&cid=1897234737.1648087782&jid=656245385&gjid=2049256707&_gid=1479648601.1648087782&_u=YADAAEAAAAAAAC~&z=935398870

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c02::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cisomag.eccouncil.org/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 24 Mar 2022 02:09:43 GMT
content-type: text/plain
access-control-allow-origin: https://cisomag.eccouncil.org
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET webpushr-sw.js.php
cisomag.eccouncil.org/wp-content/plugins/webpushr-web-push-notifications/sdk_files/ Frame 0
0

POST
H2 200 csp-report
q.stripe.com/ Frame 6F6E 0
130 B 170ms
170ms Other
text/plain 54.187.159.182
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://q.stripe.com/csp-report

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

54.187.159.182 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-54-187-159-182.stripe.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://m.stripe.network/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 24 Mar 2022 02:09:43 GMT
x-envoy-upstream-service-time: 2
server: nginx
content-length: 0
strict-transport-security: max-age=31556926; includeSubDomains; preload

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 103ms
53ms Image
image/gif 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-102314306-1&cid=1897234737.1648087782&jid=656245385&_u=YADAAEAAAAAAAC~&z=454913198

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 96ms
48ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-102314306-1&cid=1897234737.1648087782&jid=656245385&_u=YADAAEAAAAAAAC~&z=454913198

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 out-4.5.42.js Show response
m.stripe.network/ Frame 6F6E 86 KB
14 KB 8ms
8ms Script
text/javascript 2600:9000:223e:e200:19:7d10:bd80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.network/out-4.5.42.js

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/inner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:e200:19:7d10:bd80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudfront /

Resource Hash

f445ee14f2454d974293d28677213ae002e9ac17721fc04b2fdeb037e083b083

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://m.stripe.network/inner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
age: 58
x-cache: Hit from cloudfront
date: Thu, 24 Mar 2022 02:08:47 GMT
last-modified: Thu, 17 Mar 2022 19:03:12 GMT
server: Cloudfront
etag: W/"21df7244385e5c0bdf32da01d0dad6c0"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
via: 1.1 934706f40ffde6f857deae8d024c1192.cloudfront.net (CloudFront)
cache-control: max-age=300, public
x-amz-cf-pop: FRA56-P4
timing-allow-origin: *
x-amz-cf-id: By3JYTYxYQ2CVdTS_gJsui6sGl2_clZ1-3HYX98AdHsQC9wwmbfiqQ==

GET
H3

200

/
www.google.de/pagead/1p-conversion/663406144/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/663406144/?random=1772130356&cv=9&fst=1648087782138&num=1&value=0&label=0U39CI6Zv-cBEMCMq7wC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO...
https://www.google.com/pagead/1p-conversion/663406144/?random=1772130356&cv=9&fst=1648087782138&num=1&value=0&label=0U39CI6Zv-cBEMCMq7wC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_...
https://www.google.de/pagead/1p-conversion/663406144/?random=1772130356&cv=9&fst=1648087782138&num=1&value=0&label=0U39CI6Zv-cBEMCMq7wC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_a...

42 B
64 B

54ms
53ms

Image
image/gif

2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/663406144/?random=1772130356&cv=9&fst=1648087782138&num=1&value=0&label=0U39CI6Zv-cBEMCMq7wC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&tiba=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal&auid=247296780.1648087782&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=59I7Ys7kA-DH7_UP3OaNmAI&cid=CAQSKQCNIrLMz909mbscsdK-Pq0QIFHagYNIyfAhZlXF34HhheI-Phx48Fy-&eitems=ChEI8IrrkQYQu8HowrjHjonYARIdAFyJ0g8-YW9faf6Moa5OOrH9jb0lPua6AnKnreo&random=3078726978&resp=GooglemKTybQhCsO&ipr=y&prhg=0

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:43 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:43 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-conversion/663406144/?random=1772130356&cv=9&fst=1648087782138&num=1&value=0&label=0U39CI6Zv-cBEMCMq7wC&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg3e0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&tiba=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal&auid=247296780.1648087782&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=59I7Ys7kA-DH7_UP3OaNmAI&cid=CAQSKQCNIrLMz909mbscsdK-Pq0QIFHagYNIyfAhZlXF34HhheI-Phx48Fy-&eitems=ChEI8IrrkQYQu8HowrjHjonYARIdAFyJ0g8-YW9faf6Moa5OOrH9jb0lPua6AnKnreo&random=3078726978&resp=GooglemKTybQhCsO&ipr=y&prhg=0
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 6 Show response
m.stripe.com/ Frame 6F6E 156 B
522 B 519ms
172ms XHR
application/json 34.211.187.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://m.stripe.com/6

Requested by

Host: m.stripe.network
URL: https://m.stripe.network/out-4.5.42.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.211.187.4 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-211-187-4.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

4df1edcf14fba12890959c06487bf3ddb5994bf692aefe36ef385f893298a0b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://m.stripe.network/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 24 Mar 2022 02:09:43 GMT
x-content-type-options: nosniff
server: nginx
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-type: application/json;charset=utf-8
access-control-allow-origin: https://m.stripe.network
access-control-allow-credentials: true
access-control-allow-headers: Content-Type
content-length: 156

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 5D2E 0
18 B 34ms
15ms Document
text/plain 2a03:2880:f108:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f108:83:face:b00c:0:25de Milan, Italy, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://cisomag.eccouncil.org
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/

Response headers

content-type: text/plain
access-control-allow-origin: https://cisomag.eccouncil.org
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=0
date: Thu, 24 Mar 2022 02:09:43 GMT

POST
H2 204 collect Show response
k.clarity.ms/ 0
96 B 290ms
290ms XHR
text/plain 20.96.88.162
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://k.clarity.ms/collect
Requested by: Host: k.clarity.ms
URL: https://k.clarity.ms/s/0.6.31/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.96.88.162 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://cisomag.eccouncil.org/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

access-control-allow-origin: https://cisomag.eccouncil.org
date: Thu, 24 Mar 2022 02:09:43 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:e97341f6-8fff-46a6-9229-fbbfe0892c78

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.4.0/css/ Frame 77E5 119 KB
21 KB 54ms
23ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/css/bootstrap.min.css

Requested by

Host: edm-image.s3.us-west-2.amazonaws.com
URL: https://edm-image.s3.us-west-2.amazonaws.com/Forms/CISOMAG/Subscribe_Newsletter.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1f429f4e2829515fb4ff9b67d875c2d023f08610e15a049ac0976715dd02182a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://edm-image.s3.us-west-2.amazonaws.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:43 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 722
age: 6722813
cdn-cachedat: 11/02/2021 18:14:20
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cdn-proxyver: 1.0
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:00 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 32a59edb542812a95fcff70fcc606a80
cf-ray: 6f0bddc6a90469a3-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 CaptchaServlet
crm.zoho.com/crm/ Frame 77E5 3 KB
4 KB 497ms
172ms Image
image/jpeg 204.141.42.49
ZOHO-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://crm.zoho.com/crm/CaptchaServlet?formId=072586c2102dd292e5fbec10cbd72c4773ca41c57c701e6aa1a7e0b3539f19b0&grpid=039dfce44f73bb27d1a1d24c16fe87968f4e36d450355aa5749fef7ad69cb8e6

Requested by

Host: edm-image.s3.us-west-2.amazonaws.com
URL: https://edm-image.s3.us-west-2.amazonaws.com/Forms/CISOMAG/Subscribe_Newsletter.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

204.141.42.49 , United States, ASN2639 (ZOHO-AS, US),

Reverse DNS

Software

ZGS /

Resource Hash

22af8fe599f217e14dfb82c2f1442dd759352038cb6e6cb8328770d08a65e25e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://edm-image.s3.us-west-2.amazonaws.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:43 GMT
referrer-policy: strict-origin
server: ZGS
x-frame-options: SAMEORIGIN
content-language: de-DE
x-xss-protection: 1; mode=block
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=63072000
content-type: image/jpeg
content-security-policy-report-only: script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: https://*.zappsusercontent.com https://*.zappsusercontent.eu https://*.zappsusercontent.in https://*.zappsusercontent.com.au https://*.zappsusercontent.com.cn https://*.localzappscontents.com https://*.zohostatic.com https://*.zoho.com https://js.zohocdn.com https://desk.zoho.com https://salesiq.zoho.com https://js.zohostatic.com https://localjs.zohostatic.com https://media.twiliocdn.com/sdk/js/client/releases/1.7.7/twilio.min.js https://media.twiliocdn.com/sdk/js/client/v1.7/twilio.min.js https://cdn.pagesense.io https://pagesense-collect.zoho.com https://iplocation.zoho.com https://s.ytimg.com/yts/jsbin/ https://www.youtube.com/iframe_api https://dyjgaef5vuq51.cloudfront.net https://dtzpfzv31buvf.cloudfront.net https://d22czkv2r5ogmg.cloudfront.net https://d12h6dzwzn4m10.cloudfront.net https://d17nz991552y2g.cloudfront.net https://scripts.zohospotlight.com chrome-extension://* https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://js.stratuscdn.com https://cdn.pagesense.io https://zohotagmanager.cdn.pagesense.io https://static.zohocdn.com https://www.zohowebstatic.com/ https://scripts.zohospotlight.com https://widgets.zohosalesiq.com https://static.stratuscdn.com; report-uri https://logsapi.zoho.com/csplog?service=crm
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 36ms
36ms Image
image/gif 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1917416453&t=event&ni=1&_s=2&dl=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&ul=en-us&de=UTF-8&dt=Lapsus%24%20Ransomware%20Targets%20Media%20Firms%20in%20Portugal&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Clarity&ea=1vr7mqh&_u=aDDAAEABAAAAAC~&jid=&gjid=&cid=1897234737.1648087782&tid=UA-102314306-1&_gid=1479648601.1648087782&gtm=2wg3e0KK9FGHN&cd1=https%3A%2F%2Fclarity.microsoft.com%2Fga%2F48pbph9uo8%2F1hov924%2F1vr7mqh&z=1222004881

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 23 Mar 2022 06:50:14 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 69569
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203170101/ 152 KB
54 KB 58ms
57ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203170101/reactive_library_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e647f50908584c7bf2827898737733d8ab7bfa41caa8cc62fc35259244ef7b10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55148
x-xss-protection: 0
server: cafe
etag: 15990817658027725146
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Mar 2022 02:09:43 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 90ms
45ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=cisomag.eccouncil.org

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 24 Mar 2022 02:09:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 97ms
50ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=cisomag.eccouncil.org

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 24 Mar 2022 02:09:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5C43 27 KB
12 KB 506ms
505ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5389645983523610&output=html&h=600&adk=595182048&adf=572165612&pi=t.aa~a.2242084310~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1648087783&rafmt=1&to=qs&pwprc=1353055134&psa=0&format=300x600&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648087783147&bpp=3&bdt=1835&idt=3&shv=r20220317&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D54a2b546abe038e9-22a9422963cd0063%3AT%3D1648087783%3ART%3D1648087783%3AS%3DALNI_MZBsL2ywRIPRIM4lxzm3l0DC0GJVg&prev_fmts=0x0&nras=2&correlator=920607142486&frm=20&pv=1&ga_vid=1897234737.1648087782&ga_sid=1648087782&ga_hid=1917416453&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=991&ady=1565&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C21066435&oid=2&pvsid=1823385132476362&pem=654&tmod=805977650&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=0BAjZ7FgDq&p=https%3A//cisomag.eccouncil.org&dtd=25

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58a0abffab9845abc31991c6fca6a5874d2db1d8238c6fa4a86e5bfd64a49636

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 24 Mar 2022 02:09:44 GMT
server: cafe
content-length: 12354
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/ Frame A5C7 10 KB
4 KB 39ms
38ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ce5fc08d0f617e71e1d61bcd79fc7cc1855f4221945b0c09ac774685fe7f52c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4502
x-xss-protection: 0
date: Wed, 23 Mar 2022 23:13:42 GMT
expires: Wed, 06 Apr 2022 23:13:42 GMT
cache-control: public, max-age=1209600
age: 10561
etag: 4044455266028820542
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 200
OK get_info Show response
bot.webpushr.com/prompt/ 23 KB
7 KB 492ms
161ms Fetch
text/html 64.225.42.52
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://bot.webpushr.com/prompt/get_info
Requested by: Host: cdn.webpushr.com
URL: https://cdn.webpushr.com/app.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.225.42.52 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: b615139483987653bc5e5259a6b2980bf3b9fb33ab942f8a8b13ccab79fe09e5

Request headers

Referer: https://cisomag.eccouncil.org/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Thu, 24 Mar 2022 02:09:44 GMT
Content-Encoding: gzip
Server: nginx/1.14.0 (Ubuntu)
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: https://cisomag.eccouncil.org
Access-Control-Allow-Credentials: true
X-Fastcgi-Cache: HIT
Connection: keep-alive
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
server_name: lookup4

POST
H/1.1 200
OK session Show response
analytics.webpushr.com/impression/ 0
544 B 490ms
163ms Fetch
text/html 138.68.235.115
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webpushr.com/impression/session
Requested by: Host: cdn.webpushr.com
URL: https://cdn.webpushr.com/app.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 138.68.235.115 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cisomag.eccouncil.org/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Thu, 24 Mar 2022 02:09:44 GMT
Content-Encoding: gzip
Server: nginx/1.14.0 (Ubuntu)
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: https://cisomag.eccouncil.org
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220317/r20110914/ Frame A5C7 19 KB
8 KB 128ms
39ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220317/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d072a09604e6a1fea8ef42203503771aa36b63a3c91fd1059966e26e6f5812b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 01:27:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2524
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7871
x-xss-protection: 0
server: cafe
etag: 7397949449432438406
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 07 Apr 2022 01:27:40 GMT

