news.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42e3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://blogs.sophos.com/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Effective URL:
https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Submission: On October 10 via api (October 10th 2022, 3:33:53 pm UTC) from DE — Scanned from DE

Summary HTTP 70 Redirects Links 19 Behaviour Indicators

Summary

This website contacted 35 IPs in 6 countries across 29 domains to perform 70 HTTP transactions. The main IP is 2a04:fa87:fffd::c000:42e3, located in Ireland and belongs to AUTOMATTIC, US. The main domain is news.sophos.com.
TLS certificate: Issued by R3 on September 28th 2022. Valid for: 3 months.

This is the only time news.sophos.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 19	2a04:fa87:fff... 2a04:fa87:fffd::c000:42e3	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a00:1450:400... 2a00:1450:4001:82b::2008	15169 (GOOGLE) (GOOGLE)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2606:4700::68... 2606:4700::6810:5614	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1 3	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
1	96.16.149.96 96.16.149.96	16625 (AKAMAI-AS) (AKAMAI-AS)
1 4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:149b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	13.32.27.124 13.32.27.124	16509 (AMAZON-02) (AMAZON-02)
1	199.232.136.157 199.232.136.157	54113 (FASTLY) (FASTLY)
1	162.159.153.247 162.159.153.247	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	44.206.39.165 44.206.39.165	14618 (AMAZON-AES) (AMAZON-AES)
1	65.9.65.116 65.9.65.116	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1288:80:... 2a00:1288:80:807::1	203220 (YAHOO-DEB) (YAHOO-DEB)
1	23.35.237.86 23.35.237.86	16625 (AKAMAI-AS) (AKAMAI-AS)
1 3	2a00:1450:400... 2a00:1450:4001:830::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
2 2	54.217.231.82 54.217.231.82	16509 (AMAZON-02) (AMAZON-02)
1 2	52.222.214.8 52.222.214.8	16509 (AMAZON-02) (AMAZON-02)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	18.66.97.46 18.66.97.46	16509 (AMAZON-02) (AMAZON-02)
1	18.205.225.81 18.205.225.81	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	70.42.32.31 70.42.32.31	13789 (INTERNAP-...) (INTERNAP-BLK3)
1	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
2	2620:1ec:40::45 2620:1ec:40::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
2	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
2	52.224.31.34 52.224.31.34	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	20.234.93.27 20.234.93.27	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
70	35

19 2a04:fa87:fffd::c000:42e3 (Ireland) 2 redirects

ASN2635 (AUTOMATTIC, US)

blogs.sophos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
news.sophos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5614 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400c:c00::9b (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 96.16.149.96 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a96-16-149-96.deploy.static.akamaitechnologies.com

img03.en25.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:149b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.124 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-124.fra56.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.136.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.159.153.247 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)

a.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 44.206.39.165 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-206-39-165.compute-1.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.65.116 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-65-116.fra56.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:80:807::1 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.35.237.86 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-237-86.deploy.static.akamaitechnologies.com

amplify.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.217.231.82 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-217-231-82.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.222.214.8 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-8.fra56.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.46 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-46.fra56.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.205.225.81 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-205-225-81.compute-1.amazonaws.com

q.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 70.42.32.31 (United States)

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com

tr.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:40::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.224.31.34 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

h.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.234.93.27 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	sophos.com 2 redirects blogs.sophos.com news.sophos.com	563 KB
6	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 804 h.clarity.ms — Cisco Umbrella Rank: 6675 c.clarity.ms — Cisco Umbrella Rank: 1219	26 KB
5	doubleclick.net 1 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 171 googleads.g.doubleclick.net — Cisco Umbrella Rank: 68	20 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 850 www.linkedin.com — Cisco Umbrella Rank: 840 px4.ads.linkedin.com — Cisco Umbrella Rank: 6680	4 KB
4	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 4818	7 KB
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 665 c.bing.com — Cisco Umbrella Rank: 426	13 KB
3	company-target.com 1 redirects segments.company-target.com — Cisco Umbrella Rank: 2556 api.company-target.com — Cisco Umbrella Rank: 8247	3 KB
3	google.de www.google.de — Cisco Umbrella Rank: 3460	675 B
3	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 19	807 B
3	outbrain.com amplify.outbrain.com — Cisco Umbrella Rank: 3330 tr.outbrain.com — Cisco Umbrella Rank: 2938	4 KB
2	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1787	879 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 115	222 B
2	bidr.io 2 redirects match.prod.bidr.io — Cisco Umbrella Rank: 833	1 KB
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 650	7 KB
2	adsrvr.org js.adsrvr.org — Cisco Umbrella Rank: 2307 insight.adsrvr.org — Cisco Umbrella Rank: 922	3 KB
2	quora.com a.quora.com — Cisco Umbrella Rank: 9340 q.quora.com — Cisco Umbrella Rank: 4287	15 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 203	111 KB
2	wp.com stats.wp.com — Cisco Umbrella Rank: 3434 pixel.wp.com — Cisco Umbrella Rank: 2931	3 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 129	116 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 154	15 KB
1	rlcdn.com id.rlcdn.com — Cisco Umbrella Rank: 900	98 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 859	394 B
1	t.co t.co — Cisco Umbrella Rank: 550	377 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 967	15 KB
1	demandbase.com scripts.demandbase.com — Cisco Umbrella Rank: 15516	19 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1571	3 KB
1	en25.com img03.en25.com — Cisco Umbrella Rank: 33728	3 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 492	9 KB
1	gravatar.com secure.gravatar.com — Cisco Umbrella Rank: 2593	5 KB
70	29

	Domain	Requested by
18	news.sophos.com	1 redirects news.sophos.com
4	tags.srv.stackadapt.com	news.sophos.com tags.srv.stackadapt.com
3	www.google.de	news.sophos.com
3	www.google.com	1 redirects news.sophos.com
3	bat.bing.com	news.sophos.com bat.bing.com
3	stats.g.doubleclick.net	1 redirects news.sophos.com
2	c.clarity.ms	1 redirects
2	h.clarity.ms	www.clarity.ms
2	sp.analytics.yahoo.com	news.sophos.com
2	googleads.g.doubleclick.net	www.googleadservices.com
2	px.ads.linkedin.com	2 redirects
2	www.clarity.ms	bat.bing.com www.clarity.ms
2	tr.outbrain.com	amplify.outbrain.com news.sophos.com
2	www.facebook.com	news.sophos.com
2	segments.company-target.com	1 redirects news.sophos.com
2	match.prod.bidr.io	2 redirects
2	s.yimg.com	news.sophos.com s.yimg.com
2	connect.facebook.net	news.sophos.com connect.facebook.net
2	www.googletagmanager.com	news.sophos.com www.googletagmanager.com
1	insight.adsrvr.org	js.adsrvr.org
1	c.bing.com	1 redirects
1	px4.ads.linkedin.com	news.sophos.com
1	www.linkedin.com	1 redirects
1	www.googleadservices.com	www.googletagmanager.com
1	q.quora.com	news.sophos.com
1	api.company-target.com	scripts.demandbase.com
1	id.rlcdn.com	news.sophos.com
1	analytics.twitter.com	news.sophos.com
1	t.co	news.sophos.com
1	amplify.outbrain.com	news.sophos.com
1	js.adsrvr.org	www.googletagmanager.com
1	a.quora.com	news.sophos.com
1	static.ads-twitter.com	news.sophos.com
1	scripts.demandbase.com	news.sophos.com
1	snap.licdn.com	news.sophos.com
1	pixel.wp.com	news.sophos.com
1	img03.en25.com	news.sophos.com
1	stats.wp.com	news.sophos.com
1	cdn.jsdelivr.net	news.sophos.com
1	secure.gravatar.com	news.sophos.com
1	blogs.sophos.com	1 redirects
70	41

This site contains links to these domains. Also see Links.

Domain
nakedsecurity.sophos.com
www.sophos.com
blogs.sophos.com
digital-forensics.sans.org
www.welivesecurity.com
www.facebook.com
twitter.com
www.linkedin.com
secure.ethicspoint.eu

Subject Issuer	Validity	Valid
news.sophos.com R3	`2022-09-28` - `2022-12-27`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.gravatar.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-14` - `2022-11-16`	2 years	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-02` - `2023-06-01`	a year	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2022-06-11` - `2023-07-12`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.en25.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-17` - `2023-07-18`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2022-09-03` - `2023-03-03`	6 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-07-19` - `2022-10-17`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2022-08-17` - `2023-09-18`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-22` - `2023-08-22`	a year	crt.sh
quora.com R3	`2022-09-11` - `2022-12-10`	3 months	crt.sh
*.srv.stackadapt.com Amazon	`2022-10-09` - `2023-11-07`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
*.api.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-09-05` - `2022-10-26`	2 months	crt.sh
*.outbrain.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-03` - `2023-04-04`	a year	crt.sh
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2022-09-16` - `2023-10-18`	a year	crt.sh
*.quora.com R3	`2022-08-21` - `2022-11-19`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2022-02-27` - `2023-02-27`	a year	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-08-09` - `2023-02-01`	6 months	crt.sh
www.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
a.clarity.ms Microsoft Azure TLS Issuing CA 02	`2022-06-07` - `2023-06-02`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Frame ID: 1D8DF185ACC33E87654DB7A8F35B4CFF
Requests: 68 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: C014D9FD742DD8F6FA009487A1808CD5
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&upid=ql4fc2b&upv=1.1.0
Frame ID: 92411A476FB045E5E39C00405A1CA4C3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

The current state of ransomware: TorrentLocker – Sophos News

Page URL History Show full URLs

https://blogs.sophos.com/2015/12/23/the-current-state-of-ransomware-torrentlocker/ HTTP 301
https://news.sophos.com/2015/12/23/the-current-state-of-ransomware-torrentlocker/ HTTP 301
https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

Alpine.js (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

/alpine(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

70
Requests

94 %
HTTPS

41 %
IPv6

29
Domains

41
Subdomains

35
IPs

6
Countries

963 kB
Transfer

2156 kB
Size

44
Cookies

19 Outgoing links

These are links going to different origins than the main page.

