news.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42c8  Public Scan

53 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 47

• https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=338349653&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=A%20Conti%20ransomware%20attack%20day-by-day%20%E2%80%93%20Sophos%20News&utmhid=1146585759&utmr=-&utmp=%2Fcorpblog%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&utmht=1613741232779&utmac=UA-737537-1&utmcc=__utma%3D1.714291543.1613741233.1613741233.1613741233.1%3B%2B__utmz%3D1.1613741233.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=2059283762&utmredir=3&utmu=q1CAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=714291543.1613741233&jid=2059283762&_v=5.7.2dc&z=338349653 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=714291543.1613741233&jid=2059283762&_v=5.7.2dc&z=338349653&slf_rd=1&random=1732237359

Request Chain 49

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1613741232794&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1613741232794%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-us%252F2021%252F02%252F16%252Fconti-ransomware-attack-day-by-day%252F%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1613741232794&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&liSync=true

Request Chain 62

• https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
• https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
• https://segments.company-target.com/log?vendor=choca&user_id=AAHYFk7AX3kAABBcu_Aa7Q HTTP 303
• https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAHYFk7AX3kAABBcu_Aa7Q&verifyHash=64b59741a20fa94a47e7bb162e178205ea3088e3

60 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
9 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/	48 KB 14 KB	25ms 5ms	Document text/html	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / WordPress VIP <https://wpvip.com> Resource Hash 031537da3d3701a6f7ef79863b53a68c38a597b3180402b836ed81b6359ade6b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers :method GET :authority news.sophos.com :scheme https :path /en-us/2021/02/16/conti-ransomware-attack-day-by-day/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers server nginx date Fri, 19 Feb 2021 13:27:12 GMT content-type text/html; charset=UTF-8 content-length 13785 x-hacker If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header. x-powered-by WordPress VIP <https://wpvip.com> host-header a9130478a60e5f9135f765b23f26593b link <https://news.sophos.com/wp-json/>; rel="https://api.w.org/" <https://news.sophos.com/wp-json/wp/v2/posts/72541>; rel="alternate"; type="application/json" <https://news.sophos.com/?p=72541>; rel=shortlink content-encoding gzip x-rq hhn2 101 200 3081 cache-control max-age=300, must-revalidate age 59 x-cache hit vary Accept-Encoding accept-ranges bytes strict-transport-security max-age=31536000
GET H2	200	/ news.sophos.com/_static/	453 KB 198 KB	6ms 5ms	Stylesheet text/css	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.4/css/jetpack.css?m=1613605105 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 344165dd87edae72118753f5eb282abc235005e020875994cd9bb63758a0e42a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT content-encoding gzip x-rq hhn2 102 104 3131 last-modified Wed, 03 Feb 2021 21:57:32 GMT server nginx age 133040 vary Accept-Encoding x-cache hit content-type text/css;charset=utf-8 cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 202598
GET H2	200	/ Show response news.sophos.com/_static/	98 KB 34 KB	15ms 14ms	Script application/x-javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZebmaeXVayjj0+Rbm5melFiSSpUsX2uraGZobGppaWRqVEWAK+CIiM= Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7eb243627ed4013b84418c9fe94ee3b9907906ace4de00965ff3b3b33a9f151c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT content-encoding gzip x-rq hhn2 101 200 3081 last-modified Wed, 17 Feb 2021 22:00:52 GMT server nginx age 133040 vary Accept-Encoding x-cache hit content-type application/x-javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 34537
GET H2	200	gtm.js Show response www.googletagmanager.com/	91 KB 35 KB	21ms 20ms	Script application/javascript	2a00:1450:4001:802::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash db587ec5a1bcbe1ddb9432674793819adf179d9f365d322fb0bf0bc44f8a6309 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT content-encoding br vary * cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35572 x-xss-protection 0 pragma no-cache server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	wp-emoji-release.min.js Show response news.sophos.com/wp-includes/js/	14 KB 5 KB	8ms 5ms	Script application/x-javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-includes/js/wp-emoji-release.min.js?ver=5.6.1 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT content-encoding gzip x-rq hhn2 102 126 3117 last-modified Wed, 03 Feb 2021 21:57:24 GMT server nginx age 1345905 etag W/"601b1c44-3795" vary Accept-Encoding x-cache hit content-type application/x-javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 4712 expires Sat, 19 Feb 2022 13:27:12 GMT
GET H2	200	IMG_20161230_152920.jpg news.sophos.com/wp-content/uploads/2021/02/	5 KB 6 KB	8ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/02/IMG_20161230_152920.jpg?w=145 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash e99cba6306e2262bb1a898b7e4ed821c6007f3db7d47ec1e4b70877cab3d8818 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT x-rq hhn2 109 142 443 last-modified Wed, 10 Feb 2021 21:30:17 GMT server nginx etag "5b465aa66d52eae1" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 5502 expires Thu, 10 Feb 2022 21:30:17 GMT
GET H2	200	facebook-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	600 B 957 B	176ms 90ms	Image image/svg+xml	23.36.239.66 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/facebook-icon.svg?la=en&hash=1CA0A5A0E9C9999E7E079A5D32C86E9BF9C7AD1E Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.36.239.66 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-36-239-66.deploy.static.akamaitechnologies.com Software / Resource Hash c87eb0c349fe4518e3ffd3d05b3f43f90d4f8709eb7f9924e74e858a6efdb6ed Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 1147, 1147, 1147, 1147 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 2, 21, 2, 16 server-timing cdn-cache; desc=HIT, edge; dur=57 content-length 395 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:34:25 GMT x-frame-options SAMEORIGIN date Fri, 19 Feb 2021 13:27:12 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=257 expires Fri, 19 Feb 2021 13:31:29 GMT