GET
H2 200 7922402861885404176
tpc.googlesyndication.com/simgad/ Frame A5C7 5 KB
5 KB 168ms
80ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7922402861885404176?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qmj05KEwK_NcusLotlWUZvzJK2DvA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e54906d19a7e8b355ec4aad735a08c571da17cde43b537ec376f74f4c5e9ca65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 23 Mar 2022 00:19:50 GMT
x-content-type-options: nosniff
age: 92994
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4636
x-xss-protection: 0
last-modified: Thu, 03 Feb 2022 13:28:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 23 Mar 2023 00:19:50 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220317/r20110914/client/ Frame A5C7 2 KB
1 KB 135ms
47ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220317/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 01:48:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1280
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 07 Apr 2022 01:48:24 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A5C7 119 KB
37 KB 140ms
53ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 24 Mar 2022 02:09:44 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220317/r20110914/client/ Frame A5C7 15 KB
6 KB 130ms
43ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220317/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 01:49:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1216
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6407
x-xss-protection: 0
server: cafe
etag: 6055885685211612390
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 07 Apr 2022 01:49:28 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame A5C7 0
0 48ms
47ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR5EWqwzjCmqJqmfAnC3Mw9W4ri4vNtaTtMgjy78aMKWi45APs-LQVBmfiuVgm1SfQdMSozyX-yY0UIPAo8Revxoe1o0w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H2 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220317/r20110914/client/ Frame A5C7 28 KB
12 KB 136ms
49ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220317/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b32e2a199c3c9352689ae64546f5d70094b7208f0188067d7f583982f9886ef1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 23 Mar 2022 13:49:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 44399
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11790
x-xss-protection: 0
server: cafe
etag: 15946466291951677483
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Apr 2022 13:49:45 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 41C3 143 B
163 B 43ms
39ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1

Response headers

x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 145
x-xss-protection: 0
date: Thu, 24 Mar 2022 02:06:52 GMT
cache-control: public, max-age=3600
content-type: text/html; charset=UTF-8
age: 172
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2EFB 1 KB
749 B 42ms
41ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Wed, 23 Mar 2022 05:53:44 GMT
expires: Thu, 24 Mar 2022 05:53:44 GMT
cache-control: public, max-age=86400
age: 72960
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 dpixel
cms.quantserve.com/ Frame 2EFB 35 B
463 B 27ms
9ms Image
image/gif 2620:116:800d:21:fcb8:22d2:d390:5f1b
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENF6GpEfVfpteea5PlBhAc8&google_cver=1&google_push=AYg5qPIuHRcCminwv0HbP79Ws5ElI384I-Cv683wTbVNgslMI_JpUMmrqF7CLVbJ-FzvF5A1tSLSvw7ZgvXnANKNHRN_tXp96FBhpw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:fcb8:22d2:d390:5f1b , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2EFB
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPK3DQPM...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPK3DQPM...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAzMjQwMjA5NDQwMDAzMzYwODI2MTY4NA%3D%3D&google_push=AYg5qPK3DQPMhwBskfsfEaXG2p3jxFmaxKznmRB_MP2VZuWkuq98jy_cnkUzhVRM059G5D...

170 B
188 B

50ms
50ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAzMjQwMjA5NDQwMDAzMzYwODI2MTY4NA%3D%3D&google_push=AYg5qPK3DQPMhwBskfsfEaXG2p3jxFmaxKznmRB_MP2VZuWkuq98jy_cnkUzhVRM059G5DeE5cUv5jzVjxsQvBlpeJyWPOoihoZW

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAzMjQwMjA5NDQwMDAzMzYwODI2MTY4NA%3D%3D&google_push=AYg5qPK3DQPMhwBskfsfEaXG2p3jxFmaxKznmRB_MP2VZuWkuq98jy_cnkUzhVRM059G5DeE5cUv5jzVjxsQvBlpeJyWPOoihoZW
pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Thu, 24 Mar 2022 02:09:44 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 2EFB 43 B
351 B 55ms
20ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEH08A0j1vn5w6srnLfS53Z0&google_cver=1&google_push=AYg5qPIdgGJjIlXNDe2wQFdOxrYOaNxIU3oCCn_yjph_OFnZbmtKrT4tvOGpYgUUfDCyy95lmoPsYYC6YHgWoZD-1veeJliIb7Wx
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 7b85bh0gvmq7gl6usj7jpi2ukggs73r4

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2EFB
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=hqWg6X58QhybsoQi71_M7A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

47ms
47ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=hqWg6X58QhybsoQi71_M7A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJdS6u5IUfQ2B2f-N8ZcH3DDFk6bWqYnBMpRvNN61i7yZqbQyb7PR5QGXD9ZLu643RIOfwvBka57j1bK5z8Qy2RN11dTp-GbQ

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=hqWg6X58QhybsoQi71_M7A%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJdS6u5IUfQ2B2f-N8ZcH3DDFk6bWqYnBMpRvNN61i7yZqbQyb7PR5QGXD9ZLu643RIOfwvBka57j1bK5z8Qy2RN11dTp-GbQ
date: Thu, 24 Mar 2022 02:09:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 2EFB
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEGQrQ-znpmzoAXevz-GOXT0&google_cver=1&google_push=AYg5qPKrUeQGkrZKClI8L-fI1kmU_ZtT_fRv5lCjoGJNdnyNvgX7IGihRuoqgmHzDksUQmYc2mX...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDE0Q1dYMkYtNi00U0tB&google_push=AYg5qPKrUeQGkrZKClI8L-fI1kmU_ZtT_fRv5lCjoGJNdnyNvgX7IGihRuoqgmHzDksUQmYc2mXyjMi1P9F5-OvbfYP3Z_6hY2x5BA

170 B
243 B

119ms
50ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDE0Q1dYMkYtNi00U0tB&google_push=AYg5qPKrUeQGkrZKClI8L-fI1kmU_ZtT_fRv5lCjoGJNdnyNvgX7IGihRuoqgmHzDksUQmYc2mXyjMi1P9F5-OvbfYP3Z_6hY2x5BA

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDE0Q1dYMkYtNi00U0tB&google_push=AYg5qPKrUeQGkrZKClI8L-fI1kmU_ZtT_fRv5lCjoGJNdnyNvgX7IGihRuoqgmHzDksUQmYc2mXyjMi1P9F5-OvbfYP3Z_6hY2x5BA
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 2EFB
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSS...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 2EFB 43 B
296 B 110ms
19ms Image
image/gif 2a05:d01c:1d8:8100:8701:aae2:1118:ca9
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEM5XiO-ZZKr4XDhDHetcQqs&google_cver=1&google_push=AYg5qPJ4IZFcoBVEwWv0s3FdX_R3o5MXhtM_avQLn3AbxEDU7E4s2VB3rlq83CKMiA8QMlKgs_yT7AUh11hTaOryB1xlMtugG-HJqg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8100:8701:aae2:1118:ca9 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 2EFB 0
232 B 146ms
46ms Image
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JUpeaK6Vb0QOSSTx5MDhL5QmHysM23pmedhqRN-wDSg6zxSULt9TS4rhAJB-2TOSywZgSz

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:44 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 41C3
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

67ms
67ms

Document
text/html

2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 24 Mar 2022 02:09:44 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 24 Mar 2022 02:09:44 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 24 Mar 2022 02:09:44 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Guojae3EGYR4c8nOY3QAJp6N_HyMY3qMC8IMY_l3vL8.js Show response
pagead2.googlesyndication.com/bg/ Frame 3056 35 KB
14 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Guojae3EGYR4c8nOY3QAJp6N_HyMY3qMC8IMY_l3vL8.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220317/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1aea2369edc419847873c9ce637400269e8dfc7c8c637a8c0bc20c63f977bcbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 23 Mar 2022 19:52:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22646
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13802
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 23 Mar 2023 19:52:18 GMT

GET
H/1.1 200
OK js Show response
tags.mathtag.com/notify/ Frame 5C43 3 KB
2 KB 46ms
13ms Script
application/x-javascript 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTnpaa01EWXpaamN0Wmpka1lpMDRPVGRoTFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5NjI3NzE3NDQzMDU1MjM2OTcvMTA0MDYyOTEvMTExNDI0ODEvNC9jSGRFdmg2M3BIVnJqNXRsQzhUanM3bURVSTNiREN5NWV2dklYd0syeDRzLzEvNC8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMzk2Mjc3MTc0NDMwNTUyMzY5Ny96cmgvMC85MDM3LzE2Lzk5OS8yNTgvMmEwMzoxYjIwOjY6Oi8wLjAwMC8xNjQ4MDg3NzgzLzE2NDgxMDAzODMvNC9wdWItNTM4OTY0NTk4MzUyMzYxMC8/ODpoKFRufI2gSYzwrJKWiKJC2tQ&nodeid=2633&group=zrh&auctionid=3962771744305523697&shardkey=3962771744305523697&sid=11142481&cid=10406291&bp=a_bjiibd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.133.235&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCSASb59I7YsK8NLeux_AP7-CWyAjPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi01Mzg5NjQ1OTgzNTIzNjEwyAEJqAMBqgSIAk_QjXJkrbcggwHeI6dOzy0s0nmiVCNhS9ErPpMDciT68BkpVlF_rKELDishKbiFjmOU3fCvhjvsjSMTAg8wGbQypXPgzT65bSG43K9anSGmgRhpLyEC44bbvIyy0DQVgPXqI7B8H-LquDgkuGWjgW-AZsIF5rbuSzPHn8UrT1lkUeP4yDz-J1Cpp1fIjqxtSQp9xdITfvRLxFXJoeKZiQt-dgIDVvcFcinX5NgXBYcC7B0yf4YU2vAWh_VHCQNqUS6xCYi3rtdJiByWTXmxwixAzHUFPuOrc3P4JQUbegLrk3B1gI2U_1y7GMSrjkxZnddr8eSVxeMTebDKmkf-jQJ3sJDliJwwQoAGh-uT36LvmL9goAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_193ZXno3XPO38MIYPebIaiyNe82g%26client%3Dca-pub-5389645983523610%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5389645983523610&output=html&h=600&adk=595182048&adf=572165612&pi=t.aa~a.2242084310~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1648087783&rafmt=1&to=qs&pwprc=1353055134&psa=0&format=300x600&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648087783147&bpp=3&bdt=1835&idt=3&shv=r20220317&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D54a2b546abe038e9-22a9422963cd0063%3AT%3D1648087783%3ART%3D1648087783%3AS%3DALNI_MZBsL2ywRIPRIM4lxzm3l0DC0GJVg&prev_fmts=0x0&nras=2&correlator=920607142486&frm=20&pv=1&ga_vid=1897234737.1648087782&ga_sid=1648087782&ga_hid=1917416453&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=991&ady=1565&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C21066435&oid=2&pvsid=1823385132476362&pem=654&tmod=805977650&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=0BAjZ7FgDq&p=https%3A//cisomag.eccouncil.org&dtd=25
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.305.0 /
Resource Hash: 9f2513aaec10734f9e4185005a7e0a28469d770cdee77ef6c164ed58af8f1132

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 24 Mar 2022 02:09:44 GMT
Content-Encoding: gzip
x-mm-bid-request-time: 1648087783
Last-Modified: Thu, 24 Mar 2022 02:09:43 GMT
Server: MMBD/3.305.0
x-mm-latency: 1 (0)
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
x-mm-dbg: Count
Cache-Control: no-cache
x-mm-host: zrh-router-x37, zrh-bidder-x147
Connection: close
Content-Type: application/x-javascript; charset=UTF-8
Expires: Thu, 24 Mar 2022 02:09:43 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220317/r20110914/client/ Frame 5C43 2 KB
1 KB 92ms
42ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220317/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5389645983523610&output=html&h=600&adk=595182048&adf=572165612&pi=t.aa~a.2242084310~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1648087783&rafmt=1&to=qs&pwprc=1353055134&psa=0&format=300x600&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648087783147&bpp=3&bdt=1835&idt=3&shv=r20220317&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D54a2b546abe038e9-22a9422963cd0063%3AT%3D1648087783%3ART%3D1648087783%3AS%3DALNI_MZBsL2ywRIPRIM4lxzm3l0DC0GJVg&prev_fmts=0x0&nras=2&correlator=920607142486&frm=20&pv=1&ga_vid=1897234737.1648087782&ga_sid=1648087782&ga_hid=1917416453&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=991&ady=1565&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C21066435&oid=2&pvsid=1823385132476362&pem=654&tmod=805977650&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=0BAjZ7FgDq&p=https%3A//cisomag.eccouncil.org&dtd=25