URL: https://nakedsecurity.sophos.com/
Title: Security News

Search URL Search Domain Scan URL

URL: https://nakedsecurity.sophos.com/2013/10/18/cryptolocker-ransomware-see-how-it-works-learn-about-prevention-cleanup-and-recovery/
Title: CryptoLocker

Search URL Search Domain Scan URL

URL: https://nakedsecurity.sophos.com/2014/06/03/has-cryptolocker-been-cracked-is-gameover-over/
Title: law enforcement took out

Search URL Search Domain Scan URL

URL: https://nakedsecurity.sophos.com/2013/07/22/who-is-sophoslabs-james-wyke-senior-threat-researcher/
Title: James Wyke

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-current-state-of-ransomware.pdf?la=en
Title: The Current State of Ransomware

Search URL Search Domain Scan URL

URL: http://blogs.sophos.com/2015/12/17/the-current-state-of-ransomware-cryptowall/
Title: CryptoWall

Search URL Search Domain Scan URL

URL: http://digital-forensics.sans.org/blog/2014/09/09/torrentlocker-unlocked
Title: encrypted/unencrypted file pair

Search URL Search Domain Scan URL

URL: http://www.welivesecurity.com/wp-content/uploads/2014/12/torrent_locker.pdf
Title: AES was used in CTR mode

Search URL Search Domain Scan URL

URL: http://www.sophos.com/en-us/products/free-tools/virus-removal-tool.aspx
Title: Free Virus Removal Tool

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/products/next-gen-firewall.aspx
Title: Install a firewall

Search URL Search Domain Scan URL

URL: http://www.facebook.com/share.php?u=https://news.sophos.com/?p=30419&title=The%20current%20state%20of%20ransomware:%20TorrentLocker
Title: Share on Facebook

Search URL Search Domain Scan URL

URL: http://twitter.com/intent/tweet?text=The%20current%20state%20of%20ransomware%3A%20TorrentLocker%20https%3A%2F%2Fnews.sophos.com%2F%3Fp%3D30419
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?mini=true&url=https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Title: Share on LinkedIn

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/legal/sophos-website.aspx
Title: Terms

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/legal/sophos-group-privacy-policy.aspx
Title: Privacy Notice

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/legal/cookie-information.aspx
Title: Cookies

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/legal.aspx
Title: General

Search URL Search Domain Scan URL

URL: https://www.sophos.com/en-us/legal/modern-slavery-act-transparency-statement.aspx
Title: Modern Slavery Statement

Search URL Search Domain Scan URL

URL: https://secure.ethicspoint.eu/domain/media/en/gui/104916/index.html
Title: Speak Out

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://blogs.sophos.com/2015/12/23/the-current-state-of-ransomware-torrentlocker/ HTTP 301
https://news.sophos.com/2015/12/23/the-current-state-of-ransomware-torrentlocker/ HTTP 301
https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 35

https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=628335157&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=The%20current%20state%20of%20ransomware%3A%20TorrentLocker%20%E2%80%93%20Sophos%20News&utmhid=1263840636&utmr=-&utmp=%2Fcorpblog%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&utmht=1665416027654&utmac=UA-737537-1&utmcc=__utma%3D1.112817332.1665416028.1665416028.1665416028.1%3B%2B__utmz%3D1.1665416028.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1955546465&utmredir=3&utmu=q1CAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=112817332.1665416028&jid=1955546465&_v=5.7.2dc&z=628335157 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=112817332.1665416028&jid=1955546465&_v=5.7.2dc&z=628335157&slf_rd=1&random=3399804916

Request Chain 39

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
https://segments.company-target.com/log?vendor=choca&user_id=AABcmE7GiHcAAB8KPvKEBQ HTTP 303
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABcmE7GiHcAAB8KPvKEBQ&verifyHash=ff7c5af58a3adc82e2631721549a5ac6e040303c

Request Chain 51

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1665416027854&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1665416027854%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-us%252F2015%252F12%252F23%252Fthe-current-state-of-ransomware-torrentlocker%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1665416027854&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1665416027854&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&liSync=true&e_ipv6=AQJWaDFiHRW3LAAAAYPCh-EcxFel01MkhyBEG9vxwUJBpz_S84dNoo4SLO6vjR1CByPN6mTWYFt5VH70Voo_UtdXgQY

Request Chain 66

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?CtsSyncId=FAC8FBCF47AF47D08169CE8AD9F9BEBA&RedC=c.clarity.ms&MXFR=3A2C377F062F623905D42546022F6CB9 HTTP 302
https://c.clarity.ms/c.gif?CtsSyncId=FAC8FBCF47AF47D08169CE8AD9F9BEBA&MUID=14095FBA1E97643F15E64D831F4565A2

70 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Redirect Chain

https://blogs.sophos.com/2015/12/23/the-current-state-of-ransomware-torrentlocker/
https://news.sophos.com/2015/12/23/the-current-state-of-ransomware-torrentlocker/
https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

80 KB
22 KB

448ms
448ms

Document
text/html

2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx / WordPress VIP <https://wpvip.com>

Resource Hash

544c93eb16ddd32877954737a2078a11e85a8a21c3565fb7714225a60d0e2c0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
cache-control: max-age=300, must-revalidate
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Mon, 10 Oct 2022 15:33:47 GMT
host-header: a9130478a60e5f9135f765b23f26593b
link: <https://news.sophos.com/wp-json/>; rel="https://api.w.org/" <https://news.sophos.com/wp-json/wp/v2/posts/30419>; rel="alternate"; type="application/json" <https://news.sophos.com/?p=30419>; rel=shortlink
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-cache: miss
x-hacker: If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by: WordPress VIP <https://wpvip.com>
x-rq: ams8 0 2 9980

Redirect headers

age: 0
cache-control: max-age=300, must-revalidate
content-encoding: gzip
content-length: 20
content-type: text/html; charset=UTF-8
date: Mon, 10 Oct 2022 15:33:46 GMT
host-header: a9130478a60e5f9135f765b23f26593b
location: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
server: nginx
strict-transport-security: max-age=31536000
x-cache: miss
x-hacker: If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by: WordPress VIP <https://wpvip.com>
x-redirect-by: WordPress
x-rq: ams8 0 2 9980

GET
H2 200 /
news.sophos.com/_static/ 102 KB
14 KB 37ms
36ms Stylesheet
text/css 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/_static/??-eJyNj9EOwjAIRX/Ijpnokj0Yv6WjZKK0awqL6d87Z5Zsbz5e4AAH3tlxQpkDKaAqBFaDQSZ8OeGh+FJBrQo1kVOzDJxgTzwVIgX2JBQp2SFk8ZWKExo91v/wpbfPBwinZOuJ2WWZR04KSr7gA0i8GmMutP3/FSlL2Si4PKmp+xmtJrqtvcfbuesufdu21/4DN3xi/A==

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

5467511a1c80aeedcb76b7143274329dd6d861608a3cac5b8ac6a46166723c97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
x-rq: ams8 0 2 9980
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Tue, 04 Oct 2022 16:14:19 GMT
server: nginx
age: 514265
vary: Accept-Encoding
x-cache: hit
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 14715

GET
H2 200 /
news.sophos.com/_static/ 139 KB
25 KB 48ms
47ms Stylesheet
text/css 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/_static/??/wp-content/themes/sophosnews-2017/style-2021.css,/wp-content/mu-plugins/jetpack-11.4/css/jetpack.css?m=1665096552

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

0168c7db469360f21c61a653e00f7dccece3450e41418288739324d86814a928

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
x-rq: ams8 0 2 9980
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Thu, 06 Oct 2022 22:49:12 GMT
server: nginx
age: 317283
vary: Accept-Encoding
x-cache: hit
content-type: text/css;charset=utf-8
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 25676

GET
H2 200 / Show response
news.sophos.com/_static/ 98 KB
34 KB 23ms
23ms Script
application/javascript 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/_static/??-eJzTLy/QzcxLzilNSS3WzwKiwtLUokoopZebmaeXVayjj0+Rbm5melFiSSpUsX2uraGZmYmlgYGBqUUWAK90Ih8=

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

75839e3ea0cd949a33dc21dd8b0931f396829fea8e0e3148b576b1228f40e469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
x-rq: ams8 0 2 9980
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Tue, 04 Oct 2022 16:14:18 GMT
server: nginx
age: 514265
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 34312