GET H2	200	instagram-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	2 KB 2 KB	304ms 218ms	Image image/svg+xml	23.36.239.66 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/instagram-icon.svg?la=en&hash=2B50C2B67C3023D9E7D4E1C3A16401EAD8F10F76 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.36.239.66 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-36-239-66.deploy.static.akamaitechnologies.com Software / Resource Hash 9f67d83d034c658809bf7a06ff6d74a417ea25a0005f4561abd5254652b6d7c6 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 2200, 2200, 2200, 2253, 2200, 2200 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 0, 20, 0, 0, 1, 1 server-timing cdn-cache; desc=HIT, edge; dur=176 content-length 990 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:37:54 GMT x-frame-options SAMEORIGIN date Fri, 19 Feb 2021 13:27:12 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=841 expires Fri, 19 Feb 2021 13:41:13 GMT
GET H2	200	linkedin-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	923 B 1 KB	469ms 384ms	Image image/svg+xml	23.36.239.66 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/linkedin-icon.svg?la=en&hash=B6D5378C1E1A16F239A4C862EAE3499B8EC1F3F9 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.36.239.66 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-36-239-66.deploy.static.akamaitechnologies.com Software / Resource Hash c6f378c4d31ede24622009dc2d5e85386926ea9881e94326252146bff0fd5110 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 237, 237, 237, 352, 237, 237, 237 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 0, 20, 0, 2, 1, 22, 119 server-timing cdn-cache; desc=HIT, edge; dur=330 content-length 516 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:36:13 GMT x-frame-options SAMEORIGIN date Fri, 19 Feb 2021 13:27:12 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=221 expires Fri, 19 Feb 2021 13:30:53 GMT
GET H2	200	rss-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	461 B 816 B	692ms 606ms	Image image/svg+xml	23.36.239.66 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/rss-icon.svg?la=en&hash=76C4DAFD331DC675814191A66794A778D8C6DCF7 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.36.239.66 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-36-239-66.deploy.static.akamaitechnologies.com Software / Resource Hash b7c9fd97a3a7165755766cd3ba55676f6505642b8c522d89d6f0ab0cabaaa8d7 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 274, 274, 333 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 28, 29, 0 server-timing cdn-cache; desc=HIT, edge; dur=542 content-length 305 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:36:16 GMT x-frame-options SAMEORIGIN date Fri, 19 Feb 2021 13:27:13 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=84 expires Fri, 19 Feb 2021 13:28:37 GMT
GET H2	200	twitter-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	1 KB 1 KB	427ms 342ms	Image image/svg+xml	23.36.239.66 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/twitter-icon.svg?la=en&hash=9A90D9F99ABE6454741BBAAF9C3FB6966624C92D Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.36.239.66 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-36-239-66.deploy.static.akamaitechnologies.com Software / Resource Hash 52600b30637371871a7d5d50ba86cb9a29ad65d75a78824b4daba442c4eee113 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 149, 149, 149, 319, 149, 149 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 1, 22, 1, 0, 2, 1 server-timing cdn-cache; desc=HIT, edge; dur=266 content-length 582 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Mon, 26 Nov 2018 11:36:19 GMT x-frame-options SAMEORIGIN date Fri, 19 Feb 2021 13:27:12 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=802 expires Fri, 19 Feb 2021 13:40:34 GMT
GET H2	200	youtube-icon.svg www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/	792 B 988 B	197ms 112ms	Image image/svg+xml	23.36.239.66 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.sophos.com/en-us/medialibrary/SophosNext/Images/Navigation/Footer/youtube-icon.svg?la=en&hash=CCCF647AFA78C8DB74D654DB9FEFBF0AC54F42D3 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.36.239.66 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-36-239-66.deploy.static.akamaitechnologies.com Software / Resource Hash 0ce7b19357902318f5e2db207e64647d6a78d7f9f620ef55a8a07ad2f8e6d798 Security Headers Name Value Strict-Transport-Security max-age=10886400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-edgeconnect-origin-mex-latency 233, 233, 233, 233 strict-transport-security max-age=10886400 content-encoding gzip x-content-type-options nosniff x-edgeconnect-midmile-rtt 0, 24, 1, 15 server-timing cdn-cache; desc=HIT, edge; dur=25 content-length 426 x-xss-protection 1; mode=block x-ua-compatible IE=edge referrer-policy strict-origin-when-cross-origin last-modified Thu, 16 May 2019 15:01:23 GMT x-frame-options SAMEORIGIN date Fri, 19 Feb 2021 13:27:12 GMT vary Accept-Encoding content-type image/svg+xml cache-control private, max-age=708 expires Fri, 19 Feb 2021 13:39:00 GMT
GET H2	200	/ Show response news.sophos.com/_static/	140 KB 40 KB	6ms 5ms	Script application/x-javascript	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/_static/??-eJyVkMEOwiAMhl9IYMxsnoyPYpDVjUmBUHD69mKWJR48jKSX/v2+NqlYAtPeJXBJpAkQSJAPkycHC7G2kScxU6kC+YcB9mx5y2UJ+BrwmQ5i1w7tYwUNrxQV7efXiOdkbL2lFQZlRlctBhWTg1jtjapa+WabZJy2eQBa34pYFrAIwb45GvcPKi3gDYbf+XYZMws2j8aRUA9DCElciyvuPmJhL3iWvTz2TSebbv4AbSPKCg== Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash a988b5aa1de46505228262448ce5f82ad6f90611ed840c3fe2b37d7081fec524 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT content-encoding gzip x-rq hhn2 102 126 3117 last-modified Wed, 03 Feb 2021 21:57:24 GMT server nginx age 133040 vary Accept-Encoding x-cache hit content-type application/x-javascript cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 41188
GET H2	200	e-202107.js Show response stats.wp.com/	9 KB 3 KB	50ms 16ms	Script application/javascript	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://stats.wp.com/e-202107.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-nc HIT ams date Fri, 19 Feb 2021 13:27:12 GMT content-encoding gzip server nginx etag W/"5c6340e3-350a" vary Accept-Encoding content-type application/javascript cache-control max-age=31536000 expires Sun, 06 Feb 2022 22:23:47 GMT