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 01:48:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1280
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1233
x-xss-protection: 0
server: cafe
etag: 16517525077337815633
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 07 Apr 2022 01:48:24 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5C43 119 KB
36 KB 49ms
49ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36904
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1648035241783118"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 24 Mar 2022 02:09:44 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220317/r20110914/client/ Frame 5C43 15 KB
6 KB 88ms
39ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220317/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 01:49:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1216
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6407
x-xss-protection: 0
server: cafe
etag: 6055885685211612390
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 07 Apr 2022 01:49:28 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 5C43 0
0 47ms
46ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS0qHu0j8AjQal4zPdiOdoXBwvg68rNRtTMJd90dieiqxZ04dFzb1TzYXqOu2xp94QIobwbSLdRMhYPdj9QNIgzfVaKGQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5389645983523610&output=html&h=600&adk=595182048&adf=572165612&pi=t.aa~a.2242084310~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1648087783&rafmt=1&to=qs&pwprc=1353055134&psa=0&format=300x600&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648087783147&bpp=3&bdt=1835&idt=3&shv=r20220317&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D54a2b546abe038e9-22a9422963cd0063%3AT%3D1648087783%3ART%3D1648087783%3AS%3DALNI_MZBsL2ywRIPRIM4lxzm3l0DC0GJVg&prev_fmts=0x0&nras=2&correlator=920607142486&frm=20&pv=1&ga_vid=1897234737.1648087782&ga_sid=1648087782&ga_hid=1917416453&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=991&ady=1565&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C21066435&oid=2&pvsid=1823385132476362&pem=654&tmod=805977650&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=0BAjZ7FgDq&p=https%3A//cisomag.eccouncil.org&dtd=25
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 5C43 0
0 82ms
81ms Fetch
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CkN5y59I7YsK8NLeux_AP7-CWyAjPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi01Mzg5NjQ1OTgzNTIzNjEwyAEJqAMBqgSFAk_QjXJkrbcggwHeI6dOzy0s0nmiVCNhS9ErPpMDciT68BkpVlF_rKELDishKbiFjmOU3fCvhjvsjSMTAg8wGbQypXPgzT65bSG43K9anSGmgRhpLyEC44bbvIyy0DQVgPXqI7B8H-LquDgkuGWjgW-AZsIF5rbuSzPHn8UrT1lkUeP4yDz-J1Cpp1fIjqxtSQp9xdITfvRLxFXJoeKZiQt-dgIDVvcFcinX5NgXBYcC7B0yf4YU2vAWh_VHCQNqUS6xCYi3rtdJiByWTXmxwixAzHUFPuOrc3P4JQUbegKpkVHnLDEw-NEfUG9zzuOpgMNhTe673QKuufBlYObgoRrZKSziBYAGh-uT36LvmL9goAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAGACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItNTM4OTY0NTk4MzUyMzYxMBgA&sigh=PUwDNjVIVgg&uach_m=[UACH]&cid=CAQSOwCNIrLMeRuKD9C5VWYIbZicK0qaNua5njLTAsWdzZlm2MNd3gshH5XsrwRFGNGoQ_i8cE8fwT9JCD49GAE&tpd=AGWhJmuJn2FylKuDoA0v_SFbBbHoGD0Rm6uGz5bUYV2XMLrceqSNkIICAV8STL4L6SvKwTj5faVDcgpm9ClzNqORUKsBWDAmy3nqVqENpAGmtK4SvF5CRRIaSaCQz4SNQpYDHyPTv3dLv5Rp7JoPB3dOQ5UUfCUuBltrH9f9KSV3z5epZOsVVtffeFF8PFmidaeqDx1vzxfuhzD9QNOWgIE6kdWCUXqUYnuhNKEmvEzgD0jqFzhd3YYE66QAZfZXjFs3YPkAnZtdCTGVC0fH1tBI-pswr28_GKsGT9DoOuUtSIZ4O3wQMj1wPR5PHbaRduQnBnHtzS_TUsIyrm9lZtAGi3gnuF8Ncglzwawg66rtJb9DkgkTLyMlnqPBgGimCSmAr7XBPkZUQTl6WpHuLH_Y2r1Ds-74ZCwVqD9U2sAgwIozE9Egdu-7ll0e2rIqTdzckWyktkjhD-MLgFUPNpkwbwE05fFd4ldu8Sr4ckezI_jsNN9E2b_FaQuWbvTzG8ahRLopSzoQMVK-1rdABvUlHDNwj8livF9FAW49Kj3vmdsTh7DoiRlPPeDqxBxlDAH8-tZ6kD1WMJphdlJehbvy9K_uVEIJfdqp2zLWOyEztReVbYtiSBF1Fy0XqgD08hB-fLvNg5AyG_hsPN9oye5-ZP4cfnBb3AdJjKBwI52uynP-zlVYMlAtxloA5fhjLFfuUI6IZEZURqDIzZgCaC3iOKQS7qYskGhNkDITpRgHlB_Z6PiG54Yp7mOIIEHfB2mv9Zzw7VHeQ7WDNZT-OAvm8b8rKpEMWxkX3lQ57UOkAyZpyoN5UnODyXVJj15JMPNYClw1EX4cpM8JyKrsZMm0SrJAkl7_nkuxan438PP2GMGFbbNUtfG0M5HRCzzVqE8he4shTXwap_c3b0OL-fBMsTM32F3v-uy-Vw3-uMySNwSW9cF_Hs-q7ZWkxKWG3XMCG5f_bHocFWkN_nL7u8FHNPwCD-7GYR0-Lq_VrCo5ha-dxHPWIQ6iuujJMqHMhiX-cYDy95hiLPLrQkS7jdxD3UHmSxYYQcFKkSociNayxVvbt3Xip8dSv3fPJqCpctHIQ_k8jD9e-q1SXvpj

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5389645983523610&output=html&h=600&adk=595182048&adf=572165612&pi=t.aa~a.2242084310~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1648087783&rafmt=1&to=qs&pwprc=1353055134&psa=0&format=300x600&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648087783147&bpp=3&bdt=1835&idt=3&shv=r20220317&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D54a2b546abe038e9-22a9422963cd0063%3AT%3D1648087783%3ART%3D1648087783%3AS%3DALNI_MZBsL2ywRIPRIM4lxzm3l0DC0GJVg&prev_fmts=0x0&nras=2&correlator=920607142486&frm=20&pv=1&ga_vid=1897234737.1648087782&ga_sid=1648087782&ga_hid=1917416453&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=991&ady=1565&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C21066435&oid=2&pvsid=1823385132476362&pem=654&tmod=805977650&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=0BAjZ7FgDq&p=https%3A//cisomag.eccouncil.org&dtd=25
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 24 Mar 2022 02:09:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

POST
H/1.1 200
OK prompt Show response
analytics.webpushr.com/impression/ 0
544 B 164ms
164ms Fetch
text/html 138.68.235.115
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webpushr.com/impression/prompt
Requested by: Host: cdn.webpushr.com
URL: https://cdn.webpushr.com/app.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 138.68.235.115 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cisomag.eccouncil.org/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Thu, 24 Mar 2022 02:09:44 GMT
Content-Encoding: gzip
Server: nginx/1.14.0 (Ubuntu)
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: https://cisomag.eccouncil.org
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

POST
H/1.1 200
OK prompt Show response
analytics.webpushr.com/impression/ 0
544 B 328ms
163ms Fetch
text/html 138.68.235.115
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webpushr.com/impression/prompt
Requested by: Host: cdn.webpushr.com
URL: https://cdn.webpushr.com/app.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 138.68.235.115 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cisomag.eccouncil.org/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Thu, 24 Mar 2022 02:09:44 GMT
Content-Encoding: gzip
Server: nginx/1.14.0 (Ubuntu)
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: https://cisomag.eccouncil.org
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

GET
H2 200 gsJx9jb8dL.png
cdn.webpushr.com/siteassets/ 5 KB
6 KB 7ms
6ms Image
image/png 167.71.57.196
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.webpushr.com/siteassets/gsJx9jb8dL.png
Requested by: Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 167.71.57.196 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: 7ad75b5b6da6d2c152a792a611e9b555f821e1e50a336d2abd4d59e62f091b84

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:44 GMT
last-modified: Tue, 02 Feb 2021 05:19:49 GMT
server: nginx/1.16.1
etag: "6018e0f5-15dd"
content-type: image/png
access-control-allow-origin: *
x-gg-cache-status: HIT
accept-ranges: bytes
content-length: 5597

GET
H/1.1 200
OK ynpsxyk40ika Show response
hal9000.redintelligence.net/zone/ Frame 5C43 10 KB
4 KB 44ms
12ms Script
text/html 144.76.91.199
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/ynpsxyk40ika?subid=&gdpr=1&gdpr_consent=li&rnd=3962771744305523697&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYjvS5wAOk2sK4DaKLg1Bpw%26exch_seat%3D20035004448%26mt_aid%3D3962771744305523697%26mt_id%3D10406291%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dd786623b-d2e8-4801-8374-76c392c1e9eb%26mt_cid%3Dd786623b-d2e8-4801-8374-76c392c1e9eb%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCSASb59I7YsK8NLeux_AP7-CWyAjPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi01Mzg5NjQ1OTgzNTIzNjEwyAEJqAMBqgSIAk_QjXJkrbcggwHeI6dOzy0s0nmiVCNhS9ErPpMDciT68BkpVlF_rKELDishKbiFjmOU3fCvhjvsjSMTAg8wGbQypXPgzT65bSG43K9anSGmgRhpLyEC44bbvIyy0DQVgPXqI7B8H-LquDgkuGWjgW-AZsIF5rbuSzPHn8UrT1lkUeP4yDz-J1Cpp1fIjqxtSQp9xdITfvRLxFXJoeKZiQt-dgIDVvcFcinX5NgXBYcC7B0yf4YU2vAWh_VHCQNqUS6xCYi3rtdJiByWTXmxwixAzHUFPuOrc3P4JQUbegLrk3B1gI2U_1y7GMSrjkxZnddr8eSVxeMTebDKmkf-jQJ3sJDliJwwQoAGh-uT36LvmL9goAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_193ZXno3XPO38MIYPebIaiyNe82g%2526client%253Dca-pub-5389645983523610%2526adurl%253D%26redirect%3D
Requested by: Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 144.76.91.199 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.199.91.76.144.clients.your-server.de
Software: Apache /
Resource Hash: 983a0a22d44af024affc73914eca0820e642f4d6f59ed707d2f1880b048ac277

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 24 Mar 2022 02:09:44 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3406
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK ck-confirm
tags.mathtag.com/ Frame 5C43 49 B
330 B 36ms
13ms Image
image/gif 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/ck-confirm?bid_id=3962771744305523697&node_id=2633&exch_id=4
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTnpaa01EWXpaamN0Wmpka1lpMDRPVGRoTFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5NjI3NzE3NDQzMDU1MjM2OTcvMTA0MDYyOTEvMTExNDI0ODEvNC9jSGRFdmg2M3BIVnJqNXRsQzhUanM3bURVSTNiREN5NWV2dklYd0syeDRzLzEvNC8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMzk2Mjc3MTc0NDMwNTUyMzY5Ny96cmgvMC85MDM3LzE2Lzk5OS8yNTgvMmEwMzoxYjIwOjY6Oi8wLjAwMC8xNjQ4MDg3NzgzLzE2NDgxMDAzODMvNC9wdWItNTM4OTY0NTk4MzUyMzYxMC8/ODpoKFRufI2gSYzwrJKWiKJC2tQ&nodeid=2633&group=zrh&auctionid=3962771744305523697&shardkey=3962771744305523697&sid=11142481&cid=10406291&bp=a_bjiibd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.133.235&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCSASb59I7YsK8NLeux_AP7-CWyAjPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi01Mzg5NjQ1OTgzNTIzNjEwyAEJqAMBqgSIAk_QjXJkrbcggwHeI6dOzy0s0nmiVCNhS9ErPpMDciT68BkpVlF_rKELDishKbiFjmOU3fCvhjvsjSMTAg8wGbQypXPgzT65bSG43K9anSGmgRhpLyEC44bbvIyy0DQVgPXqI7B8H-LquDgkuGWjgW-AZsIF5rbuSzPHn8UrT1lkUeP4yDz-J1Cpp1fIjqxtSQp9xdITfvRLxFXJoeKZiQt-dgIDVvcFcinX5NgXBYcC7B0yf4YU2vAWh_VHCQNqUS6xCYi3rtdJiByWTXmxwixAzHUFPuOrc3P4JQUbegLrk3B1gI2U_1y7GMSrjkxZnddr8eSVxeMTebDKmkf-jQJ3sJDliJwwQoAGh-uT36LvmL9goAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_193ZXno3XPO38MIYPebIaiyNe82g%26client%3Dca-pub-5389645983523610%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.305.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 24 Mar 2022 02:09:44 GMT
Server: MMBD/3.305.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x66, zrh-bidder-x147
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Thu, 24 Mar 2022 02:09:43 GMT

GET
H/1.1 200
OK img
pixel.mathtag.com/event/ Frame 5C43 43 B
405 B 47ms
18ms Image
image/gif 104.79.88.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=4&v2=3962771744305523697&v3=1129274&v4=11142481&v5=10406291&mt_nsync=1&no_attr=1
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTnpaa01EWXpaamN0Wmpka1lpMDRPVGRoTFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5NjI3NzE3NDQzMDU1MjM2OTcvMTA0MDYyOTEvMTExNDI0ODEvNC9jSGRFdmg2M3BIVnJqNXRsQzhUanM3bURVSTNiREN5NWV2dklYd0syeDRzLzEvNC8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMzk2Mjc3MTc0NDMwNTUyMzY5Ny96cmgvMC85MDM3LzE2Lzk5OS8yNTgvMmEwMzoxYjIwOjY6Oi8wLjAwMC8xNjQ4MDg3NzgzLzE2NDgxMDAzODMvNC9wdWItNTM4OTY0NTk4MzUyMzYxMC8/ODpoKFRufI2gSYzwrJKWiKJC2tQ&nodeid=2633&group=zrh&auctionid=3962771744305523697&shardkey=3962771744305523697&sid=11142481&cid=10406291&bp=a_bjiibd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.133.235&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCSASb59I7YsK8NLeux_AP7-CWyAjPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi01Mzg5NjQ1OTgzNTIzNjEwyAEJqAMBqgSIAk_QjXJkrbcggwHeI6dOzy0s0nmiVCNhS9ErPpMDciT68BkpVlF_rKELDishKbiFjmOU3fCvhjvsjSMTAg8wGbQypXPgzT65bSG43K9anSGmgRhpLyEC44bbvIyy0DQVgPXqI7B8H-LquDgkuGWjgW-AZsIF5rbuSzPHn8UrT1lkUeP4yDz-J1Cpp1fIjqxtSQp9xdITfvRLxFXJoeKZiQt-dgIDVvcFcinX5NgXBYcC7B0yf4YU2vAWh_VHCQNqUS6xCYi3rtdJiByWTXmxwixAzHUFPuOrc3P4JQUbegLrk3B1gI2U_1y7GMSrjkxZnddr8eSVxeMTebDKmkf-jQJ3sJDliJwwQoAGh-uT36LvmL9goAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_193ZXno3XPO38MIYPebIaiyNe82g%26client%3Dca-pub-5389645983523610%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.79.88.164 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-79-88-164.deploy.static.akamaitechnologies.com
Software: MT3 4267 dd20a5c master cdg-pixel-x12 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 24 Mar 2022 02:09:44 GMT
Server: MT3 4267 dd20a5c master cdg-pixel-x12 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 24 Mar 2022 02:09:43 GMT