GET
H2 200 ransomware-150.png
news.sophos.com/wp-content/uploads/2015/12/ 9 KB
9 KB 24ms
22ms Image
image/webp 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://news.sophos.com/wp-content/uploads/2015/12/ransomware-150.png

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

de35cf1643aec2d5e935a162565bac412cdd96ce8f980a46feadcd71ad10b4ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
strict-transport-security: max-age=31536000
x-rq: ams8 109 84 443
last-modified: Sat, 08 Oct 2022 05:15:10 GMT
server: nginx
etag: "f196c9197800f787"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 9256
expires: Sun, 08 Oct 2023 05:15:10 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 146 KB
55 KB 74ms
34ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5e7d0961e3fcec97f7e8d12198a4a28e5cfaa2d16abf0bc5e30a7d3c2284746e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55432
x-xss-protection: 0
pragma: no-cache
server: Google Tag Manager
vary: *
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 wp-emoji-release.min.js Show response
news.sophos.com/wp-includes/js/ 18 KB
5 KB 23ms
21ms Script
application/javascript 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/wp-includes/js/wp-emoji-release.min.js?ver=6.0.2

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
x-rq: ams8 0 2 9980
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Tue, 30 Aug 2022 19:06:15 GMT
server: nginx
age: 3502596
etag: W/"630e5fa7-48b9"
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 5004
expires: Tue, 10 Oct 2023 15:33:47 GMT

GET
H2 200 avatar-three.png
news.sophos.com/wp-content/themes/sophosnews-2017/img/avatars/ 2 KB
2 KB 24ms
22ms Image
image/png 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://news.sophos.com/wp-content/themes/sophosnews-2017/img/avatars/avatar-three.png

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

b85ed9ff65cb89798ff1ac4b0d9a9b2c2d14f27a949ac3c19bae5c228ecc8f38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
x-rq: ams8 0 2 9980
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Fri, 22 Jul 2022 01:49:00 GMT
server: nginx
age: 6386478
etag: W/"62da020c-7ba"
x-cache: hit
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1945
expires: Tue, 10 Oct 2023 15:33:47 GMT

GET
H2 200 025c4bb891cbc5a1bb24a4854f823e48
secure.gravatar.com/avatar/ 5 KB
5 KB 55ms
15ms Image
image/png 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/025c4bb891cbc5a1bb24a4854f823e48?s=60&d=blank&r=g
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 9c9e5ce4a745398c82c6afcbb22d8d8c9c42e42869a2831d0e66830943ca80a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Mon, 10 Oct 2022 15:33:47 GMT
last-modified: Thu, 14 Jul 2022 12:27:52 GMT
server: nginx
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="025c4bb891cbc5a1bb24a4854f823e48.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/025c4bb891cbc5a1bb24a4854f823e48?s=60&d=blank&r=g>; rel="canonical"
content-length: 5262
expires: Mon, 10 Oct 2022 15:38:47 GMT

GET
H2 200 / Show response
news.sophos.com/_static/ 135 KB
38 KB 22ms
21ms Script
application/javascript 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/_static/??-eJyVjFEOwiAQBS8krGBKv4xnIWTTQstC2NV6fDG9QEne12TmwVFVKCRIArJiRgYudS1MeLCydzND4r4ulS2i+lhttelAn0AnvsGlj1DagI1faZ6v+yfSb4n7eBV8rj4uNBxW34SwDXeLH07+rEev/DTOPWbj7DSlH6CkoEI=

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

a36c1b591e0a043aef36da97ac4da5a313386c35ad3c92eb558e13d0291f8eff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
x-rq: ams8 0 2 9980
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Tue, 20 Sep 2022 23:24:15 GMT
server: nginx
age: 402529
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 38988

GET
H2 200 alpine.min.js Show response
cdn.jsdelivr.net/gh/alpinejs/alpine@v2.8.1/dist/ 26 KB
9 KB 74ms
40ms Script
application/javascript 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/alpinejs/alpine@v2.8.1/dist/alpine.min.js?ver=2.0.1

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

de9485aee0805fc555984a4286697dccb8a9762fa9240c6a47b4dd478d282e74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 486903
x-jsd-version: 2.8.1
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19177-FRA, cache-itm18830-ITM
x-jsd-version-type: version
server: cloudflare
etag: W/"6964-M33llwtEtRbUwMPPG0SKpWL3vX8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nZN30lIFm0MgI5nWPQpdWxkbwzzB3NsKhSO53q%2BKAIfLQ9%2BnGqAjHguWoS36d0twt2cLsCutiC0fZ5954ZDhKr7bI9G9AFMOPcOZ%2BXDmnbgYuO11sFpxPZmar7z4uWsiSDtgMfNR8JK4Qya4nTM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 75806a9bcacb913d-FRA

GET
H2 200 comment-reply.min.js Show response
news.sophos.com/wp-includes/js/ 3 KB
1 KB 23ms
21ms Script
application/javascript 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/wp-includes/js/comment-reply.min.js?m=1664900059g

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
x-rq: ams8 0 2 9980
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Tue, 04 Oct 2022 16:14:19 GMT
server: nginx
age: 513841
etag: W/"633c5bdb-ba5"
vary: Accept-Encoding
x-cache: hit
content-type: application/javascript
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 1351
expires: Tue, 10 Oct 2023 15:33:47 GMT

GET
H2 200 e-202241.js Show response
stats.wp.com/ 9 KB
3 KB 71ms
21ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202241.js
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-nc: HIT ams
date: Mon, 10 Oct 2022 15:33:47 GMT
content-encoding: br
server: nginx
etag: W/"6197c5cf-3508"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Sun, 01 Oct 2023 22:04:11 GMT

GET
H2 200 SophosSans-Light.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ 25 KB
25 KB 21ms
21ms Font
font/woff2 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Light.woff2

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/_static/??/wp-content/themes/sophosnews-2017/style-2021.css,/wp-content/mu-plugins/jetpack-11.4/css/jetpack.css?m=1665096552

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://news.sophos.com/_static/??/wp-content/themes/sophosnews-2017/style-2021.css,/wp-content/mu-plugins/jetpack-11.4/css/jetpack.css?m=1665096552
Origin: https://news.sophos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
age: 397
x-cache: grace
content-length: 25344
x-rq: ams8 0 2 9980
last-modified: Tue, 20 Sep 2022 23:24:15 GMT
server: nginx
etag: W/"632a4b9f-62e4"
vary: X-Mobile-Class
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Oct 2023 15:33:47 GMT

GET
H2 200 SophosSans-Medium.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ 26 KB
26 KB 27ms
27ms Font
font/woff2 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Medium.woff2

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/_static/??/wp-content/themes/sophosnews-2017/style-2021.css,/wp-content/mu-plugins/jetpack-11.4/css/jetpack.css?m=1665096552

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://news.sophos.com/_static/??/wp-content/themes/sophosnews-2017/style-2021.css,/wp-content/mu-plugins/jetpack-11.4/css/jetpack.css?m=1665096552
Origin: https://news.sophos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
age: 397
x-cache: grace
content-length: 26560
x-rq: ams8 0 2 9980
last-modified: Tue, 20 Sep 2022 23:24:15 GMT
server: nginx
etag: W/"632a4b9f-67a4"
vary: X-Mobile-Class
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Oct 2023 15:33:47 GMT

GET
H2 200 SophosSans-Semibold.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ 26 KB
26 KB 23ms
23ms Font
font/woff2 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://news.sophos.com/wp-content/themes/sophosnews-2017/fonts/SophosSans-Semibold.woff2

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/_static/??/wp-content/themes/sophosnews-2017/style-2021.css,/wp-content/mu-plugins/jetpack-11.4/css/jetpack.css?m=1665096552

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

f927844e8c953560f5a67112c5dfaab926df93df57f3d8cd062028f1ca80b530

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://news.sophos.com/_static/??/wp-content/themes/sophosnews-2017/style-2021.css,/wp-content/mu-plugins/jetpack-11.4/css/jetpack.css?m=1665096552
Origin: https://news.sophos.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
age: 397
x-cache: grace
content-length: 26692
x-rq: ams8 0 2 9980
last-modified: Tue, 20 Sep 2022 23:24:15 GMT
server: nginx
etag: W/"632a4b9f-6828"
vary: X-Mobile-Class
access-control-allow-methods: GET, HEAD
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Oct 2023 15:33:47 GMT

GET
H2 200 figure-1-torrentlocker-office-of-state-revenue-spam.png
news.sophos.com/wp-content/uploads/2015/12/ 35 KB
35 KB 110ms
110ms Image
image/webp 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://news.sophos.com/wp-content/uploads/2015/12/figure-1-torrentlocker-office-of-state-revenue-spam.png

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

092d3e0daf1e4670efcbd6afa13196ec9525d9a045bea4dbeca8c4d7859a247e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
strict-transport-security: max-age=31536000
x-rq: ams8 109 142 443
last-modified: Mon, 10 Oct 2022 15:33:47 GMT
server: nginx
etag: "ed27f1516b3e2434"
vary: Accept
x-cache: MISS
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 35420
expires: Tue, 10 Oct 2023 15:33:47 GMT

