darktrace.com Open in urlscan Pro
34.253.101.190 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Effective URL:
https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Submission: On September 07 via api (September 7th 2022, 8:21:54 am UTC) from US — Scanned from DE

Summary HTTP 52 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 22 IPs in 4 countries across 19 domains to perform 52 HTTP transactions. The main IP is 34.253.101.190, located in Dublin, Ireland and belongs to AMAZON-02, US. The main domain is darktrace.com. The Cisco Umbrella rank of the primary domain is 72156.
TLS certificate: Issued by R3 on July 16th 2022. Valid for: 3 months.

This is the only time darktrace.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 4	172.67.0.161 172.67.0.161	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	34.253.101.190 34.253.101.190	16509 (AMAZON-02) (AMAZON-02)
6	2600:9000:206... 2600:9000:206e:4600:12:9e5f:cac0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
11	2606:4700:440... 2606:4700:4400::ac40:929e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
3	2600:9000:206... 2600:9000:206e:b200:1:28b3:b280:93a1	16509 (AMAZON-02) (AMAZON-02)
1	13.225.84.179 13.225.84.179	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
1	108.138.17.87 108.138.17.87	16509 (AMAZON-02) (AMAZON-02)
3	2600:9000:211... 2600:9000:211a:4e00:11:3b84:d200:93a1	16509 (AMAZON-02) (AMAZON-02)
1	108.138.1.193 108.138.1.193	16509 (AMAZON-02) (AMAZON-02)
7	13.225.78.129 13.225.78.129	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:10e... 2a02:26f0:10e::6860:5baa	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	18.66.97.46 18.66.97.46	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
52	22

4 172.67.0.161 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

www.darktrace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ir.darktrace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
careers.darktrace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.253.101.190 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-253-101-190.eu-west-1.compute.amazonaws.com

darktrace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2600:9000:206e:4600:12:9e5f:cac0:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets-global.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700:4400::ac40:929e (United States)

ASN13335 (CLOUDFLARENET, US)

cdn-ukwest.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:206e:b200:1:28b3:b280:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.weglot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.84.179 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-84-179.fra2.r.cloudfront.net

d3e54v103j8qbb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.17.87 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-17-87.fra56.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:211a:4e00:11:3b84:d200:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.website-files.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.1.193 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-1-193.fra56.r.cloudfront.net

www.datadoghq-browser-agent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 13.225.78.129 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-129.fra2.r.cloudfront.net

cdn-api.weglot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:10e::6860:5baa (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.46 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-46.fra56.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	onetrust.com cdn-ukwest.onetrust.com — Cisco Umbrella Rank: 6681 geolocation.onetrust.com — Cisco Umbrella Rank: 1040	149 KB
10	weglot.com cdn.weglot.com — Cisco Umbrella Rank: 23617 cdn-api.weglot.com — Cisco Umbrella Rank: 74032	42 KB
9	website-files.com assets-global.website-files.com — Cisco Umbrella Rank: 23525 assets.website-files.com — Cisco Umbrella Rank: 21337	417 KB
6	darktrace.com 3 redirects www.darktrace.com darktrace.com — Cisco Umbrella Rank: 72156 ir.darktrace.com careers.darktrace.com	14 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 894 www.linkedin.com — Cisco Umbrella Rank: 847 px4.ads.linkedin.com — Cisco Umbrella Rank: 6869	3 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 141	219 KB
2	google.com www.google.com — Cisco Umbrella Rank: 19	1 KB
1	google.de www.google.de — Cisco Umbrella Rank: 3469	548 B
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2119	345 B
1	company-target.com api.company-target.com — Cisco Umbrella Rank: 8494	1 KB
1	rlcdn.com id.rlcdn.com — Cisco Umbrella Rank: 885	98 B
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 159	16 KB
1	doubleclick.net 9120626.fls.doubleclick.net Failed googleads.g.doubleclick.net — Cisco Umbrella Rank: 73	2 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1614	3 KB
1	datadoghq-browser-agent.com www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 3567	13 KB
1	demandbase.com tag.demandbase.com — Cisco Umbrella Rank: 11985	19 KB
1	gstatic.com www.gstatic.com	157 KB
1	cloudfront.net d3e54v103j8qbb.cloudfront.net	30 KB
0	bidr.io Failed match.prod.bidr.io Failed
52	19

	Domain	Requested by
10	cdn-ukwest.onetrust.com	darktrace.com cdn-ukwest.onetrust.com
7	cdn-api.weglot.com	cdn.weglot.com
6	assets-global.website-files.com	darktrace.com
3	assets.website-files.com	assets-global.website-files.com
3	cdn.weglot.com	darktrace.com cdn.weglot.com
3	www.googletagmanager.com	darktrace.com www.googletagmanager.com
2	px.ads.linkedin.com	2 redirects
2	www.google.com	darktrace.com
2	darktrace.com	1 redirects
2	www.darktrace.com	2 redirects
1	www.google.de	darktrace.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	px4.ads.linkedin.com	darktrace.com
1	www.linkedin.com	1 redirects
1	region1.google-analytics.com	www.googletagmanager.com
1	api.company-target.com	tag.demandbase.com
1	id.rlcdn.com	darktrace.com
1	www.googleadservices.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	www.datadoghq-browser-agent.com	cdn.weglot.com
1	geolocation.onetrust.com	cdn-ukwest.onetrust.com
1	careers.darktrace.com	darktrace.com
1	ir.darktrace.com	darktrace.com
1	tag.demandbase.com	darktrace.com
1	www.gstatic.com	www.google.com
1	d3e54v103j8qbb.cloudfront.net	darktrace.com
0	match.prod.bidr.io Failed	darktrace.com
0	9120626.fls.doubleclick.net Failed	www.googletagmanager.com
52	28

This site contains links to these domains. Also see Links.

Domain
customerportal.darktrace.com
partners.darktrace.com
careers.darktrace.com
ir.darktrace.com
fr.darktrace.com
it.darktrace.com
ko.darktrace.com
ja.darktrace.com
es.darktrace.com
de.darktrace.com
pt-br.darktrace.com
rikoostenbroek.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
darktrace.com R3	`2022-07-16` - `2022-10-14`	3 months	crt.sh
*.website-files.com Amazon	`2021-11-12` - `2022-12-10`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-07-18` - `2023-07-18`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
*.weglot.com Amazon	`2022-03-09` - `2023-04-07`	a year	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2022-08-17` - `2023-09-18`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-04` - `2023-06-03`	a year	crt.sh
*.datadoghq-browser-agent.com DigiCert TLS RSA SHA256 2020 CA1	`2022-02-17` - `2023-02-18`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2021-10-20` - `2022-09-26`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-08-22` - `2022-11-14`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Frame ID: 39DF35C6F1393F1E9EF44B5B9F237A0E
Requests: 52 HTTP requests in this frame

Frame: https://9120626.fls.doubleclick.net/activityi;src=9120626;type=unive0;cat=darkt00;ord=1406353784180;gtm=2wg8v0;auiddc=1423536176.1662538910;~oref=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522
Frame ID: 4EB5D797B7B499827B71EE06A000E724
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Page Not Found | DarktraceBack ButtonSearch IconFilter Icon

Page URL History Show full URLs

http://www.darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 HTTP 301
https://www.darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 HTTP 302
https://darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 HTTP 301
https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 Page URL

Detected technologies

AdonisJS (Web frameworks) Expand

Overall confidence: 100%
Detected patterns

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

otSDKStub\.js

Weglot (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

cdn\.weglot\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

52
Requests

94 %
HTTPS

55 %
IPv6

19
Domains

28
Subdomains

22
IPs

4
Countries

1082 kB
Transfer

3595 kB
Size

19
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://customerportal.darktrace.com/
Title: Customer Portal

Search URL Search Domain Scan URL

URL: https://partners.darktrace.com/
Title: Partner Portal

Search URL Search Domain Scan URL

URL: https://partners.darktrace.com/apply
Title: Become a partner

Search URL Search Domain Scan URL

URL: https://careers.darktrace.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://ir.darktrace.com/
Title: Investors

Search URL Search Domain Scan URL

URL: https://fr.darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Title: Français

Search URL Search Domain Scan URL

URL: https://it.darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Title: Italiano

Search URL Search Domain Scan URL

URL: https://ko.darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Title: 한국어

Search URL Search Domain Scan URL

URL: https://ja.darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Title: 日本語

Search URL Search Domain Scan URL

URL: https://es.darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Title: Español

Search URL Search Domain Scan URL

URL: https://de.darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://pt-br.darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Title: Português Brasileiro