GET H2	200	footer.css news.sophos.com/wp-content/themes/sophosnews-2017/	3 KB 1014 B	6ms 6ms	Stylesheet text/css	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/footer.css Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.4/css/jetpack.css?m=1613605105 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 29e135bc96ba3ec4a643931a8ef458e48aa372894da5c635433993ea961ab7ae Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.4/css/jetpack.css?m=1613605105 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT content-encoding gzip x-rq hhn2 102 104 3087 last-modified Sat, 31 Oct 2020 08:56:19 GMT server nginx age 9177541 etag W/"5f9d26b3-a6e" vary Accept-Encoding x-cache hit content-type text/css cache-control max-age=31536000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 880 expires Sat, 19 Feb 2022 13:27:12 GMT
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f81f3b44c5da8f8b9b365294b2146763d666b9f445e1b2285466910d5361cec5 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	435 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 011ee00e2221fd2994156f01b85251391099270cc849857806d6a249481c90ff Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	342 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b0348edeb29dc1accfecb54a863c8597ea124c1ab9f1a38f3b9e12e953364a05 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	518 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1875cad468466b9b4ea2ebd196b8969f905ab31c20cd5e0a0c2da9b37fa12095 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c8fa9e46358747cc949be0709256687b7ac1f8fd295f0de4073b11a41c534b62 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	469 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04029edaf619462965453e8ac9cf74c584b1ef526c95f71185acc63a696b7f1c Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	665 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f2792fa9c99f81eaf3035f2ba7634dd84f42526df8a1f31196912de7e55c815e Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	349 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3f510f8a21c09db2bb8f964b3e424fce6a77aea73ac791e9c0c6b8b238405366 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	515 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 633210530499824ad06b2b30a04a9ee18b4b8e2071620691a58c9a476dc728b9 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET H2	200	sophos-news-ft-img-mtr_v3.png news.sophos.com/wp-content/uploads/2020/08/	48 KB 48 KB	7ms 5ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2020/08/sophos-news-ft-img-mtr_v3.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 7eb69c20bdfe9d883c00bc771f731f5841e0a62ba2c7a0b5d96300a9bf79832f Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT x-rq hhn2 109 30 443 last-modified Thu, 05 Nov 2020 08:08:10 GMT server nginx etag "f8f2bae8df859eec" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 49326 expires Fri, 05 Nov 2021 08:08:10 GMT
GET H2	200	ZTNA-header.png news.sophos.com/wp-content/uploads/2021/02/	104 KB 104 KB	8ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/02/ZTNA-header.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 1b9516037aef4a1390e382f03eb44df874758ed6f8acc06aa46dc7b3c8286443 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT x-rq hhn2 109 196 443 last-modified Tue, 02 Feb 2021 16:04:18 GMT server nginx etag "e05fded9a63cc7b5" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 106664 expires Wed, 02 Feb 2022 16:04:18 GMT
GET H2	200	sophos-news-ft-img-mtr_v1.png news.sophos.com/wp-content/uploads/2020/08/	27 KB 27 KB	8ms 7ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2020/08/sophos-news-ft-img-mtr_v1.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 5572c863ab7c9fbc6f64ef41a39b12e7a4a24e3c298989ed9796e9e14f8925d3 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT x-rq hhn2 109 139 443 last-modified Thu, 05 Nov 2020 10:48:34 GMT server nginx etag "a0a7f780337fa3d6" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 27584 expires Fri, 05 Nov 2021 10:48:34 GMT
GET H2	200	APIs-hero.png news.sophos.com/wp-content/uploads/2020/12/	58 KB 58 KB	8ms 7ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2020/12/APIs-hero.png?w=640 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 49f04b810da5ba0377466eb23302f9e33f6c5104be7bcb55322f140e2078f2cb Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT x-rq hhn2 109 30 443 last-modified Thu, 17 Dec 2020 19:39:59 GMT server nginx etag "f2b82ad4c1a7307a" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 58934 expires Fri, 17 Dec 2021 19:39:59 GMT
GET H2	200	SophosSans-Regular.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	24 KB 25 KB	9ms 8ms	Font application/font-woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Regular.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.4/css/jetpack.css?m=1613605105 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash c1da7a3d76f2fd71ba637d968b49556520ee94d72a5b60a5d21f34f5e4029ec4 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin https://news.sophos.com Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.4/css/jetpack.css?m=1613605105 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT x-rq hhn2 101 200 3081 last-modified Wed, 17 Feb 2021 23:38:25 GMT server nginx age 991 etag "602da8f1-61bc" strict-transport-security max-age=31536000 x-cache hit content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-methods GET, HEAD accept-ranges bytes content-length 25020 expires Sat, 19 Feb 2022 13:27:12 GMT
GET H2	200	SophosSans-Light.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	25 KB 25 KB	9ms 8ms	Font application/font-woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Light.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.4/css/jetpack.css?m=1613605105 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin https://news.sophos.com Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.4/css/jetpack.css?m=1613605105 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT x-rq hhn2 102 126 3117 last-modified Sun, 01 Nov 2020 13:44:25 GMT server nginx age 991 etag "5f9ebbb9-62e4" strict-transport-security max-age=31536000 x-cache hit content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-methods GET, HEAD accept-ranges bytes content-length 25316 expires Sat, 19 Feb 2022 13:27:12 GMT