GET
H2 200 figure-2-torrentlocker-royal-mail-spam.png
news.sophos.com/wp-content/uploads/2015/12/ 4 KB
4 KB 125ms
124ms Image
image/webp 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://news.sophos.com/wp-content/uploads/2015/12/figure-2-torrentlocker-royal-mail-spam.png

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

b1dabfd8c891f8dc85b58fa6ae8a535222693d59dc76b5fe160752510f01601f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
strict-transport-security: max-age=31536000
x-rq: ams8 109 198 443
last-modified: Mon, 10 Oct 2022 15:33:47 GMT
server: nginx
etag: "b7c930ea825e1bc7"
vary: Accept
x-cache: MISS
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 4224
expires: Tue, 10 Oct 2023 15:33:47 GMT

GET
H2 200 sophos-ransomware-web-banner-1200x628px-option-2.png
news.sophos.com/wp-content/uploads/2021/05/ 166 KB
166 KB 23ms
22ms Image
image/webp 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://news.sophos.com/wp-content/uploads/2021/05/sophos-ransomware-web-banner-1200x628px-option-2.png?w=640

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

d93cea00230540bc488dbe3afab54b37f88bd1b65aeb9bb576edaa7b8d0b4035

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
strict-transport-security: max-age=31536000
x-rq: ams8 109 139 443
last-modified: Tue, 24 May 2022 14:41:50 GMT
server: nginx
etag: "2275ec51bd886a14"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 170202
expires: Wed, 24 May 2023 14:41:50 GMT

GET
H2 200 sophos-edr-news-blog-image-838x440px@2x.png
news.sophos.com/wp-content/uploads/2021/05/ 21 KB
21 KB 23ms
22ms Image
image/webp 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://news.sophos.com/wp-content/uploads/2021/05/sophos-edr-news-blog-image-838x440px@2x.png?w=640

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

1fa648f58cc0b3ce7d4574578aeb59038d1b5ddc00de3f568655be62a1d5c0ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
strict-transport-security: max-age=31536000
x-rq: ams8 109 30 443
last-modified: Thu, 19 May 2022 14:57:09 GMT
server: nginx
etag: "54d7f4d83afaeaef"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 21526
expires: Fri, 19 May 2023 14:57:09 GMT

GET
H2 200 sophos-xdr.png
news.sophos.com/wp-content/uploads/2021/05/ 107 KB
107 KB 42ms
42ms Image
image/webp 2a04:fa87:fffd::c000:42e3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://news.sophos.com/wp-content/uploads/2021/05/sophos-xdr.png?w=640

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffd::c000:42e3 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

56c4c9c31e9c4febdaaed356a15c9566084977d2a7a86842b14e9af3a71f9baa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
strict-transport-security: max-age=31536000
x-rq: ams8 109 140 443
last-modified: Tue, 10 May 2022 07:46:54 GMT
server: nginx
etag: "766f1aaa61418d0c"
vary: Accept
x-cache: HIT
content-type: image/webp
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 109794
expires: Wed, 10 May 2023 07:46:54 GMT

GET
H2 200 dc.js Show response
stats.g.doubleclick.net/ 45 KB
17 KB 116ms
34ms Script
text/javascript 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/_static/??-eJyVjFEOwiAQBS8krGBKv4xnIWTTQstC2NV6fDG9QEne12TmwVFVKCRIArJiRgYudS1MeLCydzND4r4ulS2i+lhttelAn0AnvsGlj1DagI1faZ6v+yfSb4n7eBV8rj4uNBxW34SwDXeLH07+rEev/DTOPWbj7DSlH6CkoEI=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 10 Oct 2022 15:31:02 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 165
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17093
expires: Mon, 10 Oct 2022 17:31:02 GMT

GET
H/1.1 200
OK elqCfg.min.js Show response
img03.en25.com/i/ 6 KB
3 KB 191ms
62ms Script
application/x-javascript 96.16.149.96
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://img03.en25.com/i/elqCfg.min.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

96.16.149.96 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-149-96.deploy.static.akamaitechnologies.com

Software

Resource Hash

3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Mon, 10 Oct 2022 15:33:47 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Connection: keep-alive
Content-Length: 2183
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Last-Modified: Tue, 12 Jul 2022 22:09:35 GMT
ETag: "a2d639123c96d81:0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: no-store
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow
Expires: Mon, 10 Oct 2022 15:33:47 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
93 B 28ms
22ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A11.4&blog=166161023&post=30419&tz=-4&srv=news.sophos.com&hp=vip&host=news.sophos.com&ref=&fcp=1234&rand=0.3214090740164588
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 10 Oct 2022 15:33:47 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 167 KB
61 KB 187ms
186ms Script
application/javascript 2a00:1450:4001:82b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-743773256

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1185f89f1ba6e4d1b3213cc96da7b42ec6a136d293c6eace2954fbc6360f6e40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62616
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 10 Oct 2022 15:33:47 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 38 KB
12 KB 91ms
48ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

30153b15b4cb898c421e657f6de21dc27435cb990e7888367bdee12e06398da7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Mon, 10 Oct 2022 15:33:46 GMT
last-modified: Thu, 28 Jul 2022 17:32:37 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F5479D4AF64E4EBDB57B1A63581F43B2 Ref B: FRAEDGE1308 Ref C: 2022-10-10T15:33:47Z
etag: "80a8697a8a2d81:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 11367

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 101 KB
27 KB 52ms
17ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

00a92494627ed8f758972b7dc47b3af186497c0637ea867a33fdb604c1548674

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 10 Oct 2022 15:33:47 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26840
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: 1U+W+8qRawEq0qKL39PbQD/S7vIvu47ACm8UgdI1tR/ueRhDTUHcdOpaqBrRIq33+T+JRtfUuf6pmjLs/mWhdw==
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 278ms
142ms Script
application/x-javascript 2a02:26f0:3500:16::215:149b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
content-encoding: gzip
last-modified: Fri, 12 Aug 2022 20:23:36 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=65457
accept-ranges: bytes
content-length: 3063

GET
H2 200 WuEFNglz.min.js Show response
scripts.demandbase.com/ 70 KB
19 KB 60ms
18ms Script
application/javascript 13.32.27.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://scripts.demandbase.com/WuEFNglz.min.js

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.124 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-124.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

a14d480f7330e0f27db7e8765697f4ddf746bfde815b1eb57e31a0fad9d7a647

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-amz-version-id: W2AS1N2.R_OBvM.iBlGYZjzxse.wYTzi
content-encoding: gzip
via: 1.1 8fd360cd20d33fa1400394ae41746f66.cloudfront.net (CloudFront)
date: Mon, 10 Oct 2022 15:30:31 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-amz-cf-pop: FRA56-C2
age: 203
x-cache: Hit from cloudfront
last-modified: Mon, 26 Sep 2022 14:04:02 GMT
server: AmazonS3
etag: W/"f34624186b27244426acd90af2df0746"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-id: bvIANZrHCmZEy0QbpShRGKBUZZud6HD-35UszZAqQAbgUl7ry1iF3w==

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 64ms
16ms Script
application/javascript 199.232.136.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 41b758f84ab2dd5da6f7ba488813d17410ebb48bc2074d304c26d63c5ece003d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
content-encoding: gzip
last-modified: Tue, 30 Aug 2022 15:04:19 GMT
etag: "d4de8398858246712016031c834bb061+gzip+gzip"
vary: Accept-Encoding,Host
x-cache: HIT, HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15317
x-served-by: cache-iad-kjyo7100153-IAD, cache-hhn11547-HHN

GET
H2 200 qevents.js Show response
a.quora.com/ 40 KB
15 KB 78ms
32ms Script
text/plain 162.159.153.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.quora.com/qevents.js
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.159.153.247 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a15bef5551f730c8269a1cba57c370099d559defd996193c80a477c411081ca2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
x-amz-version-id: vyBstMTGyA6m5sV66zq8xsypUg.tAOk.
content-encoding: gzip
cf-cache-status: HIT
x-amz-request-id: ABWFWAK2P6Z86ST7
age: 5829220
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: Lo6V6sS9dollZm991E+r9QS5ilIWlcul705lMiga2oQnz8bnT95jaa4X7qyu2MPUU2YNcD20ek4=
last-modified: Fri, 18 Mar 2022 00:16:52 GMT
server: cloudflare
x-amz-meta-s3cmd-attrs: atime:1647562609/ctime:1647562609/gid:150037/gname:ezhang/md5:47078e63380c6b0cbbfb6d8508b25ee7/mode:33204/mtime:1647562609/uid:150037/uname:ezhang
etag: W/"47078e63380c6b0cbbfb6d8508b25ee7"
vary: Accept-Encoding
content-type: text/plain
cache-control: public, max-age=14400
cf-ray: 75806a9cb82c6927-FRA
expires: Mon, 10 Oct 2022 19:33:47 GMT