Search URL Search Domain Scan URL

URL: https://rikoostenbroek.com/
Title: Rik Oostenbroek

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 HTTP 301
https://www.darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 HTTP 302
https://darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 HTTP 301
https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 42

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1662538910198&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm=gtmv2 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D67174%26time%3D1662538910198%26url%3Dhttps%253A%252F%252Fdarktrace.com%252Fblog%252Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%252F%252F%252F%252F%252522%26tm%3Dgtmv2%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1662538910198&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm=gtmv2&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1662538910198&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm=gtmv2&liSync=true&e_ipv6=AQIF8aL2_gD1AAAAAYMXCovC7dxDxQsGr0bsCf3lR71YrToph9I39e9QhUcn94QqgtfsTavQlQ

52 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

404

Primary Request %22 Show response
darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////
Redirect Chain

http://www.darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
https://www.darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
https://darktrace.com/en/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

55 KB
13 KB

1370ms
1369ms

Document
text/html

34.253.101.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.253.101.190 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-253-101-190.eu-west-1.compute.amazonaws.com

Software

openresty /

Resource Hash

bf5da93bd636c1fa4341d8f8eb4d4cac2f51b5ba91a58f61346bbccce2d88493

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: private, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: frame-ancestors 'self'
content-type: text/html
date: Wed, 07 Sep 2022 08:21:49 GMT
etag: W/"2224ca2023cc1ee57b387ab8800e18e7"
last-modified: Wed, 31 Aug 2022 08:44:04 GMT
server: openresty
strict-transport-security: max-age=31536000; includeSubDomains
vary: x-wf-forwarded-proto, Accept-Encoding
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-cluster-name: eu-west-1-prod-edge-blue
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-served-by: cache-iad-kcgs7200056-IAD, cache-dub4327-DUB
x-timer: S1662538908.330796,VS0,VE1327

Redirect headers

accept-ranges: bytes
cache-control: private
content-length: 166
content-security-policy: frame-ancestors 'self'
content-type: text/html
date: Wed, 07 Sep 2022 08:21:48 GMT
location: /blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
server: openresty
strict-transport-security: max-age=31536000; includeSubDomains
vary: x-wf-forwarded-proto
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-cluster-name: eu-west-1-prod-edge-blue
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-served-by: cache-iad-kiad7000177-IAD, cache-dub4334-DUB
x-timer: S1662538908.089646,VS0,VE199

GET
H2 200 web-phoenix.509e6aba0.min.css
assets-global.website-files.com/626ff19cdd07d1258d49238d/css/ 266 KB
42 KB 143ms
32ms Stylesheet
text/css 2600:9000:206e:4600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/css/web-phoenix.509e6aba0.min.css
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:4600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8e38f112a12bbb2df0b18f6221ac9730374e46edbefd04641929d4f1ec350e4f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-version-id: rxItIKf0Rl0ha0sbTZnxX9X6tmkUNxwS
content-encoding: gzip
etag: "2c22844d9ef356c8eba2b86333c02b94"
age: 75110
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 42671
via: 1.1 96b3f0ca359697e92cd090a37a2e3bf4.cloudfront.net (CloudFront)
last-modified: Wed, 31 Aug 2022 08:44:04 GMT
server: AmazonS3
date: Tue, 06 Sep 2022 11:30:00 GMT
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
x-amz-cf-id: AkNVvDqxDwwM_XMxkNJ7AXMWgPlApL7H-jhe4uaMwTNJ78EXIfMINA==

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
969 B 64ms
25ms Script
text/javascript 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

7bbc0a1a176faba3ab4ef9aebd61fbc1fd8afc56ce0ed7f7183d8256a57bb024

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 07 Sep 2022 08:21:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 556
x-xss-protection: 1; mode=block
expires: Wed, 07 Sep 2022 08:21:49 GMT

GET
H2 200 OtAutoBlock.js Show response
cdn-ukwest.onetrust.com/consent/2f0e2e84-c239-468b-b9dc-95c94890809c/ 6 KB
3 KB 103ms
44ms Script
application/x-javascript 2606:4700:4400::ac40:929e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/consent/2f0e2e84-c239-468b-b9dc-95c94890809c/OtAutoBlock.js

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:929e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

71e525f4a8cfaa33a6b13bf5ba608ca1c0c8e38b7616b031a18c33460ba690f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 07 Sep 2022 08:21:49 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
content-md5: fuiobenC4rhpGzZ+ojecDg==
age: 5235
content-length: 2037
x-ms-lease-status: unlocked
last-modified: Thu, 25 Aug 2022 13:43:49 GMT
server: cloudflare
etag: 0x8DA869FD7619B28
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: f45ece0c-501e-0035-57e2-bd8ace000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 746e0879f90f0225-ZRH

GET
H2 200 otSDKStub.js Show response
cdn-ukwest.onetrust.com/scripttemplates/ 21 KB
7 KB 112ms
53ms Script
application/javascript 2606:4700:4400::ac40:929e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:929e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2c340dd3914586acfd9e644e15964cb976c43d5d05dd4db674cf70271cac1ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 07 Sep 2022 08:21:49 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
content-md5: lV57NRWKkVir6GIbp6EfFw==
age: 9930
content-length: 7129
x-ms-lease-status: unlocked
last-modified: Tue, 23 Aug 2022 20:32:11 GMT
server: cloudflare
etag: 0x8DA85468E72146C
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: ee48c867-d01e-0024-0be2-bdbdd5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 746e0879f9150225-ZRH
expires: Wed, 07 Sep 2022 12:21:49 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 211 KB
74 KB 78ms
34ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N8JM61T88C

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

659f3a582c2c4f15e673a3b6c893427d55061acb9d2ff1ab0a00f067c6f0528a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 07 Sep 2022 08:21:49 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 75302
x-xss-protection: 0
expires: Wed, 07 Sep 2022 08:21:49 GMT

GET
H2 200 weglot.min.js Show response
cdn.weglot.com/ 77 KB
27 KB 108ms
30ms Script
application/javascript 2600:9000:206e:b200:1:28b3:b280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.weglot.com/weglot.min.js
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:b200:1:28b3:b280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 69b9fc3d390d3d3fa1acf88cd79696ce9d2bc3dc1e10d459f89756d2e90d40f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: gzip
last-modified: Wed, 31 Aug 2022 12:56:37 GMT
server: AmazonS3
age: 1369
etag: W/"e777fec616849e554d69e6d931f44e69"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
via: 1.1 315b8dfb52e5c49bd834510b0301e938.cloudfront.net (CloudFront)
cache-control: max-age=1800
date: Wed, 07 Sep 2022 07:59:00 GMT
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: iexbpT9u5O_MU32P13t4sJ6Us-SqTlUB4_6HSNWXbWoZSOyA_nJNIA==

GET
H2 200 page-not-found.211a85e40c.svg
assets-global.website-files.com/static/ 754 B
1 KB 61ms
60ms Image
image/svg+xml 2600:9000:206e:4600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/static/page-not-found.211a85e40c.svg
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:4600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 58afd37317e5adb23a1e2b5006169e2350cdbc8948ee7998250fce897f3fb699

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-version-id: 0gxtxNJ0N3yfqHO_jy8.CvIJW1g5Fi8V
via: 1.1 96b3f0ca359697e92cd090a37a2e3bf4.cloudfront.net (CloudFront)
etag: "211a85e40c7aeb39347a880746cd17c3"
age: 26834
x-cache: Hit from cloudfront
content-length: 754
last-modified: Mon, 19 Dec 2016 20:52:42 GMT
server: AmazonS3
date: Wed, 07 Sep 2022 06:23:10 GMT
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
x-amz-cf-id: 4FIURCMj71H3GwuIpNkEq0fVhoF5m5eEHjBM8GpAzNHIErIli0BN2g==

GET
H2 200 jquery-3.5.1.min.dc5e7f18c8.js Show response
d3e54v103j8qbb.cloudfront.net/js/ 87 KB
30 KB 69ms
20ms Script
application/javascript 13.225.84.179
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=626ff19cdd07d1258d49238d
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.84.179 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-84-179.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://darktrace.com/
Origin: https://darktrace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 06 Sep 2022 23:44:22 GMT
content-encoding: br
vary: Accept-Encoding
age: 31048
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Mon, 20 Jul 2020 17:53:02 GMT
server: AmazonS3
etag: W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront)
cache-control: max-age=84600, must-revalidate
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: xJ8J45UVIhhRxTJSsQGd-5GrSZR70FN8MH4LVwoRkxtJSU1GKYcsHw==