GET
H/1.1 200
OK img
tags.mathtag.com/event/ Frame 5C43 49 B
330 B 35ms
12ms Image
image/gif 185.29.132.242
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/event/img?type=mmImpTrack&exch=adx&bid=3962771744305523697&st=11142481&time=1648087784&nodeid=2633
Requested by: Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTnpaa01EWXpaamN0Wmpka1lpMDRPVGRoTFRBd01EQXRNREF3TURBd01EQXdNREF3LzM5NjI3NzE3NDQzMDU1MjM2OTcvMTA0MDYyOTEvMTExNDI0ODEvNC9jSGRFdmg2M3BIVnJqNXRsQzhUanM3bURVSTNiREN5NWV2dklYd0syeDRzLzEvNC8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMzk2Mjc3MTc0NDMwNTUyMzY5Ny96cmgvMC85MDM3LzE2Lzk5OS8yNTgvMmEwMzoxYjIwOjY6Oi8wLjAwMC8xNjQ4MDg3NzgzLzE2NDgxMDAzODMvNC9wdWItNTM4OTY0NTk4MzUyMzYxMC8/ODpoKFRufI2gSYzwrJKWiKJC2tQ&nodeid=2633&group=zrh&auctionid=3962771744305523697&shardkey=3962771744305523697&sid=11142481&cid=10406291&bp=a_bjiibd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.133.235&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCSASb59I7YsK8NLeux_AP7-CWyAjPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi01Mzg5NjQ1OTgzNTIzNjEwyAEJqAMBqgSIAk_QjXJkrbcggwHeI6dOzy0s0nmiVCNhS9ErPpMDciT68BkpVlF_rKELDishKbiFjmOU3fCvhjvsjSMTAg8wGbQypXPgzT65bSG43K9anSGmgRhpLyEC44bbvIyy0DQVgPXqI7B8H-LquDgkuGWjgW-AZsIF5rbuSzPHn8UrT1lkUeP4yDz-J1Cpp1fIjqxtSQp9xdITfvRLxFXJoeKZiQt-dgIDVvcFcinX5NgXBYcC7B0yf4YU2vAWh_VHCQNqUS6xCYi3rtdJiByWTXmxwixAzHUFPuOrc3P4JQUbegLrk3B1gI2U_1y7GMSrjkxZnddr8eSVxeMTebDKmkf-jQJ3sJDliJwwQoAGh-uT36LvmL9goAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_193ZXno3XPO38MIYPebIaiyNe82g%26client%3Dca-pub-5389645983523610%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.305.0 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 24 Mar 2022 02:09:44 GMT
Server: MMBD/3.305.0
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x65, zrh-bidder-x147
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Thu, 24 Mar 2022 02:09:43 GMT

GET
H/1.1 200
OK request.php Show response
hal900030.redintelligence.net/ Frame 5C43 613 B
772 B 95ms
59ms Script
application/x-javascript 136.243.149.243
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900030.redintelligence.net/request.php?zone=ynpsxyk40ika&nw=20&renderingType=javascript&namespace=90c31c568d&subid=&uid=c1756a19f48c2bab&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYjvS5wAOk2sK4DaKLg1Bpw%26exch_seat%3D20035004448%26mt_aid%3D3962771744305523697%26mt_id%3D10406291%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dd786623b-d2e8-4801-8374-76c392c1e9eb%26mt_cid%3Dd786623b-d2e8-4801-8374-76c392c1e9eb%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCSASb59I7YsK8NLeux_AP7-CWyAjPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi01Mzg5NjQ1OTgzNTIzNjEwyAEJqAMBqgSIAk_QjXJkrbcggwHeI6dOzy0s0nmiVCNhS9ErPpMDciT68BkpVlF_rKELDishKbiFjmOU3fCvhjvsjSMTAg8wGbQypXPgzT65bSG43K9anSGmgRhpLyEC44bbvIyy0DQVgPXqI7B8H-LquDgkuGWjgW-AZsIF5rbuSzPHn8UrT1lkUeP4yDz-J1Cpp1fIjqxtSQp9xdITfvRLxFXJoeKZiQt-dgIDVvcFcinX5NgXBYcC7B0yf4YU2vAWh_VHCQNqUS6xCYi3rtdJiByWTXmxwixAzHUFPuOrc3P4JQUbegLrk3B1gI2U_1y7GMSrjkxZnddr8eSVxeMTebDKmkf-jQJ3sJDliJwwQoAGh-uT36LvmL9goAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_193ZXno3XPO38MIYPebIaiyNe82g%2526client%253Dca-pub-5389645983523610%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-5389645983523610%26output%3Dhtml%26h%3D600%26adk%3D595182048%26adf%3D572165612%26pi%3Dt.aa~a.2242084310~rp.4%26w%3D300%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1648087783%26rafmt%3D1%26to%3Dqs%26pwprc%3D1353055134%26psa%3D0%26format%3D300x600%26url%3Dhttps%253A%252F%252Fcisomag.eccouncil.org%252Flapsus-ransomware-targets-media-firms-in-portugal%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D4%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1648087783147%26bpp%3D3%26bdt%3D1835%26idt%3D3%26shv%3Dr20220317%26mjsv%3Dm202203170101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D54a2b546abe038e9-22a9422963cd0063%253AT%253D1648087783%253ART%253D1648087783%253AS%253DALNI_MZBsL2ywRIPRIM4lxzm3l0DC0GJVg%26prev_fmts%3D0x0%26nras%3D2%26correlator%3D920607142486%26frm%3D20%26pv%3D1%26ga_vid%3D1897234737.1648087782%26ga_sid%3D1648087782%26ga_hid%3D1917416453%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D991%26ady%3D1565%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C21066435%26oid%3D2%26pvsid%3D1823385132476362%26pem%3D654%26tmod%3D805977650%26uas%3D0%26nvt%3D1%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D2%26uci%3Da!2%26btvi%3D1%26fsb%3D1%26xpc%3D0BAjZ7FgDq%26p%3Dhttps%253A%2F%2Fcisomag.eccouncil.org%26dtd%3D25&ancestorOrigins=null&random=3488793737779&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/ynpsxyk40ika?subid=&gdpr=1&gdpr_consent=li&rnd=3962771744305523697&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYjvS5wAOk2sK4DaKLg1Bpw%26exch_seat%3D20035004448%26mt_aid%3D3962771744305523697%26mt_id%3D10406291%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dd786623b-d2e8-4801-8374-76c392c1e9eb%26mt_cid%3Dd786623b-d2e8-4801-8374-76c392c1e9eb%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCSASb59I7YsK8NLeux_AP7-CWyAjPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi01Mzg5NjQ1OTgzNTIzNjEwyAEJqAMBqgSIAk_QjXJkrbcggwHeI6dOzy0s0nmiVCNhS9ErPpMDciT68BkpVlF_rKELDishKbiFjmOU3fCvhjvsjSMTAg8wGbQypXPgzT65bSG43K9anSGmgRhpLyEC44bbvIyy0DQVgPXqI7B8H-LquDgkuGWjgW-AZsIF5rbuSzPHn8UrT1lkUeP4yDz-J1Cpp1fIjqxtSQp9xdITfvRLxFXJoeKZiQt-dgIDVvcFcinX5NgXBYcC7B0yf4YU2vAWh_VHCQNqUS6xCYi3rtdJiByWTXmxwixAzHUFPuOrc3P4JQUbegLrk3B1gI2U_1y7GMSrjkxZnddr8eSVxeMTebDKmkf-jQJ3sJDliJwwQoAGh-uT36LvmL9goAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_193ZXno3XPO38MIYPebIaiyNe82g%2526client%253Dca-pub-5389645983523610%2526adurl%253D%26redirect%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 136.243.149.243 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.243.149.243.136.clients.your-server.de
Software: Apache /
Resource Hash: 1a4a2e3ff8af40ae480d9b2729225b135b6c6603c6a94b9b0a998af88cc25846

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 24 Mar 2022 02:09:44 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 89055100012235204380388011908030
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 329
Expires: Thu, 24 Mar 2022 02:09:44 +0100

GET
H/1.1 200
OK request_content.php Show response
hal900030.redintelligence.net/ Frame 6B18 4 KB
2 KB 38ms
14ms Document
text/html 136.243.149.243
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900030.redintelligence.net/request_content.php?s=89055100012235204380388011908030&a=b7ec1e84
Requested by: Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request.php?zone=ynpsxyk40ika&nw=20&renderingType=javascript&namespace=90c31c568d&subid=&uid=c1756a19f48c2bab&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYjvS5wAOk2sK4DaKLg1Bpw%26exch_seat%3D20035004448%26mt_aid%3D3962771744305523697%26mt_id%3D10406291%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Dd786623b-d2e8-4801-8374-76c392c1e9eb%26mt_cid%3Dd786623b-d2e8-4801-8374-76c392c1e9eb%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCSASb59I7YsK8NLeux_AP7-CWyAjPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi01Mzg5NjQ1OTgzNTIzNjEwyAEJqAMBqgSIAk_QjXJkrbcggwHeI6dOzy0s0nmiVCNhS9ErPpMDciT68BkpVlF_rKELDishKbiFjmOU3fCvhjvsjSMTAg8wGbQypXPgzT65bSG43K9anSGmgRhpLyEC44bbvIyy0DQVgPXqI7B8H-LquDgkuGWjgW-AZsIF5rbuSzPHn8UrT1lkUeP4yDz-J1Cpp1fIjqxtSQp9xdITfvRLxFXJoeKZiQt-dgIDVvcFcinX5NgXBYcC7B0yf4YU2vAWh_VHCQNqUS6xCYi3rtdJiByWTXmxwixAzHUFPuOrc3P4JQUbegLrk3B1gI2U_1y7GMSrjkxZnddr8eSVxeMTebDKmkf-jQJ3sJDliJwwQoAGh-uT36LvmL9goAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBwiA4YAQEAH6CwIIAYAMAdAVAYAXAQ%2526num%253D1%2526sig%253DAOD64_193ZXno3XPO38MIYPebIaiyNe82g%2526client%253Dca-pub-5389645983523610%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-5389645983523610%26output%3Dhtml%26h%3D600%26adk%3D595182048%26adf%3D572165612%26pi%3Dt.aa~a.2242084310~rp.4%26w%3D300%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1648087783%26rafmt%3D1%26to%3Dqs%26pwprc%3D1353055134%26psa%3D0%26format%3D300x600%26url%3Dhttps%253A%252F%252Fcisomag.eccouncil.org%252Flapsus-ransomware-targets-media-firms-in-portugal%252F%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D4%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%26dt%3D1648087783147%26bpp%3D3%26bdt%3D1835%26idt%3D3%26shv%3Dr20220317%26mjsv%3Dm202203170101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D54a2b546abe038e9-22a9422963cd0063%253AT%253D1648087783%253ART%253D1648087783%253AS%253DALNI_MZBsL2ywRIPRIM4lxzm3l0DC0GJVg%26prev_fmts%3D0x0%26nras%3D2%26correlator%3D920607142486%26frm%3D20%26pv%3D1%26ga_vid%3D1897234737.1648087782%26ga_sid%3D1648087782%26ga_hid%3D1917416453%26ga_fc%3D1%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D991%26ady%3D1565%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C21066435%26oid%3D2%26pvsid%3D1823385132476362%26pem%3D654%26tmod%3D805977650%26uas%3D0%26nvt%3D1%26eae%3D0%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26ifi%3D2%26uci%3Da!2%26btvi%3D1%26fsb%3D1%26xpc%3D0BAjZ7FgDq%26p%3Dhttps%253A%2F%2Fcisomag.eccouncil.org%26dtd%3D25&ancestorOrigins=null&random=3488793737779&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 136.243.149.243 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.243.149.243.136.clients.your-server.de
Software: Apache /
Resource Hash: 9e8cf1439188194d4e3222a19a109b5aecc5aabb6dcebfffa566ab3665510be6

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

Date: Thu, 24 Mar 2022 02:09:44 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Thu, 24 Mar 2022 02:09:44 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1419
Connection: close
Content-Type: text/html; charset=utf-8

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 76E4 1 KB
749 B 39ms
39ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Wed, 23 Mar 2022 05:53:44 GMT
expires: Thu, 24 Mar 2022 05:53:44 GMT
cache-control: public, max-age=86400
age: 72960
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 5C43 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 90c81de9c1a4846e00e1de7ce41abffed514ff9218437e261b5b8340ce1112f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 / Show response
track.adform.net/adfscript/ Frame 6B18 747 B
942 B 97ms
20ms Script
text/javascript 37.157.4.41
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfscript/?bn=53795677;click=https%3A%2F%2Fhal900030.redintelligence.net%2Fc%2Fpe7zkn9wkeyb5bd%3Ftprde%3D

Requested by

Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request_content.php?s=89055100012235204380388011908030&a=b7ec1e84

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

f44dcc0cc08966be1118e3d100c9b40144c927fbb9e51637460efbb393d91160

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 549
expires: -1

GET
H/1.1 200
OK viewability Show response
hal900030.redintelligence.net/ Frame 6B18 0
150 B 41ms
16ms Script
text/html 136.243.149.243
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900030.redintelligence.net/viewability?s=89055100012235204380388011908030&a=dd2a1a51&vb=m
Requested by: Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request_content.php?s=89055100012235204380388011908030&a=b7ec1e84
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 136.243.149.243 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.243.149.243.136.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/request_content.php?s=89055100012235204380388011908030&a=b7ec1e84
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Thu, 24 Mar 2022 02:09:44 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 76E4
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENF6GpEfVfpteea5PlBhAc8&google_cver=1&google_push=AYg5qPL7Dk63LTSEMyTM6IFK7N9a70uXVTbS9mpM0tfSSQOza06Dwe0C0S...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPL7Dk63LTSEMyTM6IFK7N9a70uXVTbS9mpM0tfSSQOza06Dwe0C0SWr02zoBsnzvHD8mymdSK7qC6F9qDq8KyraQfoaM8Q&google_hm=hSPdnUdu8r9OP...