GET
H/1.1 200
OK events.js Show response
tags.srv.stackadapt.com/ 17 KB
6 KB 456ms
108ms Script
text/javascript 44.206.39.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.206.39.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-206-39-165.compute-1.amazonaws.com
Software: /
Resource Hash: b35d7eb53f5c6227f8f59adb3d9242c57cf1a4d6d91df89c7ae4df795c38c97a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 10 Oct 2022 15:33:47 GMT
Cache-Control: max-age=5
Content-Encoding: gzip
Connection: keep-alive
transfer-encoding: chunked
Content-Type: text/javascript

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 58ms
15ms Script
application/x-javascript 65.9.65.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5L6H3LN&gtm_auth=d5XceCG5H_eblswmMfURjQ&gtm_preview=env-2&gtm_cookies_win=x
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.65.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-65-116.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Mon, 10 Oct 2022 02:56:58 GMT
Content-Encoding: gzip
Via: 1.1 72e8bbddfffeeec486003f867d631024.cloudfront.net (CloudFront)
Last-Modified: Thu, 24 Sep 2020 15:15:34 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA56-C1
Age: 45410
ETag: W/"98d98b3499058b76d58073cf8ede2f10"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/x-javascript
X-Cache: Hit from cloudfront
Connection: keep-alive
X-Amz-Cf-Id: AiHN3BvK0wSIE6VWCisYN0Vs74MSPSQfz1wF8iwJBQI42HYJAYyh3w==

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 16 KB
6 KB 126ms
24ms Script
application/javascript 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:23 GMT
x-amz-version-id: .QD3nDfK79S8_ikLSJXTL23Tdis9tg0C
content-encoding: gzip
strict-transport-security: max-age=15552000
x-content-type-options: nosniff
x-amz-request-id: 0BHZ4YZBG6QP6YPA
age: 25
x-amz-server-side-encryption: AES256
x-amz-id-2: iOkv7Xn3/Ms/leYLP60NdAseEp4VWCrE1EysOddtb1GIS13HihnVceJKOtA6PRRTGnQ3cMy0CMY=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Thu, 20 Jul 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Tue, 14 Jun 2022 12:21:31 GMT
server: ATS
etag: "6a624022b5d271dcefb070b0b6670abc-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H/1.1 200
OK obtp.js Show response
amplify.outbrain.com/cp/ 8 KB
4 KB 108ms
31ms Script
application/x-javascript 23.35.237.86
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://amplify.outbrain.com/cp/obtp.js
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.237.86 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-237-86.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 8f0234cadec8f9755a2b8aa9a745c354a5fbbff63a241a774c156cf93d375413

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Mon, 10 Oct 2022 15:33:47 GMT
Content-Encoding: gzip
Last-Modified: Sun, 09 Oct 2022 07:50:08 GMT
Server: AkamaiNetStorage
ETag: "0d5508c59e34b5d35cde5aea2aa1c2fd:1665301953.026714"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=1200
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3471
Expires: Mon, 10 Oct 2022 15:53:47 GMT

GET
H3 200 334990480506518 Show response
connect.facebook.net/signals/config/ 293 KB
84 KB 35ms
17ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/334990480506518?v=2.9.84&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6e2e9ea3282bf192e4fadee1e4572d213a6f063ba55c8afe67d2c839f75fbb22

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Mon, 10 Oct 2022 15:33:47 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 85918
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: K/+t2VFeSRSDTyYlbukc982uDMZqRjY0XffIS+I+jtlk3lmtBFhDZhkxsoYG/lHufFyQfmQexNxvXlhEsPzSyg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=628335157&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=2...
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=112817332.1665416028&jid=1955546465&_v=5.7.2dc&z=628335157
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=112817332.1665416028&jid=1955546465&_v=5.7.2dc&z=628335157&slf_rd=1&random=3399804916

42 B
63 B

225ms
190ms

Image
image/gif

2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=112817332.1665416028&jid=1955546465&_v=5.7.2dc&z=628335157&slf_rd=1&random=3399804916

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 15:33:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Oct 2022 15:33:48 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=112817332.1665416028&jid=1955546465&_v=5.7.2dc&z=628335157&slf_rd=1&random=3399804916
content-type: text/html; charset=UTF-8
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 __utm.gif
stats.g.doubleclick.net/r/ 35 B
111 B 333ms
32ms Image
image/gif 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=784998656&utmhn=news.sophos.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=The%20current%20state%20of%20ransomware%3A%20TorrentLocker%20%E2%80%93%20Sophos%20News&utmhid=1263840636&utmr=-&utmp=%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&utmht=1665416027657&utmac=UA-737537-53&utmcc=__utma%3D204943247.2027576132.1665416028.1665416028.1665416028.1%3B%2B__utmz%3D204943247.1665416028.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1431996439&utmredir=3&utmmt=1&utmu=q1CgAAAAAAAAAAAAAAAAAAgE~

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 10 Oct 2022 15:33:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
377 B 155ms
123ms Image
image/gif 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?bci=3&eci=2&event_id=934c8102-133b-4422-b8d4-48079b59182a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0dc99855-c49c-472d-975f-482b540f27de&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4apa&type=javascript&version=2.3.27

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-response-time: 107
date: Mon, 10 Oct 2022 15:33:47 GMT
strict-transport-security: max-age=0
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: cbe9beaead69e45d
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 779acd78aa4a1869b7f6797a20503bfe23a409f430c23e6bd4cd5a0810d9d827
content-length: 43

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
394 B 154ms
122ms Image
image/gif 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=934c8102-133b-4422-b8d4-48079b59182a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0dc99855-c49c-472d-975f-482b540f27de&tw_document_href=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o4apa&type=javascript&version=2.3.27

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-response-time: 106
date: Mon, 10 Oct 2022 15:33:46 GMT
strict-transport-security: max-age=631138519
server: tsa_o
content-type: image/gif;charset=utf-8
x-transaction-id: 5755c7d245cb7591
cache-control: no-cache, no-store, max-age=0
perf: 7626143928
x-connection-hash: 1d0bb712f885097c386e34fabe8f816300d241a081ee9dad1e308e4ecb232fdf
content-length: 43

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
https://segments.company-target.com/log?vendor=choca&user_id=AABcmE7GiHcAAB8KPvKEBQ
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABcmE7GiHcAAB8KPvKEBQ&verifyHash=ff7c5af58a3adc82e2631721549a5ac6e040303c

26 B
409 B

106ms
106ms

Image
image/gif

52.222.214.8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=choca&user_id=AABcmE7GiHcAAB8KPvKEBQ&verifyHash=ff7c5af58a3adc82e2631721549a5ac6e040303c
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Protocol: HTTP/1.1
Server: 52.222.214.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-8.fra56.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Mon, 10 Oct 2022 15:33:48 GMT
Via: 1.1 4c692717a0e85914a993c3aa5c8a2ef6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P3
Transfer-Encoding: chunked
X-Cache: Miss from cloudfront
Content-Type: image/gif
Vary: Origin
Connection: keep-alive
trace-id: 0e07c3b35289e2ce
X-Amz-Cf-Id: HZRe1YLbhxJN0JEJx8sZGpfhdqPJDXu-PjXjLTwzEL_kAOzvcI0vpQ==

Redirect headers

Date: Mon, 10 Oct 2022 15:33:47 GMT
Via: 1.1 4c692717a0e85914a993c3aa5c8a2ef6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P3
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=choca&user_id=AABcmE7GiHcAAB8KPvKEBQ&verifyHash=ff7c5af58a3adc82e2631721549a5ac6e040303c
Connection: keep-alive
trace-id: f2e62d52c9d2663e
Content-Length: 0
X-Amz-Cf-Id: H4aTfJ4MO94GnIUXsdIca1f7WtXolaTPefyEDCoEexJu46Z7_6asag==

GET
H2 451 464526.gif
id.rlcdn.com/ 0
98 B 68ms
25ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 200 ip.json Show response
api.company-target.com/api/v2/ 3 KB
1 KB 155ms
101ms XHR
application/json 18.66.97.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&page_title=The%20current%20state%20of%20ransomware%3A%20TorrentLocker%20%E2%80%93%20Sophos%20News
Requested by: Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/WuEFNglz.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-46.fra56.r.cloudfront.net
Software: nginx /
Resource Hash: 0bfc17823fb88c2de136191f024c33fb90ba470d50c347926a54f9049010bc13

Request headers

Referer: https://news.sophos.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
identification-source: CACHE
content-encoding: gzip
via: 1.1 985c0b2ec44bdebc7f24f26d1e427d30.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
x-cache: Miss from cloudfront
request-id: 9364258e-6a33-4e34-9757-a321a8e9d7e6
pragma: no-cache
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://news.sophos.com
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
vary: Accept-Encoding, Origin
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3Y3SHRt26ligmOEnE4wjutar_12goFW_iBdhgKqfLqHLIPWWCmMu6w==
expires: Sun, 09 Oct 2022 15:33:47 GMT

GET
H/1.1 200
OK pixel
q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/ 43 B
422 B 441ms
108ms Image
image/gif 18.205.225.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.quora.com/_/ad/6bed874137d04358a290eecc797a0cd6/pixel?j=1&u=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&tag=ViewContent&ts=1665416027676

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.205.225.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-205-225-81.compute-1.amazonaws.com