GET H2	200	SophosSans-Medium.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	26 KB 26 KB	10ms 9ms	Font application/font-woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Medium.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.4/css/jetpack.css?m=1613605105 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin https://news.sophos.com Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.4/css/jetpack.css?m=1613605105 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT x-rq hhn2 103 47 3114 last-modified Thu, 29 Oct 2020 17:01:28 GMT server nginx age 350 etag "5f9af568-67a4" strict-transport-security max-age=31536000 x-cache hit content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-methods GET, HEAD accept-ranges bytes content-length 26532 expires Sat, 19 Feb 2022 13:27:12 GMT
GET H2	200	SophosSans-Semibold.woff2 news.sophos.com/wp-content/themes/sophosnews-2017/fonts/	26 KB 26 KB	10ms 10ms	Font application/font-woff2	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Full URL https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Semibold.woff2 Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.4/css/jetpack.css?m=1613605105 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f927844e8c953560f5a67112c5dfaab926df93df57f3d8cd062028f1ca80b530 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin https://news.sophos.com Referer https://news.sophos.com/_static/??/wp-includes/css/dist/block-library/style.min.css,/wp-content/themes/sophosnews-2017/style.css,/wp-content/mu-plugins/jetpack-9.4/css/jetpack.css?m=1613605105 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT x-rq hhn2 103 47 3114 last-modified Thu, 29 Oct 2020 17:01:28 GMT server nginx age 1758 etag "5f9af568-6828" strict-transport-security max-age=31536000 x-cache hit content-type application/font-woff2 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-methods GET, HEAD accept-ranges bytes content-length 26664 expires Sat, 19 Feb 2022 13:27:12 GMT
GET H2	200	sophos-conti-ransomware-web-banner-1200x628px-option-2-1.png news.sophos.com/wp-content/uploads/2021/02/	114 KB 114 KB	6ms 5ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/02/sophos-conti-ransomware-web-banner-1200x628px-option-2-1.png?resize=768,402 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 32e70a1d8a3c71cf746f74dc3afbd4dd89f1c8d5db58ceb10fa1bbf2cf852047 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT x-rq hhn2 109 86 443 last-modified Tue, 16 Feb 2021 14:03:39 GMT server nginx etag "f31b252610365969" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 116928 expires Wed, 16 Feb 2022 14:03:39 GMT
GET H2	200	sophos-countries-data-published-by-conti-ransomware-1200x628px.png news.sophos.com/wp-content/uploads/2021/02/	52 KB 52 KB	7ms 6ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/02/sophos-countries-data-published-by-conti-ransomware-1200x628px.png?resize=768,402 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 4d75f9e6d1911ff33c5e06a1fe29d5db4dfd6906e19795560d659215a469b2ed Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT x-rq hhn2 109 30 443 last-modified Tue, 16 Feb 2021 15:23:22 GMT server nginx etag "7852d4d0ab2f1db9" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 52894 expires Wed, 16 Feb 2022 15:23:22 GMT
GET H2	200	sophos-sector-industry-data-published-by-conti-ransomware-1200x628px-1.png news.sophos.com/wp-content/uploads/2021/02/	37 KB 37 KB	8ms 7ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/02/sophos-sector-industry-data-published-by-conti-ransomware-1200x628px-1.png?resize=768,402 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 0620fc779748c19b9871471160f6ab19b4c85de983645451c013d356b364c935 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT x-rq hhn2 109 88 443 last-modified Tue, 16 Feb 2021 15:23:22 GMT server nginx etag "7eb50fcbce8c4a51" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 37678 expires Wed, 16 Feb 2022 15:23:22 GMT
GET H2	200	sophos-mtr-rapid-response-timeline-conti2.png news.sophos.com/wp-content/uploads/2021/02/	115 KB 115 KB	9ms 8ms	Image image/webp	2a04:fa87:fffd::c000:42c8 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://news.sophos.com/wp-content/uploads/2021/02/sophos-mtr-rapid-response-timeline-conti2.png?resize=768,911 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:fa87:fffd::c000:42c8 , Ireland, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash 17ae5b3704b7aac34ff851ded4498adce565728a19461d042de7e42bf1cafb81 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT x-rq hhn2 109 144 443 last-modified Tue, 16 Feb 2021 15:24:12 GMT server nginx etag "1892c6a072e83f54" vary Accept x-cache HIT content-type image/webp cache-control max-age=2592000 strict-transport-security max-age=31536000 accept-ranges bytes content-length 117384 expires Wed, 16 Feb 2022 15:24:12 GMT
GET H2	200	dc.js Show response stats.g.doubleclick.net/	45 KB 17 KB	14ms 14ms	Script text/javascript	2a00:1450:400c:c07::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/dc.js Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyVkMEOwiAMhl9IYMxsnoyPYpDVjUmBUHD69mKWJR48jKSX/v2+NqlYAtPeJXBJpAkQSJAPkycHC7G2kScxU6kC+YcB9mx5y2UJ+BrwmQ5i1w7tYwUNrxQV7efXiOdkbL2lFQZlRlctBhWTg1jtjapa+WabZJy2eQBa34pYFrAIwb45GvcPKi3gDYbf+XYZMws2j8aRUA9DCElciyvuPmJhL3iWvTz2TSebbv4AbSPKCg== Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 05 Feb 2021 21:33:27 GMT server Golfe2 age 2784 date Fri, 19 Feb 2021 12:40:48 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17093 expires Fri, 19 Feb 2021 14:40:48 GMT
GET H/1.1	200 OK	elqCfg.min.js Show response img03.en25.com/i/	6 KB 3 KB	78ms 28ms	Script application/x-javascript	23.36.237.138 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://img03.en25.com/i/elqCfg.min.js Requested by Host: news.sophos.com URL: https://news.sophos.com/_static/??-eJyVkMEOwiAMhl9IYMxsnoyPYpDVjUmBUHD69mKWJR48jKSX/v2+NqlYAtPeJXBJpAkQSJAPkycHC7G2kScxU6kC+YcB9mx5y2UJ+BrwmQ5i1w7tYwUNrxQV7efXiOdkbL2lFQZlRlctBhWTg1jtjapa+WabZJy2eQBa34pYFrAIwb45GvcPKi3gDYbf+XYZMws2j8aRUA9DCElciyvuPmJhL3iWvTz2TSebbv4AbSPKCg== Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.36.237.138 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-36-237-138.deploy.static.akamaitechnologies.com Software / Resource Hash 6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Content-Encoding gzip X-Content-Type-Options nosniff P3P CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA", Connection keep-alive Content-Length 2115 X-XSS-Protection 1; mode=block Pragma no-cache Last-Modified Fri, 16 Oct 2020 14:38:37 GMT Date Fri, 19 Feb 2021 13:27:12 GMT Vary Accept-Encoding Content-Type application/x-javascript Cache-Control no-cache, no-store ETag "ee5a418caa3d61:0" Accept-Ranges bytes Expires Fri, 19 Feb 2021 13:27:12 GMT