GET
H2 200 web-phoenix.10d291b65.js Show response
assets-global.website-files.com/626ff19cdd07d1258d49238d/js/ 899 KB
164 KB 31ms
31ms Script
text/javascript 2600:9000:206e:4600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/js/web-phoenix.10d291b65.js
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:4600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1a7f603a9dd1e0a381c028839fdc00b6c6bfa4869b4a8ba22ecda60037ebcaac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-version-id: p0ZnlCtKoBbB18wEe0j6TwAQDrcCDfty
content-encoding: gzip
etag: "e316235c2d8f3ca53c09689c42fc2a1a"
age: 75110
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 166956
via: 1.1 96b3f0ca359697e92cd090a37a2e3bf4.cloudfront.net (CloudFront)
last-modified: Wed, 31 Aug 2022 08:44:04 GMT
server: AmazonS3
date: Tue, 06 Sep 2022 11:30:00 GMT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=84600, must-revalidate
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
x-amz-cf-id: KjKYjlCyKpvHjQZrKDY4GpO5uX8DD7uYgVVfSPAqyVsG919MkFmkxQ==

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/ 392 KB
157 KB 58ms
15ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbea10abc6a4fb6c6db32f7ff91d4e53f496579268f4f28e4e15f14c76cdd088

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://darktrace.com/
Origin: https://darktrace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 07 Sep 2022 05:20:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10875
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 159560
x-xss-protection: 0
last-modified: Fri, 02 Sep 2022 18:40:58 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 07 Sep 2023 05:20:34 GMT

GET
H2 200 2f0e2e84-c239-468b-b9dc-95c94890809c.json Show response
cdn-ukwest.onetrust.com/consent/2f0e2e84-c239-468b-b9dc-95c94890809c/ 3 KB
2 KB 105ms
58ms XHR
application/x-javascript 2606:4700:4400::ac40:929e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/consent/2f0e2e84-c239-468b-b9dc-95c94890809c/2f0e2e84-c239-468b-b9dc-95c94890809c.json

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:929e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b59b82343b78feaa04fa094535c326c677790b720a2265af536515cd394aa783

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 07 Sep 2022 08:21:49 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
content-md5: Fx5Ovc4SHCpDGzlD8Kz5ZA==
age: 5235
content-length: 1386
x-ms-lease-status: unlocked
last-modified: Thu, 25 Aug 2022 13:43:43 GMT
server: cloudflare
etag: 0x8DA869FD3850293
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 3e753c9d-101e-0054-5be2-bdce11000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 746e087afd7d23df-ZRH

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 201 KB
71 KB 98ms
55ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PW765SZ

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4138531350f138a2e6f5fd9465a31436698dbe6cb9d9894ab0ac9058bc6398fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 07 Sep 2022 08:21:49 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 73000
x-xss-protection: 0
last-modified: Wed, 07 Sep 2022 06:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 07 Sep 2022 08:21:49 GMT

GET
H2 200 234baeaaccaa2f09e0dc6c004f571bbd6.json Show response
cdn.weglot.com/projects-settings/ 3 KB
1 KB 85ms
28ms Fetch
application/json 2600:9000:206e:b200:1:28b3:b280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.weglot.com/projects-settings/234baeaaccaa2f09e0dc6c004f571bbd6.json
Requested by: Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:b200:1:28b3:b280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 55ed0c37ad3490e7bc1ef5d0b3100b2f90ef6e30024a474da7b1ab6d0037e29f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 12:59:15 GMT
content-encoding: gzip
last-modified: Wed, 17 Aug 2022 10:20:06 GMT
server: AmazonS3
age: 588155
etag: W/"e5a2aff960407b0a5f07835f5f266312"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
x-amz-version-id: null
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-cf-pop: VIE50-C1
content-type: application/json
x-amz-cf-id: XIqvVsuBbd7YY2vPUZPDZ4HTcvhrS5ZJMShPDGzkwb3YnUAhhz807w==
via: 1.1 fd2756277dcf50743fb09f4526b54aca.cloudfront.net (CloudFront)

GET
H2 200 20cb0107a53f0895.min.js Show response
tag.demandbase.com/ 67 KB
19 KB 222ms
20ms Script
application/javascript 108.138.17.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/20cb0107a53f0895.min.js

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.17.87 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-17-87.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

dfe0ca20cde31b3e6a4253da8db7ac377f64b924cc056528122bdd21cfc88270

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-amz-version-id: P7YGeYAWHX3lAfRnXShngtJVdrjVv1v3
content-encoding: gzip
etag: W/"3bcb94db62443216c44c64e3fbcf62c4"
age: 23
x-cache: Hit from cloudfront
vary: Accept-Encoding
last-modified: Tue, 06 Sep 2022 16:38:02 GMT
server: AmazonS3
date: Wed, 07 Sep 2022 08:21:50 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
via: 1.1 26f61e70ac4b967ea82841cbd2dc7cf0.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop: FRA56-P7
x-amz-cf-id: L41vmstZhK5ErSY0b3yGnlmoK9ZjYMm-ezSmwmxsYj-etKVF7xtYqA==

GET
H2 200 62aa2f88b8c0342cb0b7fbef_TypeType%20-%20TT%20Interphases%20Pro%20Regular.ttf
assets.website-files.com/626ff19cdd07d1258d49238d/ 136 KB
63 KB 122ms
33ms Font
application/x-font-ttf 2600:9000:211a:4e00:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/626ff19cdd07d1258d49238d/62aa2f88b8c0342cb0b7fbef_TypeType%20-%20TT%20Interphases%20Pro%20Regular.ttf
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/css/web-phoenix.509e6aba0.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211a:4e00:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a6fd219289d32bb4cdc8e8831a6f56c5cc0e4246f324bb598277e0c9036753d4

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://darktrace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 04:15:27 GMT
content-encoding: br
age: 273983
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Wed, 15 Jun 2022 19:35:09 GMT
server: AmazonS3
etag: W/"c1b8cbcc934aea3e53c8fc4904d8060d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
x-amz-version-id: pdAuGtTsh6vh4TYRUxRutxs_j7OuOOpJ
via: 1.1 2a5303ed411734ba7adcd9ff65d96392.cloudfront.net (CloudFront)
cache-control: max-age=31536000, must-revalidate
x-amz-cf-pop: VIE50-C2
content-type: application/x-font-ttf
x-amz-cf-id: J0EaB8phPvuOLT21_nhruZE1_iJJHMy6rJGPBwcnA87O1lBHxwP7tg==

GET
H2 200 62c4e22e866dec1fe2712cb3_Darktrace%20Logo%20B%3AO%20-%20Vector.svg
assets-global.website-files.com/626ff19cdd07d1258d49238d/ 8 KB
3 KB 54ms
53ms Image
image/svg+xml 2600:9000:206e:4600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/62c4e22e866dec1fe2712cb3_Darktrace%20Logo%20B%3AO%20-%20Vector.svg
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:4600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ef6b6ed623b9789747d2e491b3ad692793d461be2f27bdf0c531b2d953fa670d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sat, 20 Aug 2022 02:16:24 GMT
content-encoding: gzip
age: 1577125
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
via: 1.1 96b3f0ca359697e92cd090a37a2e3bf4.cloudfront.net (CloudFront)
last-modified: Wed, 06 Jul 2022 01:15:27 GMT
server: AmazonS3
etag: W/"c34059ce90d8a25cb81c8342bac3caad"
vary: Accept-Encoding
x-amz-version-id: U3NyuUAtCMgfEVbn9mSuYAOoErDsuB9M
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-pop: VIE50-C1
content-type: image/svg+xml
x-amz-cf-id: r0zQ_XCXy3wDaG5hQwCLc6ukRrU7XCfPbE0K7HjVZ46N14A_8mpe7g==

GET
H2 200 /
ir.darktrace.com/ 0
0 111ms
95ms Other
text/html 172.67.0.161
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ir.darktrace.com/
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.0.161 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H2 200 /
careers.darktrace.com/ 0
0 99ms
83ms Other
text/html 172.67.0.161
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://careers.darktrace.com/
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.0.161 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

GET
H2 200 62aa2f9a73505602c43cdef2_TypeType%20-%20TT%20Interphases%20Pro%20Bold.ttf
assets.website-files.com/626ff19cdd07d1258d49238d/ 135 KB
63 KB 129ms
66ms Font
application/x-font-ttf 2600:9000:211a:4e00:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/626ff19cdd07d1258d49238d/62aa2f9a73505602c43cdef2_TypeType%20-%20TT%20Interphases%20Pro%20Bold.ttf
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/css/web-phoenix.509e6aba0.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211a:4e00:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: adecd63acc4782d7f6bea59bda9e02bfcc6f90ed14ace7f83e06c6c814b58e2a