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Mon, 10 Oct 2022 15:33:48 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Server: nginx
Connection: keep-alive
Content-Length: 43
X-Q-Stat: ,85f58942eef91c37c7bb1f382fcab5fd,10.0.0.208,11304,217.64.151.32,,67687435998,1,1665416028.064,0.001,,.,0,0,0.000,0.000,-,0,0,197,236,118,10,34729,,,,,,-,
Content-Type: image/gif

GET
H2 200 4015302.js Show response
bat.bing.com/p/action/ 1 KB
842 B 132ms
131ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/4015302.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

aac5341aa4c349318c1a57a00c4df3d3174c930fe1f04c34a87f4b07982d06d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Mon, 10 Oct 2022 15:33:46 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1C3B7BDA7776496BBAA560961B498776 Ref B: FRAEDGE1308 Ref C: 2022-10-10T15:33:47Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private,max-age=60
content-length: 666

GET
H2 204 0
bat.bing.com/action/ 0
175 B 41ms
41ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=4015302&Ver=2&mid=2010e08f-a42d-4eb8-af72-516dc0ce28fb&sid=eed6212048b011edb7fd11f4ee5ce36f&vid=eed64e5048b011edb42191861bb4419f&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=The%20current%20state%20of%20ransomware%3A%20TorrentLocker%20%E2%80%93%20Sophos%20News&p=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&r=&lt=1319&evt=pageLoad&sv=1&rn=127745

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 10 Oct 2022 15:33:46 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 959FFA05328F48FDB8901F92C882C4AD Ref B: FRAEDGE1308 Ref C: 2022-10-10T15:33:47Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
204 B 50ms
17ms Image
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=334990480506518&ev=PageView&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&rl=&if=false&ts=1665416027723&sw=1600&sh=1200&v=2.9.84&r=stable&ec=0&o=30&fbp=fb.1.1665416027722.1957160136&it=1665416027642&coo=false&rqm=GET

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Mon, 10 Oct 2022 15:33:47 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0

GET
H/1.1 200
OK cachedClickId Show response
tr.outbrain.com/ 32 B
241 B 470ms
127ms Script
application/javascript 70.42.32.31
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to

Full URL: https://tr.outbrain.com/cachedClickId?marketerId=004df4e554108dc44d26d5da738f006d16
Requested by: Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.31 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: ed069a73aa9c7e004ba2483c7daab5396bb64f26265e4d411155d40059503595

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Mon, 10 Oct 2022 15:33:48 GMT
content-encoding: gzip
X-TraceId: a7fc16b878743bcbd2e813101f99b5e2
Content-Length: 58
Content-Type: application/javascript

GET
H/1.1 200
OK unifiedPixel
tr.outbrain.com/ 43 B
256 B 439ms
96ms Image
image/gif 70.42.32.31
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.outbrain.com/unifiedPixel?marketerId=004df4e554108dc44d26d5da738f006d16&obApiVersion=1.1&obtpVersion=1.10.0&name=PAGE_VIEW&dl=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&optOut=false&bust=017989418211258856&referrer=
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.31 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: 33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Mon, 10 Oct 2022 15:33:48 GMT
Cache-Control: no-cache
content-encoding: gzip
X-TraceId: a4b2000fe21270d1e014d49105e68bd1
Content-Length: 60
Content-Type: image/gif;

GET
H2 200 10150886.json Show response
s.yimg.com/wi/config/ 46 B
680 B 169ms
124ms XHR
application/octet-stream 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10150886.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

b2a1b0d77cb3505f23f6ca96316687b95376336a00822166c18c2808ced160eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:48 GMT
x-amz-version-id: VO4i6Xctkzo3gjHc0HLprUqd6v7sNIpd
x-content-type-options: nosniff
strict-transport-security: max-age=15552000
x-amz-request-id: 3ZRK01R1NGWRRTHY
age: 0
x-amz-server-side-encryption: AES256
content-length: 46
x-amz-id-2: l04fV0l7f0iIiCz2UA4UD4Wad8E5zpVrrDTDPAgLYA+wnUOMHBUAjbrIwXXk6old4V3QhtdA/u4=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Fri, 20 Jan 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Wed, 15 Dec 2021 05:54:05 GMT
server: ATS
etag: "3769bd8c10be070cf8c85c08517a8fdc"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/octet-stream
access-control-allow-origin: *
accept-ranges: bytes

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
15 KB 95ms
56ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-743773256

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

195f3c8ce18239cd241304be4a02c70892564caf8a139f6035b853fe212bab3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15196
x-xss-protection: 0
server: cafe
etag: 7222976147654879957
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 10 Oct 2022 15:33:47 GMT

GET
H2 200 4015302 Show response
www.clarity.ms/tag/uet/ 1 KB
2 KB 143ms
108ms Script
application/x-javascript 2620:1ec:40::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/uet/4015302
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/4015302.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:40::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 1b80f1e5134172a5b9bebe8395665699ccdd21a02d1f7eb3e81be913ad3fbb77

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-type: application/x-javascript
date: Mon, 10 Oct 2022 15:33:47 GMT
cache-control: no-cache, no-store
expires: -1
x-azure-ref: 0WztEYwAAAADgWqIKElizT57yrqlnPhp2RlJBMjMxMDUwNDIwMDI5ADZjZmJlZWUwLTUwMjctNDg0Yi04OTY3LTRhMjlhZjc3ZjFlMQ==
x-cache: CONFIG_NOCACHE
request-context: appId=cid-v1:e55edbbe-e22b-46b4-8313-9ee2a4e71d12

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1665416027854&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D461060%26time%3D1665416027854%26url%3Dhttps%253A%252F%252Fnews.sophos.com%252Fen-...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1665416027854&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1665416027854&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&liSync=tr...

0
482 B

234ms
190ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1665416027854&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&liSync=true&e_ipv6=AQJWaDFiHRW3LAAAAYPCh-EcxFel01MkhyBEG9vxwUJBpz_S84dNoo4SLO6vjR1CByPN6mTWYFt5VH70Voo_UtdXgQY
Requested by: Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:48 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 1CAECDB5E52C43FFA821940CA1872828 Ref B: FRAEDGE1118 Ref C: 2022-10-10T15:33:48Z
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
content-type: application/javascript
x-li-fabric: prod-lor1
x-cache: CONFIG_NOCACHE
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXqr+LKwM0oIZq25LqLwQ==

Redirect headers

date: Mon, 10 Oct 2022 15:33:48 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: C2D7F96EDAC24DDAAE182C8B2E9B64AC Ref B: FRAEDGE1512 Ref C: 2022-10-10T15:33:48Z
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lor1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=461060&time=1665416027854&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&liSync=true&e_ipv6=AQJWaDFiHRW3LAAAAYPCh-EcxFel01MkhyBEG9vxwUJBpz_S84dNoo4SLO6vjR1CByPN6mTWYFt5VH70Voo_UtdXgQY
x-cache: CONFIG_NOCACHE
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXqr+LHLBzz3SQP6qMk+w==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/ 2 KB
2 KB 78ms
32ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/?random=1665416027889&cv=9&fst=1665416027889&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaa50&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&tiba=The%20current%20state%20of%20ransomware%3A%20TorrentLocker%20%E2%80%93%20Sophos%20News&auid=1536531854.1665416028&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5c7b406fd20e667671a7918977b7368048966d742c41ba6c94fa59cb2a2c50d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 15:33:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1103
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
633 B 163ms
47ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Mon%2C%2010%20Oct%202022%2015%3A33%3A47%20GMT&n=0&b=The%20current%20state%20of%20ransomware%3A%20TorrentLocker%20%E2%80%93%20Sophos%20News&.yp=10150886&f=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&enc=UTF-8&yv=1.13.0&tagmgr=gtm

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 15:33:48 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Mon, 10 Oct 2022 15:33:48 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
246 B 162ms
48ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&b=The%20current%20state%20of%20ransomware%3A%20TorrentLocker%20%E2%80%93%20Sophos%20News&.yp=10150886&f=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&enc=UTF-8&yv=1.13.0&tagmgr=gtm

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 15:33:48 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Mon, 10 Oct 2022 15:33:48 GMT

GET
H2 200 clarity.js Show response
www.clarity.ms/eus-c/s/0.6.42/ 53 KB
23 KB 108ms
107ms Script
application/javascript 2620:1ec:40::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/eus-c/s/0.6.42/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/4015302
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:40::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: d97ca913935c9897ac4e255d17e14c8a3f0d8513681fe5b6736c4921fc5dd078

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:33:47 GMT
content-encoding: br
last-modified: Wed, 01 Jun 2022 12:22:22 GMT
etag: "1d8da7270bdf0d4"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript;charset=utf-8
x-azure-ref: 0WztEYwAAAABG5Rgs89brTYUI3OesNJXERlJBMjMxMDUwNDIwMDI5ADZjZmJlZWUwLTUwMjctNDg0Yi04OTY3LTRhMjlhZjc3ZjFlMQ==
cache-control: public,max-age=86400
accept-ranges: bytes
request-context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8