GET H2	200	g.gif pixel.wp.com/	50 B 92 B	18ms 16ms	Image image/gif	192.0.76.3 AUTOMATTIC
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.wp.com/g.gif?v=ext&j=1%3A9.4.1&blog=166161023&post=72541&tz=-5&srv=news.sophos.com&host=news.sophos.com&ref=&fcp=245&rand=0.6290851119909027 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US), Reverse DNS Software nginx / Resource Hash f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT cache-control no-cache server nginx content-length 50 content-type image/gif
GET H3-Q050	200	js Show response www.googletagmanager.com/gtag/	98 KB 39 KB	44ms 29ms	Script application/javascript	2a00:1450:4001:803::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-743773256 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash f159589ce41e419b1d8334ce617dcb90e8e5e6ee99d456758f4b510301be3b79 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39250 x-xss-protection 0 last-modified Fri, 19 Feb 2021 12:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 19 Feb 2021 13:27:12 GMT
GET H2	200	bat.js Show response bat.bing.com/	27 KB 9 KB	46ms 30ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 4dd6c09ddcb0e53a6290cc1df35224856073ba5f89d4134bd7c69e4fd9c6f515 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT content-encoding gzip last-modified Wed, 03 Feb 2021 20:48:20 GMT x-msedge-ref Ref A: 81A8CB97A3E94AB78F356513D148D642 Ref B: FRAEDGE1521 Ref C: 2021-02-19T13:27:12Z etag "042b8e76dfad61:0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 8454
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	91 KB 23 KB	6ms 6ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; content-encoding gzip x-content-type-options nosniff x-xss-protection 0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 23762 x-fb-rlafr 0 pragma public x-fb-debug lF2fPA1LGiKsryhy9djf5xv2nGvpDi9fBdRTC0tdSVfoGj3al9Mqt6HmA39mXKaETtSMSOM2gZBQN1DPdkUcVw== x-fb-trip-id 686109401 x-frame-options DENY cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" date Fri, 19 Feb 2021 13:27:12 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"group":"coop_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 origin-trial AqUfQvNe9Mod+kZ3Qx78GGg2ul4TtHv3l126BaOQCbywgYxRUP0y9rs8/el96V62SmT7ue9StD9aXvYmT3UAAQcAAAB5eyJvcmlnaW4iOiJodHRwczovL2ZhY2Vib29rLmNvbTo0NDMiLCJmZWF0dXJlIjoiQ3Jvc3NPcmlnaW5PcGVuZXJQb2xpY3lSZXBvcnRpbmciLCJleHBpcnkiOjE2MTM0MTE1NzMsImlzU3ViZG9tYWluIjp0cnVlfQ== cross-origin-opener-policy-report-only same-origin-allow-popups;report-to="coop_report" expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	4 KB 2 KB	7ms 7ms	Script application/x-javascript	2a02:26f0:7100:48a::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100:48a::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 19 Feb 2021 13:27:12 GMT Content-Encoding gzip Last-Modified Mon, 04 Jan 2021 22:14:03 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=12957 Connection keep-alive Accept-Ranges bytes Content-Length 1855
GET H2	200	WuEFNglz.min.js Show response scripts.demandbase.com/	60 KB 16 KB	465ms 149ms	Script application/javascript	143.204.110.71 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://scripts.demandbase.com/WuEFNglz.min.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.110.71 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-110-71.dxb50.r.cloudfront.net Software AmazonS3 / Resource Hash 058b79d96bbf2a9f0558efaff44f70126cb2f5e73d8758d0f9b86ea1672d642e Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id HYpIheFF8jWD1XlX2mxVztFQbf3DVt6K content-encoding gzip last-modified Wed, 20 Jan 2021 13:33:48 GMT server AmazonS3 age 3076 etag W/"94d0160d80ec0ee1a85a3b9515452619" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript; charset=utf-8 via 1.1 47d6f115cd7afcd6f492ee0f19186104.cloudfront.net (CloudFront) cache-control public, max-age=3600 date Fri, 19 Feb 2021 12:37:12 GMT x-amz-cf-pop DXB50-C1 x-amz-cf-id NCryIremflwlexNIHF94d6v7kPLxSoJv5hI0rG2ZjRvICxVykRaL7Q==
GET H2	200	uwt.js Show response static.ads-twitter.com/	5 KB 2 KB	75ms 24ms	Script application/javascript	151.101.12.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT via 1.1 varnish last-modified Fri, 04 Dec 2020 00:21:46 GMT age 48503 etag "cbc512946c8abb461c6215ed5b454e5f+gzip" vary Accept-Encoding,Host x-cache HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" content-encoding gzip cache-control no-cache accept-ranges bytes content-type application/javascript; charset=utf-8 content-length 1957 x-timer S1613741233.823744,VS0,VE0 x-served-by cache-fra19143-FRA
GET H2	200	qevents.js Show response a.quora.com/	39 KB 14 KB	73ms 24ms	Script text/plain	151.101.13.2 FASTLY
General Check archive.org Show headers Download Go to Full URL https://a.quora.com/qevents.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.13.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id s3LlaOWABX1LUjiLldBNr49lVAylKDRo content-encoding gzip etag "f32ebb1e93a72c0a57add6d07f688510" age 3166 x-cache HIT, HIT content-length 13681 x-amz-id-2 94JeRsAql5wKjFeS3J2P/dtefGDSGaKfBTRuQAAOXFh33iSqLHa8S/jky3eOQQ/UkWcjJoudYQ8= x-served-by cache-bwi5149-BWI, cache-fra19124-FRA last-modified Fri, 25 Oct 2019 19:28:38 GMT server AmazonS3 x-amz-meta-s3cmd-attrs atime:1572031715/ctime:1572031714/gid:1000000/gname:employee/md5:f32ebb1e93a72c0a57add6d07f688510/mode:33188/mtime:1149709104/uid:1000332/uname:tzhou x-timer S1613741233.822514,VS0,VE0 date Fri, 19 Feb 2021 13:27:12 GMT vary Accept-Encoding x-amz-request-id E9991AFD9A0915EF via 1.1 varnish, 1.1 varnish cache-control max-age=7200 accept-ranges bytes content-type text/plain x-cache-hits 1, 688
GET H/1.1	200 OK	events.js Show response tags.srv.stackadapt.com/	13 KB 5 KB	421ms 104ms	Script text/javascript	52.202.228.151
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/events.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.202.228.151 , United States, ASN (), Reverse DNS ec2-52-202-228-151.compute-1.amazonaws.com Software / Resource Hash 5f61bc16a39df81e92414bc2e20e19b704a39953950d74f611991e725c33ce88 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 19 Feb 2021 13:27:13 GMT Content-Encoding gzip Cache-Control max-age=30 Content-Length 4295 Connection keep-alive Content-Type text/javascript