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://darktrace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sun, 04 Sep 2022 04:15:28 GMT
content-encoding: br
age: 273981
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Wed, 15 Jun 2022 19:33:53 GMT
server: AmazonS3
etag: W/"a2975bcd95ef12e21b2c7596dfb5828d"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
x-amz-version-id: w8aES_2JIQeWMFtSaIseSTPNz4Sh5jKS
via: 1.1 2a5303ed411734ba7adcd9ff65d96392.cloudfront.net (CloudFront)
cache-control: max-age=31536000, must-revalidate
x-amz-cf-pop: VIE50-C2
content-type: application/x-font-ttf
x-amz-cf-id: oDJneD0Tu00-cI6cguSA_fuNmyAquRX3McvgWhHsFcrYXDa3hoEUPQ==

GET
H2 200 62aa1da43aa2d3525162b7ca_Cyber%20Essentials.png
assets-global.website-files.com/626ff19cdd07d1258d49238d/ 4 KB
5 KB 29ms
29ms Image
image/png 2600:9000:206e:4600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/62aa1da43aa2d3525162b7ca_Cyber%20Essentials.png
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:4600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 21dea0cdc956cea9bb658cc7338d5a7526ba4bee4a4e2c15b2d067b57734b3ab

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Sat, 16 Jul 2022 20:38:45 GMT
via: 1.1 96b3f0ca359697e92cd090a37a2e3bf4.cloudfront.net (CloudFront)
age: 4534985
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 4571
last-modified: Wed, 15 Jun 2022 17:57:57 GMT
server: AmazonS3
etag: "0ae37aa84e0802a9679e796afacf31be"
x-amz-version-id: 6XwZh1Fiwma3h9iKHNFiypOx.wr2_RKl
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: GaTGMqokgs2vN5XpTRuTw3sWLmY18-yNyHtUR0GzFLMWKBabrhoZbw==

GET
H2 200 62bb366a0ea7e3dcd974222f_iso-27001.png
assets-global.website-files.com/626ff19cdd07d1258d49238d/ 10 KB
10 KB 31ms
31ms Image
image/png 2600:9000:206e:4600:12:9e5f:cac0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/62bb366a0ea7e3dcd974222f_iso-27001.png
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:4600:12:9e5f:cac0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9215591d842950b73dfde60917a48e309c617d3787046db80940902e4f8368ee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Fri, 19 Aug 2022 09:01:47 GMT
via: 1.1 96b3f0ca359697e92cd090a37a2e3bf4.cloudfront.net (CloudFront)
age: 1639203
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 10209
last-modified: Tue, 28 Jun 2022 17:12:11 GMT
server: AmazonS3
etag: "24292c18d8e2d6d7ba991aa05cec32e7"
x-amz-version-id: eipit0vlrYAgfAGDx6gL12dFYiEq9lWS
access-control-allow-origin: *
cache-control: max-age=31536000, must-revalidate
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: UgJoUKkacGGznF0OQvgeesff1VAlEz9RiexETGXcS0WRXzHCbL9DwQ==

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 182 B
326 B 66ms
51ms XHR
application/json 2606:4700:4400::ac40:929e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:929e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://darktrace.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 07 Sep 2022 08:21:50 GMT
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 746e087baeaa23df-ZRH
access-control-allow-headers: Content-Type

GET
H2 200 weglot.min.css
cdn.weglot.com/ 28 KB
5 KB 29ms
28ms Stylesheet
text/css 2600:9000:206e:b200:1:28b3:b280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.weglot.com/weglot.min.css?v=4
Requested by: Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206e:b200:1:28b3:b280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8eb91a0802b9e79aef3e47554a25b80de2f8ef73d3053b28c81820734179f4e9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 12:58:49 GMT
content-encoding: gzip
last-modified: Wed, 31 Aug 2022 12:58:43 GMT
server: AmazonS3
age: 588182
etag: W/"b72cdd8118949f04803d561712cf0c5e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: null
via: 1.1 315b8dfb52e5c49bd834510b0301e938.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: VIE50-C1
content-type: text/css; charset=utf-8
x-amz-cf-id: lFjcuyWsDtw6w5nXBtFCTkBqAwAt-VgOKkbqFnp2lgNPTm8GmMGwNw==

GET
H2 200 datadog-logs-v4.js Show response
www.datadoghq-browser-agent.com/ 38 KB
13 KB 61ms
16ms Script
application/javascript 108.138.1.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.datadoghq-browser-agent.com/datadog-logs-v4.js
Requested by: Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.1.193 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-1-193.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 844493efec5d756f8880f89560ba4877b3df232960b0f60170447b397ef4727b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 07 Sep 2022 08:21:17 GMT
content-encoding: br
last-modified: Wed, 31 Aug 2022 11:24:30 GMT
server: AmazonS3
age: 36
etag: W/"6fe4a44034e01f10b4160e3dd76c18db"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 a2eae5bb517678c9d6b43a2731b4462e.cloudfront.net (CloudFront)
cache-control: max-age=14400, s-maxage=60
x-amz-cf-pop: FRA56-P6
timing-allow-origin: *
x-amz-cf-id: VejoivW_EW2nWAg1lMQ2t9o7NgJWb4f_GPnuJo0YPK8kbIu-CEjWgQ==

GET
H2 200 slugs Show response
cdn-api.weglot.com/translations/ 533 B
2 KB 88ms
20ms Fetch
application/json 13.225.78.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-api.weglot.com/translations/slugs?api_key=wg_234baeaaccaa2f09e0dc6c004f571bbd6&language_to=fr&v=1658845381

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-129.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

9270bbe635cc7cf73fcdaa51e5e9ea0ad367a2ca4eeec9b837c5779ceb45cd40

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-fd52dc7693fb02cb654b6b9c4cbb7458' dashboard.weglot.com .weglot.com .stripe.com .announcekit.app .nolt.io .jsdelivr.net .firstpromoter.com beacon-v2.helpscout.net .google.com .google-analytics.com .googletagmanager.com .googleadservices.com .gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com .snap.licdn.com .redditstatic.com connect.facebook.net .hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 14:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3693498
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
access-control-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET,POST,PUT,PATCH
content-type: application/json
via: 1.1 286eb4b50e0acf373dd03645aee00b7e.cloudfront.net (CloudFront)
cache-control: max-age=0, must-revalidate, no-store, private
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
content-security-policy: script-src 'nonce-fd52dc7693fb02cb654b6b9c4cbb7458' dashboard.weglot.com *.weglot.com *.stripe.com *.announcekit.app *.nolt.io *.jsdelivr.net *.firstpromoter.com beacon-v2.helpscout.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com *.snap.licdn.com *.redditstatic.com connect.facebook.net *.hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
x-amz-cf-pop: FRA2-C2
access-control-allow-headers: Content-Type
x-amz-cf-id: ruRFN177puB0yFdIA6aXw7wxcHNc8ihpi282SlKPT9pO90jPGEG-wQ==
expires: Tue, 26 Jul 2022 14:23:32 GMT

GET
H2 200 slugs Show response
cdn-api.weglot.com/translations/ 2 B
1 KB 85ms
17ms Fetch
application/json 13.225.78.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-api.weglot.com/translations/slugs?api_key=wg_234baeaaccaa2f09e0dc6c004f571bbd6&language_to=it&v=1658845381

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-129.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-8bd0be8d00de84d1cffb6d70f40fd066' dashboard.weglot.com .weglot.com .stripe.com .announcekit.app .nolt.io .jsdelivr.net .firstpromoter.com beacon-v2.helpscout.net .google.com .google-analytics.com .googletagmanager.com .googleadservices.com .gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com .snap.licdn.com .redditstatic.com connect.facebook.net .hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 14:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3693498
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
access-control-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET,POST,PUT,PATCH
content-type: application/json
via: 1.1 286eb4b50e0acf373dd03645aee00b7e.cloudfront.net (CloudFront)
cache-control: max-age=0, must-revalidate, no-store, private
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
content-security-policy: script-src 'nonce-8bd0be8d00de84d1cffb6d70f40fd066' dashboard.weglot.com *.weglot.com *.stripe.com *.announcekit.app *.nolt.io *.jsdelivr.net *.firstpromoter.com beacon-v2.helpscout.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com *.snap.licdn.com *.redditstatic.com connect.facebook.net *.hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
x-amz-cf-pop: FRA2-C2
access-control-allow-headers: Content-Type
x-amz-cf-id: AW74h_w4NAjxpbNKCwi_m9xUqnF0qkXqNK9MQkF_E2kuEQJzGgZKsQ==
expires: Tue, 26 Jul 2022 14:23:32 GMT