170 B
188 B

50ms
47ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPL7Dk63LTSEMyTM6IFK7N9a70uXVTbS9mpM0tfSSQOza06Dwe0C0SWr02zoBsnzvHD8mymdSK7qC6F9qDq8KyraQfoaM8Q&google_hm=hSPdnUdu8r9OPIaQQHIpyw

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPL7Dk63LTSEMyTM6IFK7N9a70uXVTbS9mpM0tfSSQOza06Dwe0C0SWr02zoBsnzvHD8mymdSK7qC6F9qDq8KyraQfoaM8Q&google_hm=hSPdnUdu8r9OPIaQQHIpyw
pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 76E4
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEEUaEnUJ0rhwY8IZAHPYPi4&google_cver=1&google_push=AYg5qPLvGBQGYE7x3vvfRkMlAxK3xfaaIRB7G5tJmT2hLp5cixabUXL1AznCtjOy3N1FOcOlx4_LQfN-LiH2krQmLdrelNGUhc4e
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLvGBQGYE7x3vvfRkMlAxK3xfaaIRB7G5tJmT2hLp5cixabUXL1AznCtjOy3N1FOcOlx4_LQfN-LiH2krQmLdrelNGUhc4e&google_hm=Q0FFU0VFVWFFblVKMHJod...

170 B
188 B

48ms
47ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLvGBQGYE7x3vvfRkMlAxK3xfaaIRB7G5tJmT2hLp5cixabUXL1AznCtjOy3N1FOcOlx4_LQfN-LiH2krQmLdrelNGUhc4e&google_hm=Q0FFU0VFVWFFblVKMHJod1k4SVpBSFBZUGk0

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 24 Mar 2022 02:09:44 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLvGBQGYE7x3vvfRkMlAxK3xfaaIRB7G5tJmT2hLp5cixabUXL1AznCtjOy3N1FOcOlx4_LQfN-LiH2krQmLdrelNGUhc4e&google_hm=Q0FFU0VFVWFFblVKMHJod1k4SVpBSFBZUGk0
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 76E4
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPJhLme5ZAB4KZMWDDHKXKsHDX9MKyhsb3HXcRaTrC8ozs4XbkRtBPFx3KHcDGx68IqxX7CUNln1apmP9XIeUoKLCjHzSoUz&google_gid=CAESEEX4ON6Gw5vC-NFFvsig4dg&goo...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCOil75EGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BWWc1cVBKaExtZTVaQUI0S1pNV0RESEtYS3NIRFg5TUt5aHNiM0hYY1JhVHJDOG96czRYYmtSdEJQRngzS0hjREd4NjhJcXhYN0NVTmxuMWFwbVA5WE...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwU21EWVpaV1Y2OEpVQlFwTEpZeWRQVUNycW5qV1FSNlZXdGcxVUd3MUV5aw==&google_push

170 B
188 B

47ms
46ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwU21EWVpaV1Y2OEpVQlFwTEpZeWRQVUNycW5qV1FSNlZXdGcxVUd3MUV5aw==&google_push

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 24 Mar 2022 02:09:44 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwU21EWVpaV1Y2OEpVQlFwTEpZeWRQVUNycW5qV1FSNlZXdGcxVUd3MUV5aw==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3 200 dds
rtb.openx.net/sync/ Frame 76E4 43 B
64 B 39ms
21ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEH08A0j1vn5w6srnLfS53Z0&google_cver=1&google_push=AYg5qPJcj1ue-zrkVhWmJ4L8lwxNY_WXnjL0xKYvXZ0LRdnI5PR0w2p5yAxuYnH0VbjuJlt4EWyFKTZurlJT5gGlknfcAefvRw65
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5389645983523610&output=html&h=600&adk=595182048&adf=572165612&pi=t.aa~a.2242084310~rp.4&w=300&fwrn=4&fwrnh=100&lmt=1648087783&rafmt=1&to=qs&pwprc=1353055134&psa=0&format=300x600&url=https%3A%2F%2Fcisomag.eccouncil.org%2Flapsus-ransomware-targets-media-firms-in-portugal%2F&fwr=0&pra=3&rpe=1&resp_fmts=4&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1648087783147&bpp=3&bdt=1835&idt=3&shv=r20220317&mjsv=m202203170101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D54a2b546abe038e9-22a9422963cd0063%3AT%3D1648087783%3ART%3D1648087783%3AS%3DALNI_MZBsL2ywRIPRIM4lxzm3l0DC0GJVg&prev_fmts=0x0&nras=2&correlator=920607142486&frm=20&pv=1&ga_vid=1897234737.1648087782&ga_sid=1648087782&ga_hid=1917416453&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=991&ady=1565&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C21066435&oid=2&pvsid=1823385132476362&pem=654&tmod=805977650&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=0BAjZ7FgDq&p=https%3A//cisomag.eccouncil.org&dtd=25
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:43 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 45mtm3qn9jr0d4t5pu5tje3dkq6oblu6

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 76E4
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=LFhfxxk4QS2AYP6Hm7r9pg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

46ms
46ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=LFhfxxk4QS2AYP6Hm7r9pg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLrXyHv_FvKTWqWFrHoX0aRPY0wOadvzoJ8Gn6Mm_913NRjVXhirnX0_35uMQJU7beDAzZ1aPXBW_kVPZb6gMh8Pb6vt5SK

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:45 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=LFhfxxk4QS2AYP6Hm7r9pg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLrXyHv_FvKTWqWFrHoX0aRPY0wOadvzoJ8Gn6Mm_913NRjVXhirnX0_35uMQJU7beDAzZ1aPXBW_kVPZb6gMh8Pb6vt5SK
date: Thu, 24 Mar 2022 02:09:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 76E4
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEGQrQ-znpmzoAXevz-GOXT0&google_cver=1&google_push=AYg5qPLRdFn6gGr4qKx64STjGj1CvCYxAXvZBx368ntfWwh4QM9avXpl-ycMN6IkMBW-A-Zjc3o...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDE0Q1dYREMtMVEtNFVIMQ==&google_push=AYg5qPLRdFn6gGr4qKx64STjGj1CvCYxAXvZBx368ntfWwh4QM9avXpl-ycMN6IkMBW-A-Zjc3o1wMGYZ-WK-24b7Ir8GNCgqYpr

170 B
188 B

47ms
46ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDE0Q1dYREMtMVEtNFVIMQ==&google_push=AYg5qPLRdFn6gGr4qKx64STjGj1CvCYxAXvZBx368ntfWwh4QM9avXpl-ycMN6IkMBW-A-Zjc3o1wMGYZ-WK-24b7Ir8GNCgqYpr

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDE0Q1dYREMtMVEtNFVIMQ==&google_push=AYg5qPLRdFn6gGr4qKx64STjGj1CvCYxAXvZBx368ntfWwh4QM9avXpl-ycMN6IkMBW-A-Zjc3o1wMGYZ-WK-24b7Ir8GNCgqYpr
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4cdacfaa68e4ab216fffbcc107c5b898
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 76E4
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 76E4 0
12 B 45ms
44ms Image
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KVYHvEYaraMreEnafw1I6M7DEsukmLmKCy39eRdnHTjGH22XOhdvOScZe3b6ezWkn2WYG6

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:44 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 bootstrap.js Show response
s1.adform.net/stoat/626/s1.adform.net/ Frame 6B18 33 KB
16 KB 107ms
26ms Script
text/javascript 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Requested by: Host: track.adform.net
URL: https://track.adform.net/adfscript/?bn=53795677;click=https%3A%2F%2Fhal900030.redintelligence.net%2Fc%2Fpe7zkn9wkeyb5bd%3Ftprde%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 3d0bf782b47dcd079eedf6bb34ecb0742c114a4e4b90e37a58a412482101b475

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:44 GMT
content-encoding: gzip
last-modified: Thu, 10 Feb 2022 15:16:56 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Fri, 25 Mar 2022 04:59:07 GMT

POST
H2 204 collect Show response
k.clarity.ms/ 0
48 B 95ms
95ms XHR
text/plain 20.96.88.162
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://k.clarity.ms/collect
Requested by: Host: k.clarity.ms
URL: https://k.clarity.ms/s/0.6.31/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.96.88.162 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://cisomag.eccouncil.org/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

access-control-allow-origin: https://cisomag.eccouncil.org
date: Thu, 24 Mar 2022 02:09:44 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:e97341f6-8fff-46a6-9229-fbbfe0892c78

GET
H2 200 / Show response
track.adform.net/adfserve/ Frame 6B18 4 KB
2 KB 21ms
21ms Script
text/javascript 37.157.4.41
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfserve/?CC=1&bn=53795677;click=https%3A%2F%2Fhal900030.redintelligence.net%2Fc%2Fpe7zkn9wkeyb5bd%3Ftprde%3D;js=1;adfxid=1x;7116;set=en-US|en-US|1600X1200|0|300|600|24|8|3|7|1|;cmpgdpr=;cmpgdprconsent=;fd=0|0&CREFURL=https%3A%2F%2Fcisomag.eccouncil.org

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8a5a5c1282884251d11a64377b7a181176d83358531932dc08d3eb6b6b1f2a04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 2020
expires: -1

GET
DATA 200
OK truncated
/ Frame 6B18 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 157 KB
54 KB 60ms
60ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5389645983523610

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c86dc6c22f417978d42ea9bcb38e8ea9776f853bee15c914370d5e51ab6e329c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54810
x-xss-protection: 0
server: cafe
etag: 9558087595990320245
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 24 Mar 2022 02:09:44 GMT

POST
H2 200 admin-ajax.php Show response
cisomag.eccouncil.org/wp-admin/ 131 B
585 B 1057ms
1056ms XHR
application/json 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-admin/admin-ajax.php

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9db2244af7a5c4b6485ee859eebac070dd2bb5d6caf057b8c86fd7d6d53f4440

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://cisomag.eccouncil.org/
X-Requested-With: XMLHttpRequest
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Thu, 24 Mar 2022 02:09:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
ki-edge: v=17.2
ki-cf-cache-status: BYPASS
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin, strict-origin
ki-edge-o2o: yes
server: cloudflare
cache-control: no-cache, must-revalidate, max-age=0
x-frame-options: SAMEORIGIN, SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json; charset: utf-8
access-control-allow-origin: https://cisomag.eccouncil.org
x-robots-tag: noindex
access-control-allow-credentials: true
ki-cache-type: None
cf-ray: 6f0bddd048df6903-FRA
x-edge-location-klb: 1
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?CtsSyncId=6346B796BC0947DF893E86D242639494&RedC=c.clarity.ms&MXFR=32B4E06AD2E667CF14D2F11BD6E669F1
https://c.clarity.ms/c.gif?CtsSyncId=6346B796BC0947DF893E86D242639494&MUID=3AF6E30D6E6E6D093109F27C6FBC6CDB

42 B
370 B

26ms
25ms

Image
image/gif

52.142.114.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?CtsSyncId=6346B796BC0947DF893E86D242639494&MUID=3AF6E30D6E6E6D093109F27C6FBC6CDB
Protocol: H2
Server: 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
last-modified: Fri, 18 Mar 2022 19:39:54 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "8120eaf0ff3ad81:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:44 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 696CCE5EF4A8429BBF6CAF12BD87BE43 Ref B: FRAEDGE1206 Ref C: 2022-03-24T02:09:45Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?CtsSyncId=6346B796BC0947DF893E86D242639494&MUID=3AF6E30D6E6E6D093109F27C6FBC6CDB
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
10 KB 99ms
52ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220317&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0719bf495870e1f8033d9fa87dc9f6b3d10895c67e7698e92356f6eec8611d7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 24 Mar 2022 02:09:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10521
x-xss-protection: 0

GET
H2 200 Ciso-mag-jan-2022_400x518.jpg
cisomag.eccouncil.org/wp-content/uploads/2022/01/ 49 KB
49 KB 18ms
16ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2022/01/Ciso-mag-jan-2022_400x518.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f5263afadde0cdcfcd27efddbb2a4cf0e51b5764e7454c4de54cad777ad032d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:45 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.2
age: 17785
cf-polished: origFmt=jpeg, origSize=135180
content-disposition: inline; filename="Ciso-mag-jan-2022_400x518.webp"
vary: Accept
content-length: 49856
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Thu, 13 Jan 2022 12:38:30 GMT
server: cloudflare
etag: "61e01d46-2100c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:45 GMT
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddd079026903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 cciso_sidebar.jpg
cisomag.eccouncil.org/wp-content/uploads/2021/10/ 16 KB
16 KB 24ms
22ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2021/10/cciso_sidebar.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9e4b0045c300ae5ca73a4ccc90fff6080a3a0c8ba72ee4e4a7342e66b3b27a46

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:45 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2041128
cf-polished: origFmt=jpeg, origSize=39248
content-disposition: inline; filename="cciso_sidebar.webp"
vary: Accept
content-length: 15886
ki-edge-o2o: yes
last-modified: Thu, 14 Oct 2021 05:33:23 GMT
server: cloudflare
etag: "6167c123-9950"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:45 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddd079036903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 boxbanner-1.gif
cisomag.eccouncil.org/wp-content/uploads/2021/07/ 61 KB
61 KB 20ms
18ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2021/07/boxbanner-1.gif

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fd4503b5368b174f1f643fe3499e2e185b3ebf241c6c88242708b917a97fe61