GET H/1.1	200 OK	lp.js Show response metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/	5 KB 6 KB	102ms 24ms	Script application/x-javascript	205.185.216.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/lp.js Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 205.185.216.42 , United States, ASN20446 (HIGHWINDS3, US), Reverse DNS map2.hwcdn.net Software / Resource Hash 20b11d2c0012e286c38350d6c9b2ba03341667d9bc7226bf526fb47e89668fd9 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 19 Feb 2021 13:27:12 GMT Connection Keep-Alive Last-Modified Fri, 18 Dec 2020 19:31:32 GMT x-amz-request-id tx00000000000002a2fe9aa-00602a70c4-5ef4480-sfo2a ETag "23752d527a82df9be63eb97fe04bceb3" Vary Access-Control-Request-Headers,Access-Control-Request-Method,Origin X-HW 1613741232.dop022.lo4.t,1613741232.cds034.lo4.shn,1613741232.dop022.lo4.t,1613741232.cds097.lo4.c Content-Type application/x-javascript Cache-Control max-age=257684 x-rgw-object-type Normal Strict-Transport-Security max-age=15552000; includeSubDomains; preload Accept-Ranges bytes Content-Length 5105
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=338349653&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=2... https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=714291543.1613741233&jid=2059283762&_v=5.7.2dc&z=338349653 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=714291543.1613741233&jid=2059283762&_v=5.7.2dc&z=338349653&slf_rd=1&random=1732237359	42 B 107 B	18ms 18ms	Image image/gif	2a00:1450:4001:808::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=714291543.1613741233&jid=2059283762&_v=5.7.2dc&z=338349653&slf_rd=1&random=1732237359 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Fri, 19 Feb 2021 13:27:12 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Fri, 19 Feb 2021 13:27:12 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type text/html; charset=UTF-8 location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=714291543.1613741233&jid=2059283762&_v=5.7.2dc&z=338349653&slf_rd=1&random=1732237359 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	__utm.gif stats.g.doubleclick.net/r/	35 B 412 B	30ms 15ms	Image image/gif	2a00:1450:400c:c07::9d GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=1537642163&utmhn=news.sophos.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=A%20Conti%20ransomware%20attack%20day-by-day%20%E2%80%93%20Sophos%20News&utmhid=1146585759&utmr=-&utmp=%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&utmht=1613741232786&utmac=UA-737537-53&utmcc=__utma%3D204943247.181624798.1613741233.1613741233.1613741233.1%3B%2B__utmz%3D204943247.1613741233.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=36632619&utmredir=3&utmmt=1&utmu=q1CgAAAAAAAAAAAAAAAAAAgE~ Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:400c:c07::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Fri, 19 Feb 2021 13:27:12 GMT content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1613741232794&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1613741232794%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1613741232794&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&liSync=true	0 57 B	190ms 190ms	Image application/javascript	2620:119:50e1:101::6cae:b25 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1613741232794&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&liSync=true Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:119:50e1:101::6cae:b25 , United States, ASN14413 (LINKEDIN, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:13 GMT server Play linkedin-action 1 x-li-fabric prod-lor1 x-li-proto http/2 x-li-pop prod-esv5 content-type application/javascript content-length 0 x-li-uuid 8pEbHRopZRZAB89P1SoAAA== Redirect headers strict-transport-security max-age=31536000 x-content-type-options nosniff linkedin-action 1 content-length 0 x-li-uuid p+XOERopZRZgM1Sb7yoAAA== pragma no-cache x-li-pop afd-prod-lor1 x-msedge-ref Ref A: C45A2B3919EA4486B71CC70DF06EC9E0 Ref B: FRAEDGE0916 Ref C: 2021-02-19T13:27:13Z date Fri, 19 Feb 2021 13:27:12 GMT expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" x-frame-options sameorigin x-li-fabric prod-lor1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1613741232794&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&liSync=true cache-control no-cache, no-store content-security-policy default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	334990480506518 Show response connect.facebook.net/signals/config/	241 KB 69 KB	7ms 6ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/334990480506518?v=2.9.33&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash f9b3c3cf0d586f12051411da0bc10e6c4c0a747db04588c9adcab62ca0b4325c Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; content-encoding gzip x-content-type-options nosniff x-xss-protection 0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 70639 x-fb-rlafr 0 pragma public x-fb-debug SiXp77da6ANgG79mP8sbyIuudwMsROT/9PtH/L3Zzszy1Y45z5fLEeWVKZTrQZ2wrQUsybyDpDI5R3GuC4DH4A== x-fb-trip-id 686109401 x-frame-options DENY date Fri, 19 Feb 2021 13:27:12 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-content-id 1346959260 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	204	0 bat.bing.com/action/	0 147 B	28ms 28ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=4015302&Ver=2&mid=73fbe442-33fe-4595-83ed-c0eb864057bf&sid=2cea4de072b611ebbbac91f6a6f46a9b&vid=2cea544072b611eb9637613ccdc5011d&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=A%20Conti%20ransomware%20attack%20day-by-day%20%E2%80%93%20Sophos%20News&p=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&r=&lt=282&evt=pageLoad&msclkid=N&sv=1&rn=376941 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers access-control-allow-origin * pragma no-cache date Fri, 19 Feb 2021 13:27:12 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: 5FB25F19956241F8A9D4FB66812760A2 Ref B: FRAEDGE1521 Ref C: 2021-02-19T13:27:12Z expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	31 KB 13 KB	87ms 33ms	Script text/javascript	142.250.186.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-743773256 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.34 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f2.1e100.net Software cafe / Resource Hash 11e4390972243444bef13a861d73eed252a6d4c9cc43e98a7e4e19bceb46bee8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 12360 x-xss-protection 0 server cafe etag 195370021859676167 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Fri, 19 Feb 2021 13:27:12 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 260 B	6ms 5ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=334990480506518&ev=PageView&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&rl=&if=false&ts=1613741232852&sw=1600&sh=1200&v=2.9.33&r=stable&ec=0&o=30&fbp=fb.1.1613741232850.1514417009&it=1613741232802&coo=false&rqm=GET Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:12 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Fri, 19 Feb 2021 13:27:12 GMT