GET
H2 200 slugs Show response
cdn-api.weglot.com/translations/ 2 B
1 KB 85ms
18ms Fetch
application/json 13.225.78.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-api.weglot.com/translations/slugs?api_key=wg_234baeaaccaa2f09e0dc6c004f571bbd6&language_to=ko&v=1658845381

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-129.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-cf9bf898f29d24bc1a8c417a3fc149c8' dashboard.weglot.com .weglot.com .stripe.com .announcekit.app .nolt.io .jsdelivr.net .firstpromoter.com beacon-v2.helpscout.net .google.com .google-analytics.com .googletagmanager.com .googleadservices.com .gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com .snap.licdn.com .redditstatic.com connect.facebook.net .hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 14:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3693498
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
access-control-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET,POST,PUT,PATCH
content-type: application/json
via: 1.1 286eb4b50e0acf373dd03645aee00b7e.cloudfront.net (CloudFront)
cache-control: max-age=0, must-revalidate, no-store, private
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
content-security-policy: script-src 'nonce-cf9bf898f29d24bc1a8c417a3fc149c8' dashboard.weglot.com *.weglot.com *.stripe.com *.announcekit.app *.nolt.io *.jsdelivr.net *.firstpromoter.com beacon-v2.helpscout.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com *.snap.licdn.com *.redditstatic.com connect.facebook.net *.hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
x-amz-cf-pop: FRA2-C2
access-control-allow-headers: Content-Type
x-amz-cf-id: 5yen5V2zYBzPFxE7OhNdwn5jhbu4duWBXOcrXhvzChJBRMIBeHxTpg==
expires: Tue, 26 Jul 2022 14:23:32 GMT

GET
H2 200 slugs Show response
cdn-api.weglot.com/translations/ 2 B
1 KB 86ms
19ms Fetch
application/json 13.225.78.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-api.weglot.com/translations/slugs?api_key=wg_234baeaaccaa2f09e0dc6c004f571bbd6&language_to=ja&v=1658845381

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-129.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-782e5a974ee0bb3d0ba64e22c8eb6426' dashboard.weglot.com .weglot.com .stripe.com .announcekit.app .nolt.io .jsdelivr.net .firstpromoter.com beacon-v2.helpscout.net .google.com .google-analytics.com .googletagmanager.com .googleadservices.com .gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com .snap.licdn.com .redditstatic.com connect.facebook.net .hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 14:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3693498
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
access-control-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET,POST,PUT,PATCH
content-type: application/json
via: 1.1 286eb4b50e0acf373dd03645aee00b7e.cloudfront.net (CloudFront)
cache-control: max-age=0, must-revalidate, no-store, private
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
content-security-policy: script-src 'nonce-782e5a974ee0bb3d0ba64e22c8eb6426' dashboard.weglot.com *.weglot.com *.stripe.com *.announcekit.app *.nolt.io *.jsdelivr.net *.firstpromoter.com beacon-v2.helpscout.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com *.snap.licdn.com *.redditstatic.com connect.facebook.net *.hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
x-amz-cf-pop: FRA2-C2
access-control-allow-headers: Content-Type
x-amz-cf-id: _zgr5J3SIO0ZLX7VlCS2VG8u4CPzuKdfeS8Ii7KlTH7LSDkxwl-8pg==
expires: Tue, 26 Jul 2022 14:23:32 GMT

GET
H2 200 slugs Show response
cdn-api.weglot.com/translations/ 2 B
1 KB 87ms
19ms Fetch
application/json 13.225.78.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-api.weglot.com/translations/slugs?api_key=wg_234baeaaccaa2f09e0dc6c004f571bbd6&language_to=es&v=1658845381

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-129.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-2dd656899da62f7cc3ab76b07d3eca63' dashboard.weglot.com .weglot.com .stripe.com .announcekit.app .nolt.io .jsdelivr.net .firstpromoter.com beacon-v2.helpscout.net .google.com .google-analytics.com .googletagmanager.com .googleadservices.com .gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com .snap.licdn.com .redditstatic.com connect.facebook.net .hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 14:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3693498
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
access-control-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET,POST,PUT,PATCH
content-type: application/json
via: 1.1 286eb4b50e0acf373dd03645aee00b7e.cloudfront.net (CloudFront)
cache-control: max-age=0, must-revalidate, no-store, private
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
content-security-policy: script-src 'nonce-2dd656899da62f7cc3ab76b07d3eca63' dashboard.weglot.com *.weglot.com *.stripe.com *.announcekit.app *.nolt.io *.jsdelivr.net *.firstpromoter.com beacon-v2.helpscout.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com *.snap.licdn.com *.redditstatic.com connect.facebook.net *.hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
x-amz-cf-pop: FRA2-C2
access-control-allow-headers: Content-Type
x-amz-cf-id: gOisHM8_CKg_63rCfmOj8y7W8vpaCza_K75_n9Wf1anAnNlAlMLxxA==
expires: Tue, 26 Jul 2022 14:23:32 GMT

GET
H2 200 slugs Show response
cdn-api.weglot.com/translations/ 2 B
1 KB 87ms
20ms Fetch
application/json 13.225.78.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-api.weglot.com/translations/slugs?api_key=wg_234baeaaccaa2f09e0dc6c004f571bbd6&language_to=de&v=1658845381

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-129.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-3f283f1ac3cd4c4004b53c13dba01313' dashboard.weglot.com .weglot.com .stripe.com .announcekit.app .nolt.io .jsdelivr.net .firstpromoter.com beacon-v2.helpscout.net .google.com .google-analytics.com .googletagmanager.com .googleadservices.com .gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com .snap.licdn.com .redditstatic.com connect.facebook.net .hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 14:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3693498
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
access-control-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET,POST,PUT,PATCH
content-type: application/json
via: 1.1 286eb4b50e0acf373dd03645aee00b7e.cloudfront.net (CloudFront)
cache-control: max-age=0, must-revalidate, no-store, private
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
content-security-policy: script-src 'nonce-3f283f1ac3cd4c4004b53c13dba01313' dashboard.weglot.com *.weglot.com *.stripe.com *.announcekit.app *.nolt.io *.jsdelivr.net *.firstpromoter.com beacon-v2.helpscout.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com *.snap.licdn.com *.redditstatic.com connect.facebook.net *.hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
x-amz-cf-pop: FRA2-C2
access-control-allow-headers: Content-Type
x-amz-cf-id: SiK9xdJycUhuRxpY2pD1M_ra-YK9GmnGzpNVYXCunDDZqyRVx9NRKA==
expires: Tue, 26 Jul 2022 14:23:32 GMT

GET
H2 200 slugs Show response
cdn-api.weglot.com/translations/ 79 B
1 KB 88ms
21ms Fetch
application/json 13.225.78.129
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-api.weglot.com/translations/slugs?api_key=wg_234baeaaccaa2f09e0dc6c004f571bbd6&language_to=br&v=1658845381

Requested by

Host: cdn.weglot.com
URL: https://cdn.weglot.com/weglot.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.78.129 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-129.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

e52ba320502e2cd491874b86e0e3fbffbd189d8913f5f46c6092056ecfa24104

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-3e37a68a6af83ab6588535f2acd56e4d' dashboard.weglot.com .weglot.com .stripe.com .announcekit.app .nolt.io .jsdelivr.net .firstpromoter.com beacon-v2.helpscout.net .google.com .google-analytics.com .googletagmanager.com .googleadservices.com .gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com .snap.licdn.com .redditstatic.com connect.facebook.net .hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 26 Jul 2022 14:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3693498
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
access-control-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET,POST,PUT,PATCH
content-type: application/json
via: 1.1 286eb4b50e0acf373dd03645aee00b7e.cloudfront.net (CloudFront)
cache-control: max-age=0, must-revalidate, no-store, private
permissions-policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(self), magnetometer=(), microphone=(), midi=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), usb=(), xr-spatial-tracking=(), clipboard-read=(self), clipboard-write=(self), hid=(), idle-detection=(), serial=()
content-security-policy: script-src 'nonce-3e37a68a6af83ab6588535f2acd56e4d' dashboard.weglot.com *.weglot.com *.stripe.com *.announcekit.app *.nolt.io *.jsdelivr.net *.firstpromoter.com beacon-v2.helpscout.net *.google.com *.google-analytics.com *.googletagmanager.com *.googleadservices.com *.gstatic.com static.ads-twitter.com analytics.twitter.com bat.bing.com snap.licdn.com *.snap.licdn.com *.redditstatic.com connect.facebook.net *.hotjar.com a.quora.com cdn.firstpromoter.com https: http:; object-src 'none'; base-uri 'self';
x-amz-cf-pop: FRA2-C2
access-control-allow-headers: Content-Type
x-amz-cf-id: hhNLyxgFoEmQUf7-hhsdh5f87xzigJUhD-CP5X73EjmEmwZ8R5bgJg==
expires: Tue, 26 Jul 2022 14:23:32 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 211 KB
74 KB 74ms
74ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N8JM61T88C&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW765SZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e4f8af8397a4ce79da835d2f6e3bf769b85a64ed4225b99d980775a2c5cf708f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 07 Sep 2022 08:21:50 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 75284
x-xss-protection: 0
expires: Wed, 07 Sep 2022 08:21:50 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 114ms
28ms Script
application/x-javascript 2a02:26f0:10e::6860:5baa
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW765SZ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10e::6860:5baa Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 07 Sep 2022 08:21:50 GMT
content-encoding: gzip
last-modified: Fri, 12 Aug 2022 20:23:36 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=82973
accept-ranges: bytes
content-length: 3063