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:45 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.1
age: 578448
cf-polished: origFmt=gif, origSize=106894
content-disposition: inline; filename="boxbanner-1.webp"
vary: Accept
content-length: 62426
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Fri, 16 Jul 2021 06:47:25 GMT
server: cloudflare
etag: "60f12b7d-1a18e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:45 GMT
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddd079046903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 editorial-calendar.jpg
cisomag.eccouncil.org/wp-content/uploads/2020/12/ 13 KB
13 KB 24ms
23ms Image
image/jpeg 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2020/12/editorial-calendar.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9af8177a89a477ba8b031682b1f1deec3965908577a5c46b6a8527b4fa684cb6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:45 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2285686
cf-polished: origSize=14197, status=webp_bigger
vary: Accept-Encoding
content-length: 13396
last-modified: Tue, 29 Dec 2020 11:41:42 GMT
server: cloudflare
etag: "5feb15f6-3775"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:45 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddd079056903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 CISO-Mag-Banner-728x90-1.jpg
cisomag.eccouncil.org/wp-content/uploads/2021/08/ 19 KB
20 KB 19ms
17ms Image
image/jpeg 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2021/08/CISO-Mag-Banner-728x90-1.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d432c7edb51b553b7a6045a10a08a56a58307238ffffb42f0fccdf2c6a6312a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:45 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=17.1
age: 578712
cf-polished: origSize=20829, status=webp_bigger
vary: Accept-Encoding
content-length: 19868
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Fri, 11 Feb 2022 13:40:17 GMT
server: cloudflare
etag: "62066741-515d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:45 GMT
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bddd079066903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 CISOMag_6Oct.jpg
cisomag.eccouncil.org/wp-content/uploads/2021/10/ 40 KB
40 KB 21ms
19ms Image
image/webp 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2021/10/CISOMag_6Oct.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd31cd40f50febfe5d230818e64e8fa916664a9e1f38d6a6d3ba420d5605ac51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:45 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
ki-edge: v=16.8
age: 2811260
cf-polished: origFmt=jpeg, origSize=75430
content-disposition: inline; filename="CISOMag_6Oct.webp"
vary: Accept
content-length: 41178
last-modified: Thu, 14 Oct 2021 05:31:50 GMT
server: cloudflare
etag: "6167c0c6-126a6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/webp
access-control-allow-origin: *
expires: Sun, 21 Mar 2032 02:09:45 GMT
cache-control: public, max-age=315360000
accept-ranges: bytes
cf-ray: 6f0bddd079076903-FRA
x-edge-location-klb: 1
cf-bgj: imgq:100,h2pri

GET
H2 200 Standard Show response
s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/ Frame 6B18 90 KB
39 KB 39ms
39ms Script
text/javascript 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: f7e06ae449bdd4ebece6e26cdb36840f7cb19f28b57bbb6b8647a54535557d3f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:45 GMT
content-encoding: gzip
last-modified: Thu, 10 Feb 2022 15:16:56 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Fri, 25 Mar 2022 04:59:43 GMT

POST
H2 200 rum Show response
cisomag.eccouncil.org/cdn-cgi/ 0
238 B 15ms
15ms XHR
text/plain 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://cisomag.eccouncil.org/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
content-type: application/json

Response headers

date: Thu, 24 Mar 2022 02:09:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://cisomag.eccouncil.org
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 6f0bddd089136903-FRA
vary: Origin

POST
H2 200 /
track.adform.net/csimpr/ Frame 6B18 35 B
478 B 21ms
20ms Ping
image/gif 37.157.4.41
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/csimpr/?bn=53795677&csi=Yq37sNTZL9oiMvt1fMdDvJmz0rMdij4BmoGpSmqCskPrygPkIxxfk0rba8pXrLDu9oi4Wnn_UY4sWJR2cgd5Rd6vWmW1dlSa0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://hal900030.redintelligence.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:45 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://hal900030.redintelligence.net
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 51ms
47ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 24 Mar 2022 02:09:45 GMT

GET
H2 200 10998790.js Show response
s1.adform.net/Banners/Elements/Files/160090/10998790/ Frame 85D4 105 KB
23 KB 30ms
30ms Script
application/x-javascript 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998790/10998790.js?ADFassetID=10998790&bv=258

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/lapsus-ransomware-targets-media-firms-in-portugal/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

08392ff877c5d17c9e4794b9c47c1b671b9501fbfeb78c906438008ee78aa87d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:45 GMT
content-encoding: gzip
last-modified: Fri, 11 Mar 2022 09:43:54 GMT
server: nginx
etag: W/"622b19da-1a44c"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

GET
H2 200 Adform.DHTML.js Show response
s1.adform.net/banners/scripts/rmb/ Frame 85D4 30 KB
13 KB 30ms
30ms Script
application/x-javascript 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js?bv=626
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: bea63616949c80ff0dfdbb1e8547f1585882fc691483317b06441688e3e5f14a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:45 GMT
content-encoding: gzip
last-modified: Fri, 14 May 2021 12:35:38 GMT
server: nginx
etag: W/"609e6e9a-76d9"
x-cache-status: HIT
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

GET
H2 200 Enabler.js Show response
s0.2mdn.net/ads/studio/ Frame 85D4 134 KB
46 KB 121ms
39ms Script
text/javascript 2a00:1450:4001:829::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/Enabler.js

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3705d0878203cc0b2525dcb0f874d85cc6b881d1fca1869191da4e599c768241

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 01:59:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 637
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46435
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:47:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Mar 2022 02:14:08 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 182F 13 KB
5 KB 39ms
39ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 23 Mar 2022 21:32:06 GMT
expires: Thu, 23 Mar 2023 21:32:06 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 16659
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame CF73 783 B
536 B 50ms
49ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d795c9895e1faf0346ff5d7712b4f4c4da1ff8069f382a1eeff21adca050bedd

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-QL7UoPJFyYHPLN9svKujRA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Thu, 24 Mar 2022 02:09:45 GMT
date: Thu, 24 Mar 2022 02:09:45 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-QL7UoPJFyYHPLN9svKujRA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Guojae3EGYR4c8nOY3QAJp6N_HyMY3qMC8IMY_l3vL8.js Show response
pagead2.googlesyndication.com/bg/ Frame 182F 35 KB
14 KB 42ms
39ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Guojae3EGYR4c8nOY3QAJp6N_HyMY3qMC8IMY_l3vL8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1aea2369edc419847873c9ce637400269e8dfc7c8c637a8c0bc20c63f977bcbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 23 Mar 2022 19:52:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 22647
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13802
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 23 Mar 2023 19:52:18 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame CF73 0
0 63ms
63ms Image
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220317&jk=1823385132476362&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 182F 0
9 B 39ms
38ms Image
text/plain 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?kbbnpA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 78ms
77ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220317&jk=1823385132476362&bg=!_P-l_7vNAAba2mK92to7ACkAdvg8WrjTuR9Bch2G46EVh_ajy6DR-hXhYUkKAEvdlPkxjxx6R8x8lQIAAACQUgAAAAZoAQcKAE0NdE1ofTgmlHlCIzprtZCnOtjghWFU0E629iVN1g87bi-0tjIWHIG0dt3OtqWAW5e59wkKya9f-vP3ST0mWArcusl2-DMbRtGipIIueZkC8JZynjeEaaQw3lP6t10hD3Oif60plL1NRy_xqV9Mpfs6motjdRMwRFcBxRFEKLJZpi1Wuvzv26QHmXRWhD4kul-f0BgRie4Xpx_E7Xix5z_uxVZnpkxokdmRPJdT2S95dI6BDKEwVDVl-wF-l5-pZwtpdE6GuR-H-ILTfdOqM0SSMfGrYGteSPOaNaPOkQay7NF9Pyysa_fSjS5rZAz42zmr62BEaTft6BwPcNmwvSN1yHMHgaartC2BJQVbwu3VPEjfc5YAZlUUrCj0lJQbp9V0wdTA6naYUm0NPLsXBohWxSo5l8LS5UpdhODNEdV7nL6ndcTidhw_WzxTsfFqaOmZAMk8LJDxAP2o5ATmqg5T6iMjv85wHB2vKtHQji9EWGU_uANxiqfWZbTrB6eZIsTcRdG8J4njmPcNDXKnDV28JK8jHm8qA8AZZsfeEDT-kbsM-W-ISwiHakoHnPp9C6p0llTdnYVWEZaiu590PcLw-0IkX5JNWuz1Vz9K8FuWhEQ4MKt4353PJdyX_Y-z6y9bI9_j57DNMHfm-oLZg81sgQslUFN38kfBh-NbicJ634hpu9EHPHznwPrOro6cVMc6Q7bB6E0v1Pb5-tt0Qvtwiquf0LadzYxQPKIAcRw873v5dtgN4r15zK5Wi7RQAWKI4UEC9K5pP_VgLUjz5SB4K8vdZS5cSAQwWSfz1badJVLiZa9QajJym-vkytvgons0W5HWkoinOfC27zeFA1iFB81VLQPrMskkXWzMWuNyNXgQi-A083Rym6QPAsoNyB_HSGaAwbrZWJeBwnbtYTlBtagyltUjqMHUAPkHql0xRgL-nRZBWh5y5hdVFjZFkCDPjssk0zG-6FMwXW6ba9rnmnMDZ7wgY7tP22SO3a2FdJpHLqH3yXwBENJKs4Xiitydj5SlLg7rLysGfFVZmtdKjJEuOZ8xRNHQsyYSnIz5H0__vjPd7DQZXiVi0LeJCI8Ekz9-tdiQAoMO7vGgu5gC

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 ajax-handler.php Show response
cisomag.eccouncil.org/wp-content/ 2 B
206 B 864ms
863ms XHR
text/html 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cisomag.eccouncil.org/wp-content/ajax-handler.php

Requested by

Host: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/wp-content/plugins/advanced-ads-tracking/public/assets/js/dist/tracking.min.js?ver=2.2.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cisomag.eccouncil.org/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Thu, 24 Mar 2022 02:09:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
ki-edge: v=17.2
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-xss-protection: 1; mode=block
ki-cf-cache-status: BYPASS
referrer-policy: strict-origin
ki-edge-o2o: yes
server: cloudflare
cache-control: no-cache, must-revalidate, max-age=0, smax-age=0
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
x-robots-tag: noindex
ki-cache-type: None
cf-ray: 6f0bddd6fdf76903-FRA
x-edge-location-klb: 1
expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 204 collect Show response
k.clarity.ms/ 0
48 B 95ms
95ms XHR
text/plain 20.96.88.162
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://k.clarity.ms/collect
Requested by: Host: k.clarity.ms
URL: https://k.clarity.ms/s/0.6.31/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.96.88.162 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://cisomag.eccouncil.org/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

access-control-allow-origin: https://cisomag.eccouncil.org
date: Thu, 24 Mar 2022 02:09:46 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:e97341f6-8fff-46a6-9229-fbbfe0892c78

GET
H2 200 cta2.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame 85D4 2 KB
2 KB 27ms
25ms Image
image/png 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/cta2.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

159ebfcc5f37ffb30a47afb3153e5f212fffd3e97cf7f528aecd64f2b98ec4c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:47 GMT
last-modified: Fri, 11 Mar 2022 09:43:54 GMT
server: nginx
etag: "622b19da-69b"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 1691

GET
H2 200 yellowtext.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame 85D4 4 KB
4 KB 27ms
25ms Image
image/png 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/yellowtext.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

864d8c914fa0df77f17e2652e997ce07f71b8f66f0b75a216681c4b004bce11c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:47 GMT
last-modified: Fri, 11 Mar 2022 09:43:55 GMT
server: nginx
etag: "622b19db-e50"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 3664

GET
H2 200 cta.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame 85D4 2 KB
2 KB 27ms
26ms Image
image/png 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/cta.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

7ec6524760febc1d37d614622d1b2c71ad5f2540fcbdc1d210a621c57d023a6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:47 GMT
last-modified: Fri, 11 Mar 2022 09:43:55 GMT
server: nginx
etag: "622b19db-8b5"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 2229

GET
H2 200 t.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame 85D4 4 KB
4 KB 28ms
27ms Image
image/png 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/t.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

df3ee6542919d7fa834f7a7c879fa5d099b3cbc12cee89b6d05016f76d2c6b97

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:47 GMT
last-modified: Fri, 11 Mar 2022 09:43:54 GMT
server: nginx
etag: "622b19da-ea5"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 3749

GET
H2 200 badges.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame 85D4 5 KB
5 KB 30ms
28ms Image
image/png 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/badges.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

32fd7d3af8cc39cd251f3b88469a44f5e778307f532e8810376ea503add096dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:47 GMT
last-modified: Fri, 11 Mar 2022 09:43:54 GMT
server: nginx
etag: "622b19da-1499"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 5273

GET
H2 200 text.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame 85D4 6 KB
6 KB 31ms
29ms Image
image/png 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/text.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

7502e034f95191b9c0cb8b3e31e342e54ac473e702dd98d0cf3323cb69d3a7f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:47 GMT
last-modified: Fri, 11 Mar 2022 09:43:54 GMT
server: nginx
etag: "622b19da-171b"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 5915

GET
H2 200 logo2.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame 85D4 3 KB
3 KB 31ms
30ms Image
image/png 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/logo2.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

bb677d7657006fb57417c73ef3da95da5ba9449790f75fb82a2f11afb18cdefb

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:47 GMT
last-modified: Fri, 11 Mar 2022 09:43:54 GMT
server: nginx
etag: "622b19da-b72"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 2930

GET
H2 200 pic.jpg
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame 85D4 40 KB
41 KB 35ms
34ms Image
image/jpeg 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/pic.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

2bb210405ba3e443ccf64c5b1d5bfdc42c6bd9a25337f854b8db45d4092de9bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:47 GMT
last-modified: Fri, 11 Mar 2022 09:43:54 GMT
server: nginx
etag: "622b19da-a1fd"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/jpeg
content-length: 41469

GET
H2 200 logo1.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame 85D4 4 KB
5 KB 42ms
41ms Image
image/png 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/logo1.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

35861a24167aa45139a124bb7979a78897393977570c8aa01b26f568b85a4eb6

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:47 GMT
last-modified: Fri, 11 Mar 2022 09:43:55 GMT
server: nginx
etag: "622b19db-113d"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 4413

GET
H2 200 bg.jpg
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame 85D4 7 KB
7 KB 44ms
43ms Image
image/jpeg 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/bg.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