GET H/1.1	200 OK	pixel q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/	43 B 421 B	421ms 105ms	Image image/gif	3.225.115.141 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/pixel?j=1&u=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&tag=ViewContent&ts=1613741232862 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.225.115.141 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-225-115-141.compute-1.amazonaws.com Software nginx / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 19 Feb 2021 13:27:13 GMT Server nginx Connection keep-alive Content-Length 43 Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Q-Stat ,6202e96040c715d1f2cf46982b250697,10.0.0.96,29416,185.212.171.75,,67735083606,1,1613741233.228,0.002,,.,0,0,0.004,0.004,-,0,0,197,136,68,10,26847,,,,,,-, Content-Type image/gif
GET H2	200	adsct t.co/i/	43 B 448 B	190ms 135ms	Image image/gif	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_f / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:13 GMT content-encoding gzip x-content-type-options nosniff status 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 x-response-time 107 pragma no-cache last-modified Fri, 19 Feb 2021 13:27:12 GMT server tsa_f x-frame-options SAMEORIGIN strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash ff59a12ebff74af7671baa87b3ecac69 x-transaction 005ff80c00cc5218 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/	2 KB 1 KB	20ms 19ms	Script text/javascript	2a00:1450:4001:82b::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/?random=1613741232928&cv=9&fst=1613741232928&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&tiba=A%20Conti%20ransomware%20attack%20day-by-day%20%E2%80%93%20Sophos%20News&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 416bb0f3e57c22c80e22141096797e899d844a6b5bc09ff14ae432add368dcc0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Fri, 19 Feb 2021 13:27:12 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 1081 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ www.google.com/pagead/1p-user-list/743773256/	42 B 530 B	49ms 34ms	Image image/gif	2a00:1450:4001:80f::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/743773256/?random=1613741232928&cv=9&fst=1613739600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&tiba=A%20Conti%20ransomware%20attack%20day-by-day%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=3404152301&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Fri, 19 Feb 2021 13:27:12 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	/ www.google.de/pagead/1p-user-list/743773256/	42 B 530 B	57ms 40ms	Image image/gif	2a00:1450:4001:808::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/743773256/?random=1613741232928&cv=9&fst=1613739600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2a1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&tiba=A%20Conti%20ransomware%20attack%20day-by-day%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=3404152301&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Fri, 19 Feb 2021 13:27:13 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	sa.css tags.srv.stackadapt.com/	83 B 310 B	104ms 103ms	Stylesheet text/css	52.202.228.151
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/sa.css Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.202.228.151 , United States, ASN (), Reverse DNS ec2-52-202-228-151.compute-1.amazonaws.com Software / Resource Hash 4420438d8e7f7dad5a8417c13efe5c4d3c3acf25c6c0caae972d2c64508df79f Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 19 Feb 2021 13:27:13 GMT Cache-Control only-if-cached, no-transform, private, max-age=7776000 Connection keep-alive Content-Length 83 Content-Type text/css
GET H/1.1	200 OK	sa.jpeg Show response tags.srv.stackadapt.com/	0 881 B	403ms 101ms	Fetch image/jpeg	52.202.228.151
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/sa.jpeg Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.202.228.151 , United States, ASN (), Reverse DNS ec2-52-202-228-151.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 19 Feb 2021 13:27:13 GMT Cache-Control only-if-cached, no-transform, private, max-age=7776000 Connection keep-alive Content-Length 651 Content-Type image/jpeg
GET H2	200	ip.json Show response api.company-target.com/api/v2/	438 B 939 B	123ms 57ms	XHR application/json	99.86.116.72 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&page_title=A%20Conti%20ransomware%20attack%20day-by-day%20%E2%80%93%20Sophos%20News&src=tag&key=f2514e2223f271de300b1908c2c90c911bed78d7 Requested by Host: scripts.demandbase.com URL: https://scripts.demandbase.com/WuEFNglz.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 99.86.116.72 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 73af05a4ed76ae72e7e11c8da4b8d7c677caecc0a370f0d750582a8008411eb3 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:13 GMT identification-source CENTRAL vary Accept-Encoding, Origin x-amz-cf-pop LHR61-C1 x-cache Miss from cloudfront request-id c9521956-ab07-4dd4-ac10-b02a00a61b63 content-encoding gzip pragma no-cache access-control-allow-origin https://news.sophos.com server nginx access-control-max-age 7200 access-control-allow-methods GET, POST, OPTIONS content-type application/json;charset=utf-8 via 1.1 46d5c1a4d1e3a5c8a14bdb9b6676ba11.cloudfront.net (CloudFront) access-control-expose-headers cache-control no-cache, no-store, max-age=0, must-revalidate access-control-allow-credentials true api-version v2 access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id RD89RMOVDVlfzDg8Cp91B35rQagCBR0JLNREl41_0nRSJw6ZmtM2qw== expires Thu, 18 Feb 2021 13:27:13 GMT