GET
DATA 200
OK truncated
/ 255 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9948ae846979246ddfe993e604739594ce0e7cdfa77657412b9b0090009dcf23

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET activityi;src=9120626;type=unive0;cat=darkt00;ord=1406353784180;gtm=2wg8v0;auiddc=1423536176.1662538910;~oref=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-...
9120626.fls.doubleclick.net/ Frame 4EB5 0
0

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
16 KB 121ms
67ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PW765SZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 07 Sep 2022 08:21:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15690
x-xss-protection: 0
server: cafe
etag: 13194339052015637803
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 07 Sep 2022 08:21:50 GMT

GET
H2 200 otBannerSdk.js Show response
cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/ 375 KB
89 KB 52ms
52ms Script
application/javascript 2606:4700:4400::ac40:929e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/otBannerSdk.js

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:929e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b0766007565870c9a9ce93e31236bc0119fd01fff87ed569848a2a486e931c0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 07 Sep 2022 08:21:50 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
content-md5: PoUkurh3GT3DbFeu3QcwyA==
age: 3272
content-length: 91152
x-ms-lease-status: unlocked
last-modified: Tue, 23 Aug 2022 20:32:06 GMT
server: cloudflare
etag: 0x8DA85468BC88A3B
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: e013d49b-401e-006e-31e2-bd8db2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 746e087c3d3d0225-ZRH
expires: Wed, 07 Sep 2022 12:21:50 GMT

GET demandbase
match.prod.bidr.io/cookie-sync/ 0
0

GET
H2 451 464526.gif
id.rlcdn.com/ 0
98 B 66ms
25ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 07 Sep 2022 08:21:50 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 ip.json Show response
api.company-target.com/api/v2/ 3 KB
1 KB 113ms
64ms XHR
application/json 18.66.97.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&page_title=Page%20Not%20Found%20%7C%20Darktrace
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/20cb0107a53f0895.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-46.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: d014ec03f13264986bba76a74851a30bbc9702452dbe96a24d17f5f38bc776c7

Request headers

Referer: https://darktrace.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 07 Sep 2022 08:21:50 GMT
identification-source: CENTRAL
vary: Accept-Encoding, Origin
x-amz-cf-pop: FRA56-P2
x-cache: Miss from cloudfront
request-id: 3adaee76-3bdd-4b1a-9c82-e3ad4f83158c
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://darktrace.com
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 11e35514d631a9a9566fd489de935c06.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2CWQkQWT61C-tHQXDtt41M_NGJsQncFckcVeNXwJ6FoUIn2YA2BLrw==
expires: Tue, 06 Sep 2022 08:21:50 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
345 B 76ms
22ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-N8JM61T88C&gtm=2oe8v0&_p=201238890&cid=723120045.1662538910&ul=en-us&sr=1600x1200&_z=ccd.v9B&_s=1&sid=1662538910&sct=1&seg=0&dl=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&dt=Page%20Not%20Found%20%7C%20Darktrace&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N8JM61T88C&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Sep 2022 08:21:50 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://darktrace.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 en.json Show response
cdn-ukwest.onetrust.com/consent/2f0e2e84-c239-468b-b9dc-95c94890809c/d5ff8eee-09cb-4368-a822-e6582bcf7ca7/ 53 KB
12 KB 139ms
139ms Fetch
application/x-javascript 2606:4700:4400::ac40:929e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/consent/2f0e2e84-c239-468b-b9dc-95c94890809c/d5ff8eee-09cb-4368-a822-e6582bcf7ca7/en.json

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:929e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3ef8145f66e52c663d816432e10af9dd07771e0948c4ab7f0879b138b8aa4c95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 07 Sep 2022 08:21:50 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
content-md5: U2fI4ktBSkUZ+MPrqiTsaQ==
age: 5227
content-length: 12447
x-ms-lease-status: unlocked
last-modified: Thu, 25 Aug 2022 13:43:48 GMT
server: cloudflare
etag: 0x8DA869FD677EB24
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 20140744-601e-0036-59e2-bd89c9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 746e087cd92323df-ZRH

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1662538910198&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm=...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D67174%26time%3D1662538910198%26url%3Dhttps%253A%252F%252Fdarktrace.com%252Fblog%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1662538910198&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm=...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1662538910198&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm...

0
264 B

433ms
117ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1662538910198&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm=gtmv2&liSync=true&e_ipv6=AQIF8aL2_gD1AAAAAYMXCovC7dxDxQsGr0bsCf3lR71YrToph9I39e9QhUcn94QqgtfsTavQlQ
Requested by: Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Wed, 07 Sep 2022 08:21:50 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 91202901DE764189B5E538DB54340856 Ref B: FRAEDGE1321 Ref C: 2022-09-07T08:21:51Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXoEgE4Yw+VoHfUP8AP/w==
x-li-fabric: prod-lva1

Redirect headers

date: Wed, 07 Sep 2022 08:21:50 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 885D4E939B4149838E2F9D2B70068A43 Ref B: FRAEDGE1511 Ref C: 2022-09-07T08:21:50Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=67174&time=1662538910198&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tm=gtmv2&liSync=true&e_ipv6=AQIF8aL2_gD1AAAAAYMXCovC7dxDxQsGr0bsCf3lR71YrToph9I39e9QhUcn94QqgtfsTavQlQ
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXoEgExyHg/UKKijtI/wQ==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/401176436/ 2 KB
2 KB 105ms
60ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/401176436/?random=1662538910222&cv=9&fst=1662538910222&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg8v0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tiba=Page%20Not%20Found%20%7C%20Darktrace&auid=1423536176.1662538910&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f8b2ab4dd66efa078c8583c6e48514e1ad4a9738ddda93e4bfd3ddd9588a6841

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Sep 2022 08:21:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1069
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/401176436/ 42 B
64 B 61ms
26ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/401176436/?random=1662538910222&cv=9&fst=1662537600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg8v0&sendb=1&frm=0&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tiba=Page%20Not%20Found%20%7C%20Darktrace&async=1&fmt=3&is_vtc=1&random=1716918104&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Sep 2022 08:21:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/401176436/ 42 B
548 B 68ms
28ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/401176436/?random=1662538910222&cv=9&fst=1662537600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg8v0&sendb=1&frm=0&url=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&tiba=Page%20Not%20Found%20%7C%20Darktrace&async=1&fmt=3&is_vtc=1&random=1716918104&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Sep 2022 08:21:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 otFlat.json Show response
cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/assets/ 13 KB
3 KB 53ms
52ms Fetch
application/json 2606:4700:4400::ac40:929e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/assets/otFlat.json

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:929e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 07 Sep 2022 08:21:50 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
content-md5: ivRWEcgBmKISMHohZLmqHg==
age: 5227
content-length: 3007
x-ms-lease-status: unlocked
last-modified: Tue, 23 Aug 2022 20:31:53 GMT
server: cloudflare
etag: 0x8DA85468405BB89
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: e014a099-401e-006e-12e2-bd8db2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 746e087dcadc23df-ZRH
expires: Wed, 07 Sep 2022 12:21:50 GMT

GET
H2 200 otPcCenter.json Show response
cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/assets/v2/ 62 KB
13 KB 54ms
53ms Fetch
application/json 2606:4700:4400::ac40:929e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/assets/v2/otPcCenter.json

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:929e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3e634eb4bc8fc909bd1ea389002b9036063e2fe86f1a423fb2eb577baaf7e1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 07 Sep 2022 08:21:50 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
content-md5: 21cHQ6etMkoj8lO7BcUj3Q==
age: 5227
content-length: 13334
x-ms-lease-status: unlocked
last-modified: Tue, 23 Aug 2022 20:31:56 GMT
server: cloudflare
etag: 0x8DA854685C28887
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: c6c453ef-d01e-0049-12e2-bd17fb000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 746e087dcadd23df-ZRH
expires: Wed, 07 Sep 2022 12:21:50 GMT