2187408e0d1abf69f6c14789070e6e07abec61c41da1bcec63c33d0531fcb725

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900030.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:47 GMT
last-modified: Fri, 11 Mar 2022 09:43:54 GMT
server: nginx
etag: "622b19da-1c99"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/jpeg
content-length: 7321

GET
H2 200 Slider-CISO-MAG-001.jpg
cisomag.eccouncil.org/wp-content/uploads/2021/10/ 134 KB
134 KB 1283ms
1282ms Image
image/jpeg 2606:4700::6812:15fb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisomag.eccouncil.org/wp-content/uploads/2021/10/Slider-CISO-MAG-001.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:15fb , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee1d2f26d7c2a1cf9c7ac482db2dc7ce0554c9eec6a73fd9eaf8215d6097ea6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cisomag.eccouncil.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 24 Mar 2022 02:09:49 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
ki-edge: v=17.2
vary: Accept-Encoding
content-length: 136879
ki-cf-cache-status: BYPASS
ki-edge-o2o: yes
last-modified: Wed, 01 Dec 2021 09:23:54 GMT
server: cloudflare
etag: "61a73f2a-216af"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=315360000
ki-cache-type: None
accept-ranges: bytes
cf-ray: 6f0bdde31ec56903-FRA
x-edge-location-klb: 1
expires: Sun, 21 Mar 2032 02:09:48 GMT

POST
H2 200 /
track.adform.net/serving/unload/ Frame 6B18 35 B
478 B 21ms
20ms Ping
image/gif 37.157.4.41
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/serving/unload/?version=15&unload=2744067830099156247@@53795677,2796997642746911671,0|0|0|0|0|0|0|0|0||0|1|||||1|0|0|3-vmwgS3qehcPlakbYq96UooneTphunAjnJpymKG3GDKj-g2p5dd-fL_QlhaeLlf0|||11||0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.41 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://hal900030.redintelligence.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 24 Mar 2022 02:09:50 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://hal900030.redintelligence.net
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cisomag.eccouncil.org
URL: https://cisomag.eccouncil.org/wp-content/plugins/webpushr-web-push-notifications/sdk_files/webpushr-sw.js.php

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1

Verdicts & Comments Add Verdict or Comment

326 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

56 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
cisomag.eccouncil.org/	1969-12-31 23:59:59	Name: PHPSESSID Value: b10d1a64cb218acb4a1677858454edea
cisomag.eccouncil.org/	1970-01-23 17:24:07	Name: advanced_ads_page_impressions Value: %7B%22expires%22%3A1963447782%2C%22data%22%3A1%7D
www.clarity.ms/	1970-01-20 10:33:43	Name: CLID Value: 4139cb068f05422ea174a9f51b5ec386.20220324.20230324
.eccouncil.org/	1970-01-20 03:57:43	Name: _gcl_au Value: 1.1.247296780.1648087782
.eccouncil.org/	1970-01-20 03:57:43	Name: _fbp Value: fb.1.1648087782010.1311288717
cisomag.eccouncil.org/	1970-01-20 02:31:19	Name: advanced_ads_browser_width Value: 1600
cisomag.eccouncil.org/	1970-01-20 10:33:43	Name: cookielawinfo-checkbox-necessary Value: yes
cisomag.eccouncil.org/	1970-01-20 10:33:43	Name: cookielawinfo-checkbox-functional Value: no
cisomag.eccouncil.org/	1970-01-20 10:33:43	Name: cookielawinfo-checkbox-performance Value: no
cisomag.eccouncil.org/	1970-01-20 10:33:43	Name: cookielawinfo-checkbox-analytics Value: no
cisomag.eccouncil.org/	1970-01-20 10:33:43	Name: cookielawinfo-checkbox-advertisement Value: no
cisomag.eccouncil.org/	1970-01-20 10:33:43	Name: cookielawinfo-checkbox-others Value: no
.eccouncil.org/	1970-01-20 19:19:19	Name: _ga_F0G4XCSHDL Value: GS1.1.1648087781.1.0.1648087781.0
.eccouncil.org/	1970-01-20 19:19:19	Name: _ga Value: GA1.2.1897234737.1648087782
.eccouncil.org/	1970-01-20 01:49:34	Name: _gid Value: GA1.2.1479648601.1648087782
.eccouncil.org/	1970-01-20 01:48:07	Name: _gat_UA-102314306-1 Value: 1
.eccouncil.org/	1970-01-20 11:09:43	Name: __gads Value: ID=54a2b546abe038e9-22a9422963cd0063:T=1648087783:RT=1648087783:S=ALNI_MZBsL2ywRIPRIM4lxzm3l0DC0GJVg
.eccouncil.org/	1970-01-20 10:33:43	Name: _clck Value: 1hov924\|1\|f01\|0
.eccouncil.org/	1970-01-20 01:49:34	Name: _clsk Value: 1vr7mqh\|1648087783056\|1\|1\|k.clarity.ms/collect
.doubleclick.net/	1970-01-20 11:09:43	Name: IDE Value: AHWqTUlqvxNA431knHITQccjnpo54YgOZxiKW3kR_ZvYfqZqrh95vjrJwfnePwdR2Cs
m.stripe.com/	1970-01-20 19:19:19	Name: m Value: ee27a559-fa08-48c9-a9a6-224295b90b2c43fb88
.cisomag.eccouncil.org/	1970-01-20 10:33:43	Name: __stripe_mid Value: 86ae2b70-10f1-4434-9f5d-e29858553e42656606
.cisomag.eccouncil.org/	1970-01-20 01:48:09	Name: __stripe_sid Value: 3a4cb64d-51ba-493c-8d31-7b23c17cd9c274c596
crm.zoho.com/	1969-12-31 23:59:59	Name: crmcsr Value: b1d73250-0943-469a-bd6e-df7938d02d7a
.quantserve.com/	1970-01-20 03:57:43	Name: d Value: EGMBCQHeJYEA
.quantserve.com/	1970-01-20 11:18:22	Name: mc Value: 623bd2e8-46e92-0c8d3-ce623
.casalemedia.com/	1970-01-20 10:33:43	Name: CMID Value: YjvS6Cbz2ekrPx79-LtWcQAA
.casalemedia.com/	1970-01-20 03:57:43	Name: CMPS Value: 3268
.casalemedia.com/	1970-01-20 03:57:43	Name: CMPRO Value: 1178
.casalemedia.com/	1970-01-20 01:49:34	Name: CMST Value: YjvS6GI70ugA
.innovid.com/	1970-01-20 03:57:43	Name: uuid Value: 789a3076-53e7-4d29-ac16-f058e94a8207-20220323 22:09:44
.doubleclick.net/	1970-01-20 01:48:11	Name: DSID Value: NO_DATA
.mathtag.com/	1970-01-20 10:33:43	Name: uuid Value: d786623b-d2e8-4801-8374-76c392c1e9eb
.e.dlx.addthis.com/	1970-01-20 11:18:22	Name: na_tc Value: Y
.addthis.com/	1970-01-20 11:18:22	Name: na_id Value: 2022032402094400033608261684
.addthis.com/	1970-01-20 11:18:22	Name: na_tc Value: Y
.addthis.com/	1970-01-20 11:18:22	Name: uid Value: 623bd2e8e91d7d00
.addthis.com/	1970-01-20 11:18:22	Name: ouid Value: 623bd2e80001e1936a2920be20500b2e40050622190941a4ff8b
.dlx.addthis.com/	1970-01-20 02:31:19	Name: na_rn Value: 0
.dlx.addthis.com/	1970-01-20 02:31:19	Name: na_sr Value: 20220324
.dlx.addthis.com/	1970-01-20 01:48:07	Name: na_srp Value: 3614
.dlx.addthis.com/	1970-01-20 02:31:19	Name: na_sc_e Value: 0
.agkn.com/	1970-01-20 10:33:43	Name: ab Value: 0001%3ATWH311j8sNTFdOCRzB5PAWlj53fiZzCV
.agkn.com/	1970-01-20 10:33:43	Name: u Value: C\|0CEApzo9oKc6PaAAAAAAAAQ13AQCAAQpAAAAAAA
.rlcdn.com/	1970-01-20 10:33:43	Name: rlas3 Value: 65wE1CfiE4Dk5R5SJC2Bk9Bm6WGoFWSp4uWYNObUVS0=
.pubmatic.com/	1970-01-20 01:49:34	Name: KTPCACOOKIE Value: YES
.rlcdn.com/	1970-01-20 03:14:31	Name: pxrc Value: COil75EGEgUI6AcQABIGCOndKhAA
.adform.net/	1970-01-20 02:32:42	Name: C Value: 1
.adform.net/	1970-01-20 03:14:28	Name: uid Value: 2744067830099156247
.adform.net/	1970-01-20 01:58:08	Name: TPC Value: 1648087784903
.pubmatic.com/	1970-01-20 03:57:43	Name: KADUSERCOOKIE Value: 2C585FC7-1938-412D-8060-FE879BBAFDA6
.c.bing.com/	1970-01-20 11:09:43	Name: SRM_B Value: 3AF6E30D6E6E6D093109F27C6FBC6CDB
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 11:09:43	Name: MUID Value: 3AF6E30D6E6E6D093109F27C6FBC6CDB
.c.clarity.ms/	1970-01-20 01:48:08	Name: ANONCHK Value: 0
cisomag.eccouncil.org/	1970-01-20 02:31:19	Name: advanced_ads_pro_server_info Value: %7B%22vc_cache_reset%22%3A0%7D