GET H/1.1	200 OK	validateCookie segments.company-target.com/ Redirect Chain https://match.prod.bidr.io/cookie-sync/demandbase https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 https://segments.company-target.com/log?vendor=choca&user_id=AAHYFk7AX3kAABBcu_Aa7Q https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAHYFk7AX3kAABBcu_Aa7Q&verifyHash=64b59741a20fa94a47e7bb162e178205ea3088e3	26 B 409 B	174ms 173ms	Image image/gif	13.224.226.72 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAHYFk7AX3kAABBcu_Aa7Q&verifyHash=64b59741a20fa94a47e7bb162e178205ea3088e3 Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.224.226.72 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-226-72.lhr61.r.cloudfront.net Software / Resource Hash 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 19 Feb 2021 13:27:13 GMT Via 1.1 3746550ac2cf89851f01a575c7b680a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop LHR61-C2 Vary Origin X-Cache Miss from cloudfront Content-Type image/gif Transfer-Encoding chunked Connection keep-alive trace-id 2a73c17383d8199c X-Amz-Cf-Id KqaLzP0zSRJn_TRYgfYpjqP9agwvkZTJQokvLRdRkJWnDP4TaxUWLg== Redirect headers Date Fri, 19 Feb 2021 13:27:13 GMT Via 1.1 3746550ac2cf89851f01a575c7b680a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop LHR61-C2 Vary Origin X-Cache Miss from cloudfront Location /validateCookie?vendor=choca&user_id=AAHYFk7AX3kAABBcu_Aa7Q&verifyHash=64b59741a20fa94a47e7bb162e178205ea3088e3 Connection keep-alive trace-id 17b7b0c94cb2b2e8 Content-Length 0 X-Amz-Cf-Id bs-ZYvxuHqrIyAAxtTmclCHK4rSo4_MLn_TpkM0EHcEaI66yNKW12g==
GET H2	451	464526.gif id.rlcdn.com/	0 66 B	60ms 25ms	Image text/plain	34.120.207.148 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://id.rlcdn.com/464526.gif Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.120.207.148 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 148.207.120.34.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:13 GMT via 1.1 google alt-svc clear content-length 0
GET H2	200	/ www.facebook.com/tr/	44 B 147 B	6ms 6ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=334990480506518&ev=Microdata&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&rl=&if=false&ts=1613741233355&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22A%20Conti%20ransomware%20attack%20day-by-day%20%E2%80%93%20Sophos%20News%22%7D&cd[OpenGraph]=%7B%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22A%20Conti%20ransomware%20attack%20day-by-day%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F%22%2C%22og%3Adescription%22%3A%22Editor%E2%80%99s%20note%3A%20This%20is%20one%20of%20a%20series%20of%20articles%20focused%20on%20the%20Conti%20ransomware%20family%2C%20which%20include%20technical%20details%20of%20the%20Conti%20ransomware%2C%C2%A0Conti%20ransomware%3A%20Evasive%20by%20nature%2C%C2%A0and%20a%20%E2%80%A6%22%2C%22article%3Apublished_time%22%3A%222021-02-16T13%3A30%3A30%2B00%3A00%22%2C%22article%3Amodified_time%22%3A%222021-02-16T15%3A11%3A35%2B00%3A00%22%2C%22og%3Asite_name%22%3A%22Sophos%20News%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fwp-content%2Fuploads%2F2021%2F02%2Fsophos-conti-ransomware-web-banner-1200x628px-option-2-1.png%3Fw%3D640%22%2C%22og%3Aimage%3Asecure_url%22%3A%22https%3A%2F%2Fnews.sophos.com%2Fwp-content%2Fuploads%2F2021%2F02%2Fsophos-conti-ransomware-web-banner-1200x628px-option-2-1.png%3Fw%3D640%22%2C%22og%3Aimage%3Awidth%22%3A%22640%22%2C%22og%3Aimage%3Aheight%22%3A%22335%22%2C%22og%3Alocale%22%3A%22en_US%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.33&r=stable&ec=1&o=30&fbp=fb.1.1613741232850.1514417009&it=1613741232802&coo=false&es=automatic&tm=3&rqm=GET Requested by Host: news.sophos.com URL: https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:13 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Fri, 19 Feb 2021 13:27:13 GMT
GET H/1.1	200 OK	saq_pxl Show response tags.srv.stackadapt.com/	94 B 397 B	104ms 104ms	XHR text/plain	52.202.228.151
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/saq_pxl?uid=uxMvfKEouJZfJzsjwRVn_Q&is_js=true&landing_url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&host=https://news.sophos.com&sa_conv_data_css_value=%20%220-fd5fb558-c80c-457d-4f19-7788fcaded74%24ip%24185.212.171.75%22&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd90be8b05ae4b6486267f10084deaabaf9b9d4ab4b Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.202.228.151 , United States, ASN (), Reverse DNS ec2-52-202-228-151.compute-1.amazonaws.com Software / Resource Hash 078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Fri, 19 Feb 2021 13:27:13 GMT Access-Control-Allow-Methods GET Content-Type text/plain; charset=utf-8 Access-Control-Allow-Origin https://news.sophos.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 94
GET H/1.1	204 No Content	js_tracking Show response tags.srv.stackadapt.com/	0 250 B	207ms 103ms	XHR text/plain	52.202.228.151
General Check archive.org Show headers Download Go to Full URL https://tags.srv.stackadapt.com/js_tracking?url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F&uid=uxMvfKEouJZfJzsjwRVn_Q&host=https://news.sophos.com Requested by Host: tags.srv.stackadapt.com URL: https://tags.srv.stackadapt.com/events.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.202.228.151 , United States, ASN (), Reverse DNS ec2-52-202-228-151.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin https://news.sophos.com Date Fri, 19 Feb 2021 13:27:13 GMT Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Access-Control-Allow-Methods GET
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 652 B	196ms 140ms	Script application/javascript	104.244.42.195 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=o4apa&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2021%2F02%2F16%2Fconti-ransomware-attack-day-by-day%2F Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.195 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_f / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://news.sophos.com/en-us/2021/02/16/conti-ransomware-attack-day-by-day/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 19 Feb 2021 13:27:13 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 OK x-twitter-response-tags BouncerCompliant content-length 57 x-xss-protection 0 x-response-time 112 pragma no-cache last-modified Fri, 19 Feb 2021 13:27:13 GMT server tsa_f x-frame-options SAMEORIGIN strict-transport-security max-age=631138519 content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 1b29da31487734dc5e5642312b8cce63 x-transaction 0088c81a003f8e92 expires Tue, 31 Mar 1981 05:00:00 GMT