GET
H2 200 /
www.google.com/pagead/1p-user-list/743773256/ 42 B
548 B 71ms
33ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/743773256/?random=1665416027889&cv=9&fst=1665414000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaa50&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&tiba=The%20current%20state%20of%20ransomware%3A%20TorrentLocker%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=1881332689&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 15:33:48 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/743773256/ 42 B
548 B 67ms
28ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/743773256/?random=1665416027889&cv=9&fst=1665414000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaa50&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&tiba=The%20current%20state%20of%20ransomware%3A%20TorrentLocker%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=1881332689&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 15:33:48 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK sa.css
tags.srv.stackadapt.com/ 65 B
292 B 107ms
106ms Stylesheet
text/css 44.206.39.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.206.39.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-206-39-165.compute-1.amazonaws.com
Software: /
Resource Hash: badbe40c9aaba2811aec1c9a3a24ed5a103eb2fd91891aab3d997115d7aa04d0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 10 Oct 2022 15:33:48 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 65
Content-Type: text/css

GET
H/1.1 200
OK sa.jpeg Show response
tags.srv.stackadapt.com/ 0
881 B 427ms
106ms Fetch
image/jpeg 44.206.39.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.206.39.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-206-39-165.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 10 Oct 2022 15:33:48 GMT
Cache-Control: only-if-cached, no-transform, private, max-age=7776000
Connection: keep-alive
Content-Length: 651
Content-Type: image/jpeg

POST
H2 204 collect Show response
h.clarity.ms/ 0
159 B 1199ms
397ms XHR
text/plain 52.224.31.34
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://h.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/eus-c/s/0.6.42/clarity.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.224.31.34 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://news.sophos.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

access-control-allow-origin: https://news.sophos.com
date: Mon, 10 Oct 2022 15:33:48 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
request-context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/ 2 KB
1 KB 108ms
72ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/743773256/?random=1665416028275&cv=9&fst=1665416028275&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaa50&sendb=1&ig=1&data=event%3Dform_submit&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&tiba=The%20current%20state%20of%20ransomware%3A%20TorrentLocker%20%E2%80%93%20Sophos%20News&auid=1536531854.1665416028&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d40f19e68c8968918a79bb79b0dfb71761eff751f9767c30ebe60fb7464ae64f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 15:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1103
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame C014 0
18 B 35ms
17ms Document
text/plain 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://news.sophos.com
Referer: https://news.sophos.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://news.sophos.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 15:33:48 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H3 200 /
www.google.com/pagead/1p-user-list/743773256/ 42 B
64 B 64ms
30ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/743773256/?random=1665416028275&cv=9&fst=1665414000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaa50&sendb=1&data=event%3Dform_submit&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&tiba=The%20current%20state%20of%20ransomware%3A%20TorrentLocker%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=95941238&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 15:33:48 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/743773256/ 42 B
64 B 29ms
29ms Image
image/gif 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/743773256/?random=1665416028275&cv=9&fst=1665414000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oaa50&sendb=1&data=event%3Dform_submit&frm=0&url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&tiba=The%20current%20state%20of%20ransomware%3A%20TorrentLocker%20%E2%80%93%20Sophos%20News&async=1&fmt=3&is_vtc=1&random=95941238&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: news.sophos.com
URL: https://news.sophos.com/en-us/2015/12/23/the-current-state-of-ransomware-torrentlocker/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 15:33:48 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK saq_pxl Show response
tags.srv.stackadapt.com/ 94 B
397 B 107ms
107ms XHR
text/plain 44.206.39.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=uxMvfKEouJZfJzsjwRVn_Q&is_js=true&landing_url=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&t=The%20current%20state%20of%20ransomware%3A%20TorrentLocker%20%E2%80%93%20Sophos%20News&tip=mXuKtHmUo-4PJ5c3jFALWS8z7evudEJ4bjFhSXs4PyI&host=https://news.sophos.com&sa_conv_data_css_value=%20%220-418aace1-7043-4926-47f9-de1eb1144872%22&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9a1c2b4b681f341f776a227edde6409f6d9409720&sa-user-id-v2=s%253A0-418aace1-7043-4926-47f9-de1eb1144872%2524ip%2524217.64.151.32.bm%252BZIEzibfVrw4G8VTd6tfC%252Ba7AAskRhEI8wwWVPTDs&sa-user-id=s%253A0-418aace1-7043-4926-47f9-de1eb1144872.r10gw9exXsJs6cwl3MZ9T7W6AIakM0sgxCcV8OjXgps
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.206.39.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-206-39-165.compute-1.amazonaws.com
Software: /
Resource Hash: 078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Date: Mon, 10 Oct 2022 15:33:48 GMT
Access-Control-Allow-Methods: GET
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://news.sophos.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 94

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?CtsSyncId=FAC8FBCF47AF47D08169CE8AD9F9BEBA&RedC=c.clarity.ms&MXFR=3A2C377F062F623905D42546022F6CB9
https://c.clarity.ms/c.gif?CtsSyncId=FAC8FBCF47AF47D08169CE8AD9F9BEBA&MUID=14095FBA1E97643F15E64D831F4565A2

42 B
369 B

47ms
46ms

Image
image/gif

20.234.93.27
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?CtsSyncId=FAC8FBCF47AF47D08169CE8AD9F9BEBA&MUID=14095FBA1E97643F15E64D831F4565A2
Protocol: H2
Server: 20.234.93.27 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://news.sophos.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 15:33:48 GMT
last-modified: Tue, 13 Sep 2022 19:54:52 GMT
server: Microsoft-IIS/10.0
etag: "8d3298b0aac7d81:0"
x-powered-by: ASP.NET
content-type: image/gif
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

Redirect headers

pragma: no-cache
date: Mon, 10 Oct 2022 15:33:48 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BB24C6E402124985A43AA4E29B4C95FD Ref B: FRAEDGE1308 Ref C: 2022-10-10T15:33:48Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?CtsSyncId=FAC8FBCF47AF47D08169CE8AD9F9BEBA&MUID=14095FBA1E97643F15E64D831F4565A2
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H2 200 up Show response
insight.adsrvr.org/track/ Frame 9241 0
182 B 127ms
40ms Document
text/html 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=j022xlj&ref=https%3A%2F%2Fnews.sophos.com%2Fen-us%2F2015%2F12%2F23%2Fthe-current-state-of-ransomware-torrentlocker%2F&upid=ql4fc2b&upv=1.1.0
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://news.sophos.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-type: text/html
date: Mon, 10 Oct 2022 15:33:48 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

POST
H2 204 collect Show response
h.clarity.ms/ 0
48 B 274ms
273ms XHR
text/plain 52.224.31.34
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://h.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/eus-c/s/0.6.42/clarity.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.224.31.34 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://news.sophos.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

access-control-allow-origin: https://news.sophos.com
date: Mon, 10 Oct 2022 15:33:48 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
request-context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8