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_push=AYg5qPJGRQRHgt6BKkgmkU9YQyP0Mw7IKNf6d_7-L3dnVrbaEUNQ7Ku35IKQM6QCGd8m5QzFjaOeK65xrsNBq7AgSSBERbXGI6ThhQ&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_cver=1 Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YjvS6Cbz2ekrPx79_LtWcQAABJoAAAAB&google_gid=CAESECsC0_5ficQWARwYA577LKE&google_push=AYg5qPJp9fnAsMz5CIY7fCMIGk3glDgEme3U4-zVfH2_1SyL7u-zUaPJ-_PBsP7C0iPuwqbRa8yinWGrH8wHQsX0Z58peXUC0pBQ&google_cver=1 Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
ag.innovid.com
analytics.webpushr.com
bot.webpushr.com
c.bing.com
c.clarity.ms
cdn.webpushr.com
cisomag.eccouncil.org
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
crm.zoho.com
d.agkn.com
e.dlx.addthis.com
edm-image.s3.us-west-2.amazonaws.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
hal9000.redintelligence.net
hal900030.redintelligence.net
id.rlcdn.com
image6.pubmatic.com
js.stripe.com
k.clarity.ms
m.stripe.com
m.stripe.network
maxcdn.bootstrapcdn.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.mathtag.com
pixel.rubiconproject.com
q.stripe.com
rtb.openx.net
s0.2mdn.net
s1.adform.net
secure.gravatar.com
static.cloudflareinsights.com
stats.g.doubleclick.net
tags.mathtag.com
tpc.googlesyndication.com
track.adform.net
www.clarity.ms
www.eccouncil.org
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
cisomag.eccouncil.org
cm.g.doubleclick.net
104.111.215.191
104.79.88.164
136.243.149.243
138.68.235.115
142.250.181.226
142.250.185.130
144.76.91.199
151.101.0.176
167.71.57.196
185.29.132.242
192.82.242.209
20.96.88.162
204.141.42.49
2600:9000:223e:e200:19:7d10:bd80:93a1
2606:4700:440e::ac40:9c1a
2606:4700::6812:14fb
2606:4700::6812:15fb
2606:4700::6812:acf
2620:116:800d:21:fcb8:22d2:d390:5f1b
2620:1ec:27::cafe:2154
2620:1ec:c11::200
2a00:1450:4001:801::2001
2a00:1450:4001:803::2003
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2002
2a00:1450:4001:810::2004
2a00:1450:4001:812::200a
2a00:1450:4001:827::2002
2a00:1450:4001:829::2006
2a00:1450:4001:82a::2003
2a00:1450:4001:82f::2008
2a00:1450:4001:830::200e
2a00:1450:400c:c02::9d
2a03:2880:f008:8:face:b00c:0:1
2a03:2880:f108:83:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
2a05:d01c:1d8:8100:8701:aae2:1118:ca9
3.126.56.108
34.211.187.4
35.186.253.211
35.244.174.68
37.157.2.248
37.157.4.41
52.142.114.2
52.218.241.113
54.187.159.182
64.225.42.52
69.173.144.139
00359d552170386e0f9dc362a2a48ad8da908f6263810b28eb26348073b70bee
0107265e0f85bb9a3c2f2b2bc23504054c4765ab9d2fcaeb071031d08bd2fcf9
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
033364ca2f218c52b61b1fa024ddfdbcc837b186cf51b0169e03ccd23ad08241
047cbba843c378da640821f15d741ef2798bfb234561b821ffd0af0451fb984a
06d0aabd08299b17ba9f3d2c0d764ef04203d5bb91abdf8c9afea54506c8cc4e
0719bf495870e1f8033d9fa87dc9f6b3d10895c67e7698e92356f6eec8611d7a
08392ff877c5d17c9e4794b9c47c1b671b9501fbfeb78c906438008ee78aa87d
08a25c504f8eff948a2911d660c1b12ef89c3fb8f3d57216facebebd6303b75e
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ce5fc08d0f617e71e1d61bcd79fc7cc1855f4221945b0c09ac774685fe7f52c
0d7cd639c89358f19d898c0f407c362e22f9f3efb8f419bb35ede15d184daa71
10a61bfe990a105dbc8d0d0112db142f8ab6d241b7152ac27ec9561063aabe62
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
121821e0a9fc4f76a3363ee0bb163acc739778c131796cacd4db91fe213d5863
158b085cf5649aeab1a6eebc3e36622220a89b73d3c9e4636d2d1f0b7a143de5
159ebfcc5f37ffb30a47afb3153e5f212fffd3e97cf7f528aecd64f2b98ec4c6
15baaac08e167c266f986bc1045fa6945ea8b81c7d8d0330bdb8d2218aaefaa3
16a5e055995684816b73c0b147ccdea1386297a26e364f4f61823576dee24373
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1a4a2e3ff8af40ae480d9b2729225b135b6c6603c6a94b9b0a998af88cc25846
1aea2369edc419847873c9ce637400269e8dfc7c8c637a8c0bc20c63f977bcbf
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
1dda2cecb8f0322c2b59a817ac9d9fa234b3792ff094b1a401b3862d3cf157dc
1f429f4e2829515fb4ff9b67d875c2d023f08610e15a049ac0976715dd02182a
2187408e0d1abf69f6c14789070e6e07abec61c41da1bcec63c33d0531fcb725
22af8fe599f217e14dfb82c2f1442dd759352038cb6e6cb8328770d08a65e25e
249038a22111db8b37283b8339cd4e702170a872a7ee2df525069b5d3711766b
24ef39cf7f17ee8fa232e3c50c5f93f7c695b046ef58ad45c32c01c5085b8ac8
2517ed987b0f85e3960214d2ec118e8560c8e27118d8c7edf88442c8fad20666
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
283c7fca0fd51ba6a039bc52964d9437d6c70d5acbbe5914ed03baf862ebb33f
294186e196b3b12bc2e593d33af7eea7a27f9b6d4a08633ea80a6f23d6ae3db4
2a13e32124150faa27576464b1c089cb0d080e8acb4b0a885958b31af7cb3d5d
2bb210405ba3e443ccf64c5b1d5bfdc42c6bd9a25337f854b8db45d4092de9bf
2e11dab3cfc05ecc63598d96f74d91ee015bc2636a28b12fc0a4e465f717fca6
2e2f2336b5e6698b628afc75fa9a24c67b73d5872c1d4af99ca436064f636ee0
2e426eb2679335b3474f1afb08c5413329d9cf00ee607c0d80e63a2f40e36928
308c252b2381b887baf74268990c582643dbdaad9e9b332d158112745e2c65ea
30de69c01f8eb6cb0ab7b040f02316728cb490669cbf084aad71c06a708ed1ff
320eb1bf4d98037277d8146477dfad0b3bb19a8a690fe9b3d97605829848f811
32fd7d3af8cc39cd251f3b88469a44f5e778307f532e8810376ea503add096dc
33a75ecf080349c89c1db47ced291d404c84222defbd7cf4882529bd4e2e0a89
35861a24167aa45139a124bb7979a78897393977570c8aa01b26f568b85a4eb6
3705d0878203cc0b2525dcb0f874d85cc6b881d1fca1869191da4e599c768241
39e3b7a575958736f4307accdfc7243a4aac7f0342bd12bb0743e7a0932546df
3d0bf782b47dcd079eedf6bb34ecb0742c114a4e4b90e37a58a412482101b475
3e18d0e3dd548e9745884578e3cd9f0a492ddbb6f3b797db364b45bb16cadfb3
40a2ad629fb927a5b9ad0a0a1cb9171767d1eb2dec4b53b6a0f1ba1a2256a8db
40d2dfa80fa7e4f556716c48267ced327c7282f4fd1c064d08ca192afa916ce6
44a86990defb06123c1ece0ce9cc6acfd9a774e0c7de45044740782c63faab4e
4d2e71a0ad264f5771dcb6b62a0881a13b8f5816773736acc81c97dfb4e113cc
4df1edcf14fba12890959c06487bf3ddb5994bf692aefe36ef385f893298a0b0
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
50db2fcba1fd4bc39fd9d6775ef218de3ddd7ff91295bd01de8f3915b605dab0
5473a164aafa7ecc5f460aa98783c9dbb93a4ee14b26ae67371b35b3e80ecd77
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
568de4a237f78930c495806b9302c91df36f7212ee5af1cc6d9f4abc3ff03b38
5841eb6d1895c740317d98a4cd9e5aeced865f5c50182647401afc3d303367e1
58a0abffab9845abc31991c6fca6a5874d2db1d8238c6fa4a86e5bfd64a49636
5a095d43a6cb207c855ca0b8d70d314f6454e5358b1cf4cf2e9dae378e33e3c3
5fd4503b5368b174f1f643fe3499e2e185b3ebf241c6c88242708b917a97fe61
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
655ae452d922f501b62c7028fc35e238138de989387381cc1ed9cea9085864db
67f565f25c1bb8ae629cfca60c71766232073a0c905e0387e45895657b4ae3e7
68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f
68365b839627184be94436665af992cc018cd9b54d642036ae490f82c7629fea
68de28ccd005c586a59c9a5c0653400886add03ab352219edb4b8651782d5e09
6d674e200ded2c7f1e23125a7400f7a9b5426ca81cff20301d2298ff33e32d96
6fb48fb14effad0669f76a000a143d22e573dfa4135844fc8b20faac9869c359
7436c03d88ecc34823dc52f9ca7f42001e22fc9b98f62fe251f44d89ae30ad0e
7502e034f95191b9c0cb8b3e31e342e54ac473e702dd98d0cf3323cb69d3a7f1
795d0e0a8e07f46c426e332229226ef1511dd296b16d04f36e5bf8d8af5be7f5
7ad75b5b6da6d2c152a792a611e9b555f821e1e50a336d2abd4d59e62f091b84
7b6fef0a63424245b31b293b1a3bfd074c9da482e28fb9e920e1cf306e54e8a2
7bf30893ab2583b731daf314725d1826f17ab53f79692aa4341dfd73dd837cf9
7ec6524760febc1d37d614622d1b2c71ad5f2540fcbdc1d210a621c57d023a6c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
860d562b0a45cb007e7a669dc845cc85bec45a5229c67ddc3b11534ff54a9947
864d8c914fa0df77f17e2652e997ce07f71b8f66f0b75a216681c4b004bce11c
87e1ed8c94d134e4e068a17891d3dad0d122ee052bf061da0ca0e87b3da75069
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
89d4f658329103c87d0a7947554eeca3a1870ad6553aebf803cc3ba95c8df900
8a5a5c1282884251d11a64377b7a181176d83358531932dc08d3eb6b6b1f2a04
8c106f968e6dae4cc1049fd8205860cbd57eba3b59803c5688a1f417b57d9b65
8c605f66a0310731c5322544cb0a5e52f1c9bf52b83f73dbe772f7f72bd89d46
90c81de9c1a4846e00e1de7ce41abffed514ff9218437e261b5b8340ce1112f2
9664afe7a28d034336503942719c574e7de56f24c4960348a6ac8583ce9cc8ee
9684120c94e7edc0d21be2fa3eae6ef577a1b73df8a3708e830bc033d2496ab9
9733263ec42a91a96f3e3c92136dc6f8d5e04008a257eb898258e31078552fd7
983a0a22d44af024affc73914eca0820e642f4d6f59ed707d2f1880b048ac277
990a970d0b13f02acfecc901ef01c6d8fd87b05fbb7173e2a1ecb5ffbc3ef514
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
99e5c1acabc069482cebd649fbf00052363f2b735d3cc409b30280513631a975
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9af8177a89a477ba8b031682b1f1deec3965908577a5c46b6a8527b4fa684cb6
9bc1390aab3dc237db61d65ee187f0ce80390b040289ebb3f99e909005a26aee
9bd0c27bb3606a8810394992e283c170264b7ccea383b9e106d8b6e1c7da7b98
9db2244af7a5c4b6485ee859eebac070dd2bb5d6caf057b8c86fd7d6d53f4440
9e4b0045c300ae5ca73a4ccc90fff6080a3a0c8ba72ee4e4a7342e66b3b27a46
9e8cf1439188194d4e3222a19a109b5aecc5aabb6dcebfffa566ab3665510be6
9f2513aaec10734f9e4185005a7e0a28469d770cdee77ef6c164ed58af8f1132
9f5263afadde0cdcfcd27efddbb2a4cf0e51b5764e7454c4de54cad777ad032d
a0b779ad590272d25a6b625b33f3d117b71ab8b77efa8266cf2ebcd90bd76764
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a28f7b51eecc453bfa4b7794290a3d75918d3983ec835f0089b5a92d90ba9961
a44e537eb0dfe0dfdb3a7ab134b25790c6f99e33436bf603e879598ec164a9fd
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a51c9ce1efb20a3dc89036e6c4b25cca908f28534fffbba1248815049f8d66ea
a5f27af9c0c6f37979ebafcac22eb3a613841a3d4e728f4577baf94e64d42f35
a63e53abfd30cc5be7558678f3137aaa45dfe79e3577299ad027f259b81d50f5
ab50f8066522a61b5d0a09db2469e41ae60f7461936f8e32283cc8f8bfd93ce2
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2d2f11eb78159e31bce4355ffd5e696717de4270a77ba1d2038e066462008ad
b31639b1784eda51185ea2f620d531c1654d00790ce5ac16f333a88e23785d44
b32e2a199c3c9352689ae64546f5d70094b7208f0188067d7f583982f9886ef1
b568b710853272aca9b7edde1eafaec680e6aa1ba58b503e214b4aca75ed300d
b615139483987653bc5e5259a6b2980bf3b9fb33ab942f8a8b13ccab79fe09e5
ba97ba1c19f2b4c430ab98de4ff03de245d37d94bb79df1839922c543754fee4
bb677d7657006fb57417c73ef3da95da5ba9449790f75fb82a2f11afb18cdefb
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bea63616949c80ff0dfdbb1e8547f1585882fc691483317b06441688e3e5f14a
c86dc6c22f417978d42ea9bcb38e8ea9776f853bee15c914370d5e51ab6e329c
cb2e72c0113261872a070ac9a80ddf18e79c88f5dab37c389659047339ffe415
cc07c6aa8bd99f3ecbbd42a343876f4112ba870744c300d4e38694345720b14f
ccc1920ce012472744e6a3ffa7284d794088f3133f839be088c426d35a31b091
d072a09604e6a1fea8ef42203503771aa36b63a3c91fd1059966e26e6f5812b3
d13be2720157b939b505b2b217e9caf2ed4c20d831c47add20497c2fafe81bc0
d28401c309de2ee15d69288f6d8a89bba4a5491d094aca5822a2e7033d5b40a7
d432c7edb51b553b7a6045a10a08a56a58307238ffffb42f0fccdf2c6a6312a3
d43ffb22deff8ce9564230837e4c37889fbc4aaa93bca189b9b0bc6de0e88535
d5ad9bc33b3dd6ba0c9bd9239e3db5bdff0e38da468e445871b2a2af39e92602
d713e38998ee7560803152a137b6d4fddc4ebf3c1d722682f704296c396213f9
d795c9895e1faf0346ff5d7712b4f4c4da1ff8069f382a1eeff21adca050bedd
d8503c041e7f21942aa95fcd5992a29989cb49116d3cb3bf096455658498417a
dd31cd40f50febfe5d230818e64e8fa916664a9e1f38d6a6d3ba420d5605ac51
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
df3ee6542919d7fa834f7a7c879fa5d099b3cbc12cee89b6d05016f76d2c6b97
e06b5eee99f8b2417fab514f4d881ec0c604da462047b3393c6b864cf4a5f281
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4186ff3ad26e431005946d778ce135cae8848aa9dd5b9621088c7d9a1d240f1
e50a033612979635c9fffef9a64c41e260471d4d0cf3e17416466549b8211e6b
e5166861862f7dca0bae810d00a45407760215b70b90696b74b485e27938948d
e54906d19a7e8b355ec4aad735a08c571da17cde43b537ec376f74f4c5e9ca65
e647f50908584c7bf2827898737733d8ab7bfa41caa8cc62fc35259244ef7b10
e67d55911edfcdd789d23e24d733d3aa2c59d05833ce7bc9247cebc5dcfdc932
ea7d15d7ef0e6ed4931f4affb4435f0b9841aedf7921b3062fc164366709d6b5
eabcac7f7b9de0c0f82c410a6f26c23883d3a658c910235310f39423b2e832f6
ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436
ee1d2f26d7c2a1cf9c7ac482db2dc7ce0554c9eec6a73fd9eaf8215d6097ea6d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2dec2e920659c69349f62714f6787d276a678e4c6abd5ffd0358b3e63822b89
f445ee14f2454d974293d28677213ae002e9ac17721fc04b2fdeb037e083b083
f44dcc0cc08966be1118e3d100c9b40144c927fbb9e51637460efbb393d91160
f5d3fca890c5088c347837a3d7a81a789f5355c9311d822d74b2ce5ae0188a5d
f5ef63bcd883c3e6ecca9a17785b10ee897b51aec76328706887ceb220742d71
f7e06ae449bdd4ebece6e26cdb36840f7cb19f28b57bbb6b8647a54535557d3f
f88dfe831ccc016202ea3d7dd889f7a8d25a69697b9cd6833b5d77fb5ad4a045
f9bcfcdf3913076194efc851a76c4686fd0f4c336ee09e5739ab31590eb13eaa
fbe820b6140ad28e86f34ffae507d807cf591a22697a05b71958f2014e96a9e4
fc7109dd6428c821842660a87bda6494e52c0f4ecad22105a1aed87e440ee0b1
fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

cisomag.eccouncil.org Open in urlscan Pro 2606:4700::6812:15fb Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

213 Requests

94 %HTTPS

50 %IPv6

35 Domains

51 Subdomains

43 IPs

7 Countries

2975 kBTransfer

7235 kBSize

56 Cookies

31 Outgoing links

Redirected requests

213 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

cisomag.eccouncil.org Open in urlscan Pro
2606:4700::6812:15fb Public Scan

Screenshot
Live screenshot

Full Image

213
Requests

94 %
HTTPS

50 %
IPv6

35
Domains

51
Subdomains

43
IPs

7
Countries

2975 kB
Transfer

7235 kB
Size

56
Cookies

213 HTTP transactions
3 data transactions