GET
H2 200 otCommonStyles.css Show response
cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/assets/ 22 KB
5 KB 46ms
45ms Fetch
text/css 2606:4700:4400::ac40:929e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/assets/otCommonStyles.css

Requested by

Host: cdn-ukwest.onetrust.com
URL: https://cdn-ukwest.onetrust.com/scripttemplates/202208.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:929e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 07 Sep 2022 08:21:50 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
content-md5: B55i3ZY9miZIaUrwjufy0w==
age: 5227
x-ms-lease-status: unlocked
last-modified: Tue, 23 Aug 2022 20:32:15 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 59f4d048-801e-005a-09e2-bd221a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
cf-ray: 746e087dcade23df-ZRH
expires: Wed, 07 Sep 2022 12:21:50 GMT

GET
H2 200 62aa2f9b38cc775f4bdc1381_TypeType%20-%20TT%20Interphases%20Pro%20DemiBold.ttf
assets.website-files.com/626ff19cdd07d1258d49238d/ 136 KB
65 KB 30ms
30ms Font
application/x-font-ttf 2600:9000:211a:4e00:11:3b84:d200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.website-files.com/626ff19cdd07d1258d49238d/62aa2f9b38cc775f4bdc1381_TypeType%20-%20TT%20Interphases%20Pro%20DemiBold.ttf
Requested by: Host: assets-global.website-files.com
URL: https://assets-global.website-files.com/626ff19cdd07d1258d49238d/css/web-phoenix.509e6aba0.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211a:4e00:11:3b84:d200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 79a7d5deff1189cba78946faa0ed6bd78a1c9292cfad4329b208d0be5a045ff7

Request headers

Referer: https://assets-global.website-files.com/
Origin: https://darktrace.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date: Tue, 02 Aug 2022 16:03:41 GMT
content-encoding: br
age: 3082689
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Fri, 01 Jul 2022 16:04:37 GMT
server: AmazonS3
etag: W/"6e56bc5a25ce4549b6a7580fd047582c"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
x-amz-version-id: 1q.Kipg6KvQuvMwrlLhzKvk3zJ.eCFMs
via: 1.1 2a5303ed411734ba7adcd9ff65d96392.cloudfront.net (CloudFront)
cache-control: max-age=31536000, must-revalidate
x-amz-cf-pop: VIE50-C2
content-type: application/x-font-ttf
x-amz-cf-id: J4h_qR8hbJ0N9WKsu2dUOtm2N7j4KnijZnBtRDynNHlpXD1ACHSZ3w==

GET
H2 200 ot_logo.png
cdn-ukwest.onetrust.com/logos/static/ 13 KB
13 KB 54ms
53ms Image
image/png 2606:4700:4400::ac40:929e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-ukwest.onetrust.com/logos/static/ot_logo.png

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:929e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61e7a7943f7444e87b2af6295044b34292a537a23dd3d9436886e3a2ccf620ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 07 Sep 2022 08:21:50 GMT
vary: Accept-Encoding
cf-cache-status: HIT
content-md5: 8WyO+79CLtcTX81zrcTfgg==
age: 9425
content-length: 13077
x-ms-lease-status: unlocked
last-modified: Tue, 23 Aug 2022 20:32:14 GMT
server: cloudflare
etag: 0x8DA8546904A084C
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: ee48c9ce-d01e-0024-51e2-bdbdd5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 746e087e69fa0225-ZRH
expires: Wed, 07 Sep 2022 12:21:50 GMT

GET
H2 200 poweredBy_ot_logo.svg
cdn-ukwest.onetrust.com/logos/static/ 3 KB
2 KB 50ms
49ms Image
image/svg+xml 2606:4700:4400::ac40:929e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn-ukwest.onetrust.com/logos/static/poweredBy_ot_logo.svg

Requested by

Host: darktrace.com
URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:929e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49b9b4996d1ff0a8e3de643a0c623255bf631f298f2799b949c29de93926ee7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://darktrace.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 07 Sep 2022 08:21:50 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
content-md5: LpuayL42jB78xRllx0vkOw==
age: 9896
x-ms-lease-status: unlocked
last-modified: Tue, 23 Aug 2022 20:32:13 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: ee48c967-d01e-0024-73e2-bdbdd5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
cf-ray: 746e087e69fe0225-ZRH
expires: Wed, 07 Sep 2022 12:21:50 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 9120626.fls.doubleclick.net
URL: https://9120626.fls.doubleclick.net/activityi;src=9120626;type=unive0;cat=darkt00;ord=1406353784180;gtm=2wg8v0;auiddc=1423536176.1662538910;~oref=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522?

Domain: match.prod.bidr.io
URL: https://match.prod.bidr.io/cookie-sync/demandbase

Verdicts & Comments Add Verdict or Comment

46 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
careers.darktrace.com/	1970-01-20 05:49:06	Name: XSRF-TOKEN Value: eyJpdiI6InFhdkY2dGFzSlI4Y0NpYVhlWmtRTWc9PSIsInZhbHVlIjoiVmVIT3FGa3dzQlB6amwvYnI4OHM3eWtpOU5CUk9ramdXRUYwd0QwRE1JZFNvc1VoSHhudG5JZ3dUdDBQNE5jSDdNQ0FqalY5dVVwTnI2LzBZZC8weGRPakY1TjV3ZndCVWFYZnVFcndFVWRDdzYvSWNOUU9xTVJCbTJuK1BjL0MiLCJtYWMiOiI2MDYxYjljNmNjNzViMGM0OWI0ODc4MzkyYjc1NzBiY2Q5MGNhN2U0ZjQzNzY5YzI0Nzg5YjNlYjA3OWQwNTk0IiwidGFnIjoiIn0%3D
careers.darktrace.com/	1970-01-20 05:49:06	Name: darktrace_careers_session Value: eyJpdiI6IlVjb3JjeHFaSzlKd0VnYlkvbzVFTVE9PSIsInZhbHVlIjoiWnFUMHdudFp5MGRLVWswNFhva2Z5Y0V5cVRHb2luOGk5NllUcXNrY1lrR2szcmQvM0NhbUpYVVBKRkZ2UE1mQVZVOXcxS0tvbFpMVnYrN1JRRnVaejlKdUtMdXlJcTNUc3ExejQybTJ0ZXZXb2wrcCtVYmdRUEJGNnA1Qnl0NmMiLCJtYWMiOiJlYjFhZmZhOGY2OWEyMGFjNWQyOWI2MjljOTk2ZGE5MjY1YWIzODU4ZjdkZmYzZDMyMTE5NjY4YmNhODAwYjc1IiwidGFnIjoiIn0%3D
ir.darktrace.com/	1969-12-31 23:59:59	Name: adonis-session Value: d251478c358113b881e95e67fa3d5f45zIdIt%2FrYusNhpGsjnGOr%2BZO2pDmaHUeDEEHaHsiVXUfkIjgWA1duCYXckZVz%2FJoVy%2Fyy%2BiEymG%2F%2FYQHb%2FRIoxvyO389L8wgavyujyUz9yIw9oJ3bKo5wXq24IfFiGRh1
ir.darktrace.com/	1970-01-20 05:49:06	Name: XSRF-TOKEN Value: d1ce0e0a660fff0850a3a9419a2b84063n%2Fp1ZUPIxnDk1Z0mdCxqj07vKcVrjqpHJOz9LRGVgmHNzc7b36Olnestf%2FA4Ip3rMcqWYaIqQBSXEOUVit4l6JJww6hJgS28f%2BtXso9rD52zIEFyeoMPGzNJy%2BaakyM
ir.darktrace.com/	1969-12-31 23:59:59	Name: adonis-session-values Value: 7dbc50c5f1b9aa917584ad5f696646eacNZoTVXz%2FmO3qry3E0qZz4gL0J5RGtAj6g91EvOkEhaKyTxLy8H06gzzlqwEz77BLnhDFsvBWK%2FCEkpoTPSOxoweZkXIH9KMT04wtHdurF0ndneXImgr2fWYRbUQh0WpMEiWn4fA2gvPykk9mFrNxB9ZpYCpuGTW9oLUsZhUY6z2KWEV8Q8KA5f%2FqH0RJcKp41ehSyhYaC2RXQgp3x42ZBwI5lkPaa3JSQKoXrR%2B6FgDGla%2BNTlrPR5wqlj0DFZAFPfcLOIwSFPB3iynYdm7cy%2ByQsReONYY0J6%2FGodEG1jbiJkBKvLOxavI4Xbv%2FrzG
.darktrace.com/	1970-01-20 07:58:34	Name: _gcl_au Value: 1.1.1423536176.1662538910
.darktrace.com/	1970-01-20 15:24:58	Name: _ga Value: GA1.1.723120045.1662538910
.darktrace.com/	1970-01-20 15:24:58	Name: _ga_N8JM61T88C Value: GS1.1.1662538910.1.1.1662538910.0.0.0
.doubleclick.net/	1970-01-20 05:48:59	Name: test_cookie Value: CheckForPermission
.darktrace.com/	1970-01-20 14:34:34	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Wed+Sep+07+2022+08%3A21%3A50+GMT%2B0000+(GMT)&version=202208.1.0&isIABGlobal=false&hosts=&consentId=f18a939a-4ced-40a4-9806-bdef8a7e9a7e&interactionCount=0&landingPath=https%3A%2F%2Fdarktrace.com%2Fblog%2Fold-but-still-dangerous-dharma-ransomware-via-rdp-intrusion%2F%2F%2F%2F%2522&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0
.linkedin.com/	1970-01-20 06:32:10	Name: UserMatchHistory Value: AQLbKEWkXRd7lAAAAYMXCoqbsc6O83sO3qdb0SoWD7ivVRD1Qyvu9ST9GRJ40l6WqZHy-VGQzHNEAg
.linkedin.com/	1970-01-20 06:32:10	Name: AnalyticsSyncHistory Value: AQL0sb98eTBRawAAAYMXCoqbpw0t7uvXYEJbibK80vvctrwRroKHxLkHKYuOSLlQkcNczYF-ptt4FLzzXczIPA
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 14:34:34	Name: bcookie Value: "v=2&517057de-f81a-4d26-8ee4-b0778abb8014"
.linkedin.com/	1970-01-20 05:50:25	Name: lidc Value: "b=VGST04:s=V:r=V:a=V:p=V:g=2718:u=1:x=1:i=1662538910:t=1662625310:v=2:sig=AQHdpOJqSD5SxXdBvdjCH1CSIz5-rxez"
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 14:34:34	Name: bscookie Value: "v=1&202209070821500a1a6aeb-4c73-41ee-80e4-d108da442260AQGhbIUz6O9zyrlVqkrEqL7XpE8bD31M"
.linkedin.com/	1970-01-20 10:08:10	Name: li_gc Value: MTswOzE2NjI1Mzg5MTA7MjswMjEtD0w2NSaMrgcGUtvNglzWDSK1Psv2+Z6ES4a/zEAODw==
darktrace.com/	1970-01-20 05:48:59	Name: _dd_s Value: logs=1&id=b3e3b91c-f450-4f2d-bef2-d4557d795cd1&created=1662538910115&expire=1662539810116

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://darktrace.com/blog/old-but-still-dangerous-dharma-ransomware-via-rdp-intrusion////%22 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://id.rlcdn.com/464526.gif Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9120626.fls.doubleclick.net
api.company-target.com
assets-global.website-files.com
assets.website-files.com
careers.darktrace.com
cdn-api.weglot.com
cdn-ukwest.onetrust.com
cdn.weglot.com
d3e54v103j8qbb.cloudfront.net
darktrace.com
geolocation.onetrust.com
googleads.g.doubleclick.net
id.rlcdn.com
ir.darktrace.com
match.prod.bidr.io
px.ads.linkedin.com
px4.ads.linkedin.com
region1.google-analytics.com
snap.licdn.com
tag.demandbase.com
www.darktrace.com
www.datadoghq-browser-agent.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.linkedin.com
9120626.fls.doubleclick.net
match.prod.bidr.io
108.138.1.193
108.138.17.87
13.107.42.14
13.225.78.129
13.225.84.179
142.250.186.34
172.67.0.161
18.66.97.46
2001:4860:4802:34::36
2600:9000:206e:4600:12:9e5f:cac0:93a1
2600:9000:206e:b200:1:28b3:b280:93a1
2600:9000:211a:4e00:11:3b84:d200:93a1
2606:4700:4400::ac40:929e
2620:1ec:21::14
2a00:1450:4001:809::2003
2a00:1450:4001:80f::2003
2a00:1450:4001:827::2002
2a00:1450:4001:827::2004
2a00:1450:4001:82b::2008
2a02:26f0:10e::6860:5baa
34.253.101.190
35.244.174.68
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
1a7f603a9dd1e0a381c028839fdc00b6c6bfa4869b4a8ba22ecda60037ebcaac
21dea0cdc956cea9bb658cc7338d5a7526ba4bee4a4e2c15b2d067b57734b3ab
3ef8145f66e52c663d816432e10af9dd07771e0948c4ab7f0879b138b8aa4c95
4138531350f138a2e6f5fd9465a31436698dbe6cb9d9894ab0ac9058bc6398fc
49b9b4996d1ff0a8e3de643a0c623255bf631f298f2799b949c29de93926ee7a
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
55ed0c37ad3490e7bc1ef5d0b3100b2f90ef6e30024a474da7b1ab6d0037e29f
58afd37317e5adb23a1e2b5006169e2350cdbc8948ee7998250fce897f3fb699
61e7a7943f7444e87b2af6295044b34292a537a23dd3d9436886e3a2ccf620ca
659f3a582c2c4f15e673a3b6c893427d55061acb9d2ff1ab0a00f067c6f0528a
69b9fc3d390d3d3fa1acf88cd79696ce9d2bc3dc1e10d459f89756d2e90d40f0
71e525f4a8cfaa33a6b13bf5ba608ca1c0c8e38b7616b031a18c33460ba690f2
79a7d5deff1189cba78946faa0ed6bd78a1c9292cfad4329b208d0be5a045ff7
7bbc0a1a176faba3ab4ef9aebd61fbc1fd8afc56ce0ed7f7183d8256a57bb024
844493efec5d756f8880f89560ba4877b3df232960b0f60170447b397ef4727b
8e38f112a12bbb2df0b18f6221ac9730374e46edbefd04641929d4f1ec350e4f
8eb91a0802b9e79aef3e47554a25b80de2f8ef73d3053b28c81820734179f4e9
9215591d842950b73dfde60917a48e309c617d3787046db80940902e4f8368ee
9270bbe635cc7cf73fcdaa51e5e9ea0ad367a2ca4eeec9b837c5779ceb45cd40
9948ae846979246ddfe993e604739594ce0e7cdfa77657412b9b0090009dcf23
a2c340dd3914586acfd9e644e15964cb976c43d5d05dd4db674cf70271cac1ed
a6fd219289d32bb4cdc8e8831a6f56c5cc0e4246f324bb598277e0c9036753d4
adecd63acc4782d7f6bea59bda9e02bfcc6f90ed14ace7f83e06c6c814b58e2a
b0766007565870c9a9ce93e31236bc0119fd01fff87ed569848a2a486e931c0c
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
b59b82343b78feaa04fa094535c326c677790b720a2265af536515cd394aa783
bf5da93bd636c1fa4341d8f8eb4d4cac2f51b5ba91a58f61346bbccce2d88493
cbea10abc6a4fb6c6db32f7ff91d4e53f496579268f4f28e4e15f14c76cdd088
d014ec03f13264986bba76a74851a30bbc9702452dbe96a24d17f5f38bc776c7
dfe0ca20cde31b3e6a4253da8db7ac377f64b924cc056528122bdd21cfc88270
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3e634eb4bc8fc909bd1ea389002b9036063e2fe86f1a423fb2eb577baaf7e1c
e4f8af8397a4ce79da835d2f6e3bf769b85a64ed4225b99d980775a2c5cf708f
e52ba320502e2cd491874b86e0e3fbffbd189d8913f5f46c6092056ecfa24104
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6b6ed623b9789747d2e491b3ad692793d461be2f27bdf0c531b2d953fa670d
f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f8b2ab4dd66efa078c8583c6e48514e1ad4a9738ddda93e4bfd3ddd9588a6841
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f

darktrace.com Open in urlscan Pro 34.253.101.190 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

52 Requests

94 %HTTPS

55 %IPv6

19 Domains

28 Subdomains

22 IPs

4 Countries

1082 kBTransfer

3595 kBSize

19 Cookies

15 Outgoing links

Page URL History

Redirected requests

52 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

darktrace.com Open in urlscan Pro
34.253.101.190 Public Scan

Screenshot
Live screenshot

Full Image

52
Requests

94 %
HTTPS

55 %
IPv6

19
Domains

28
Subdomains

22
IPs

4
Countries

1082 kB
Transfer

3595 kB
Size

19
Cookies

52 HTTP transactions
1 data transactions