Verdicts & Comments Add Verdict or Comment

73 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

44 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.sophos.com/	1970-01-20 10:56:08	Name: CampaignID Value: 70130000001xKqzAAE
.sophos.com/	1970-01-20 08:46:32	Name: _gcl_au Value: 1.1.1536531854.1665416028
.sophos.com/	1970-01-20 16:12:56	Name: __utma Value: 1.112817332.1665416028.1665416028.1665416028.1
.sophos.com/	1969-12-31 23:59:59	Name: __utmc Value: 1
.sophos.com/	1970-01-20 10:59:44	Name: __utmz Value: 1.1665416028.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.sophos.com/	1970-01-20 06:36:56	Name: __utmt Value: 1
.sophos.com/	1970-01-20 06:36:57	Name: __utmb Value: 1.1.10.1665416028
.news.sophos.com/	1970-01-20 16:12:56	Name: __utma Value: 204943247.2027576132.1665416028.1665416028.1665416028.1
.quora.com/	1970-01-20 06:36:57	Name: __cf_bm Value: SbePH4vRWydP7qDeqNzojxwQYXSyrQ411qDy9yncWDk-1665416027-0-AZ5Bb54hv/mgWKnYrnqmNCXFNBOdZziQ7Q714kyDxEfQ98Ifu23N8P8uWnamzBIEvz8Fpe6jOiUaVu3olzTaEm4=
.news.sophos.com/	1969-12-31 23:59:59	Name: __utmc Value: 204943247
.news.sophos.com/	1970-01-20 10:59:44	Name: __utmz Value: 204943247.1665416028.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.news.sophos.com/	1970-01-20 06:36:56	Name: __utmt_news Value: 1
.news.sophos.com/	1970-01-20 06:36:57	Name: __utmb Value: 204943247.1.10.1665416028
.bing.com/	1970-01-20 15:58:32	Name: MUID Value: 14095FBA1E97643F15E64D831F4565A2
.sophos.com/	1970-01-20 06:38:22	Name: _uetsid Value: eed6212048b011edb7fd11f4ee5ce36f
.sophos.com/	1970-01-20 15:58:32	Name: _uetvid Value: eed64e5048b011edb42191861bb4419f
.sophos.com/	1970-01-20 08:46:32	Name: _fbp Value: fb.1.1665416027722.1957160136
.twitter.com/	1970-01-20 16:12:56	Name: personalization_id Value: "v1_XHBSh81RAtK78R88pOyitA=="
.t.co/	1970-01-20 16:12:56	Name: muc_ads Value: aa5fec94-3fe0-4fe3-90b2-b6e301b95458
.bidr.io/	1970-01-20 16:05:29	Name: bito Value: AABcmE7GiHcAAB8KPvKEBQ
.bidr.io/	1970-01-20 16:05:29	Name: bitoIsSecure Value: ok
www.clarity.ms/	1970-01-20 15:22:32	Name: CLID Value: 45cc1cab87b745a281a902bce0726537.20221010.20231010
.company-target.com/	1970-01-20 16:12:56	Name: tuuid Value: 07580986-cb1e-41fe-a839-66402013638a
.company-target.com/	1970-01-20 16:12:56	Name: tuuid_lu Value: 1665416027
tags.srv.stackadapt.com/	1970-01-20 15:22:32	Name: sa-user-id Value: s%3A0-418aace1-7043-4926-47f9-de1eb1144872.r10gw9exXsJs6cwl3MZ9T7W6AIakM0sgxCcV8OjXgps
.srv.stackadapt.com/	1970-01-20 15:22:32	Name: sa-user-id-v2 Value: s%3AQYqs4XBDSSZH-d4esRRIctlAlyA.I0oCUq08T7bN32XoN9ouGpK8lrJ1BBUHNFU0Ou9Vt7U
news.sophos.com/	1970-01-20 15:22:32	Name: sa-user-id Value: s%253A0-418aace1-7043-4926-47f9-de1eb1144872.r10gw9exXsJs6cwl3MZ9T7W6AIakM0sgxCcV8OjXgps
news.sophos.com/	1970-01-20 15:22:32	Name: sa-user-id-v2 Value: s%253A0-418aace1-7043-4926-47f9-de1eb1144872%2524ip%2524217.64.151.32.bm%252BZIEzibfVrw4G8VTd6tfC%252Ba7AAskRhEI8wwWVPTDs
.sophos.com/	1970-01-20 15:22:32	Name: _clck Value: 15nwj49\|1\|f5l\|0
.linkedin.com/	1970-01-20 07:20:08	Name: UserMatchHistory Value: AQIIJQjQkCjH3AAAAYPCh99apfHIWtZQqPWfDxnOUySvkm-dao0GvfKE5C5yk5zae0_7q0GCfpSGKg
.linkedin.com/	1970-01-20 07:20:08	Name: AnalyticsSyncHistory Value: AQLYiEXDT9KBwgAAAYPCh99aCjdljDqcdY26Q7bHOd9wGUijXjjss8MWrRC3LmzkHKoldFn48onSESEdxZMhfw
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 15:22:32	Name: bcookie Value: "v=2&afd57814-74f2-482b-818f-7855623cc0c7"
.linkedin.com/	1970-01-20 06:38:22	Name: lidc Value: "b=OGST00:s=O:r=O:a=O:p=O:g=2828:u=1:x=1:i=1665416027:t=1665502427:v=2:sig=AQEqD7EbeVzZFf3Hqac3-KiXst0TdH40"
.yahoo.com/	1970-01-20 15:22:53	Name: A3 Value: d=AQABBFw7RGMCEKdXfMARK6tFOpA59C8mpDkFEgEBAQGMRWNOYwAAAAAA_eMAAA&S=AQAAAvH9EHuvCPc1ozsRkatCfVY
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 15:22:32	Name: bscookie Value: "v=1&20221010153348319414a4-bc9c-429e-8e6c-8f738db9f1c2AQElmz1vYeDi1pNWQKvrZLHiQ-NZ42L1"
.linkedin.com/	1970-01-20 10:56:08	Name: li_gc Value: MTswOzE2NjU0MTYwMjg7MjswMjF3IFCVSgSL/HMlKPD/NAYyG5x5UwiIcflp9/+3iQR7UQ==
.doubleclick.net/	1970-01-20 15:58:32	Name: IDE Value: AHWqTUlI5dzV4d3ItCvmqZz0aoy3WHge0mdVi6gPiO5yZjJ4_s8Ymw0umCRXPo2-
.c.bing.com/	1970-01-20 15:58:32	Name: SRM_B Value: 14095FBA1E97643F15E64D831F4565A2
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 15:58:32	Name: MUID Value: 14095FBA1E97643F15E64D831F4565A2
.c.clarity.ms/	1970-01-20 06:36:56	Name: ANONCHK Value: 0
.sophos.com/	1970-01-20 06:38:22	Name: _clsk Value: tzn7sn\|1665416029395\|1\|1\|h.clarity.ms/collect

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://id.rlcdn.com/464526.gif Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.quora.com
amplify.outbrain.com
analytics.twitter.com
api.company-target.com
bat.bing.com
blogs.sophos.com
c.bing.com
c.clarity.ms
cdn.jsdelivr.net
connect.facebook.net
googleads.g.doubleclick.net
h.clarity.ms
id.rlcdn.com
img03.en25.com
insight.adsrvr.org
js.adsrvr.org
match.prod.bidr.io
news.sophos.com
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
s.yimg.com
scripts.demandbase.com
secure.gravatar.com
segments.company-target.com
snap.licdn.com
sp.analytics.yahoo.com
static.ads-twitter.com
stats.g.doubleclick.net
stats.wp.com
t.co
tags.srv.stackadapt.com
tr.outbrain.com
www.clarity.ms
www.facebook.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
104.244.42.67
104.244.42.69
13.107.42.14
13.32.27.124
142.250.185.66
162.159.153.247
18.205.225.81
18.66.97.46
192.0.76.3
199.232.136.157
20.234.93.27
212.82.100.181
23.35.237.86
2606:4700::6810:5614
2620:1ec:21::14
2620:1ec:40::45
2620:1ec:c11::200
2a00:1288:80:807::1
2a00:1450:4001:82b::2003
2a00:1450:4001:82b::2008
2a00:1450:4001:830::2002
2a00:1450:4001:830::2004
2a00:1450:400c:c00::9b
2a02:26f0:3500:16::215:149b
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
2a04:fa87:fffd::c000:42e3
2a04:fa87:fffe::c000:4902
35.244.174.68
44.206.39.165
52.222.214.8
52.223.40.198
52.224.31.34
54.217.231.82
65.9.65.116
70.42.32.31
96.16.149.96
00a92494627ed8f758972b7dc47b3af186497c0637ea867a33fdb604c1548674
0168c7db469360f21c61a653e00f7dccece3450e41418288739324d86814a928
078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4
092d3e0daf1e4670efcbd6afa13196ec9525d9a045bea4dbeca8c4d7859a247e
0bfc17823fb88c2de136191f024c33fb90ba470d50c347926a54f9049010bc13
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
1185f89f1ba6e4d1b3213cc96da7b42ec6a136d293c6eace2954fbc6360f6e40
195f3c8ce18239cd241304be4a02c70892564caf8a139f6035b853fe212bab3a
1b80f1e5134172a5b9bebe8395665699ccdd21a02d1f7eb3e81be913ad3fbb77
1fa648f58cc0b3ce7d4574578aeb59038d1b5ddc00de3f568655be62a1d5c0ec
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
30153b15b4cb898c421e657f6de21dc27435cb990e7888367bdee12e06398da7
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
33ca751ed175a163bef530ebdcdbd0a2d15997ccbcbf8d50a6f504e8ffac5a5c
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
41b758f84ab2dd5da6f7ba488813d17410ebb48bc2074d304c26d63c5ece003d
544c93eb16ddd32877954737a2078a11e85a8a21c3565fb7714225a60d0e2c0d
5467511a1c80aeedcb76b7143274329dd6d861608a3cac5b8ac6a46166723c97
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
56c4c9c31e9c4febdaaed356a15c9566084977d2a7a86842b14e9af3a71f9baa
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5c7b406fd20e667671a7918977b7368048966d742c41ba6c94fa59cb2a2c50d6
5e7d0961e3fcec97f7e8d12198a4a28e5cfaa2d16abf0bc5e30a7d3c2284746e
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
6e2e9ea3282bf192e4fadee1e4572d213a6f063ba55c8afe67d2c839f75fbb22
75839e3ea0cd949a33dc21dd8b0931f396829fea8e0e3148b576b1228f40e469
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8f0234cadec8f9755a2b8aa9a745c354a5fbbff63a241a774c156cf93d375413
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9c9e5ce4a745398c82c6afcbb22d8d8c9c42e42869a2831d0e66830943ca80a8
a14d480f7330e0f27db7e8765697f4ddf746bfde815b1eb57e31a0fad9d7a647
a15bef5551f730c8269a1cba57c370099d559defd996193c80a477c411081ca2
a36c1b591e0a043aef36da97ac4da5a313386c35ad3c92eb558e13d0291f8eff
aac5341aa4c349318c1a57a00c4df3d3174c930fe1f04c34a87f4b07982d06d6
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b1dabfd8c891f8dc85b58fa6ae8a535222693d59dc76b5fe160752510f01601f
b2a1b0d77cb3505f23f6ca96316687b95376336a00822166c18c2808ced160eb
b35d7eb53f5c6227f8f59adb3d9242c57cf1a4d6d91df89c7ae4df795c38c97a
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
b85ed9ff65cb89798ff1ac4b0d9a9b2c2d14f27a949ac3c19bae5c228ecc8f38
badbe40c9aaba2811aec1c9a3a24ed5a103eb2fd91891aab3d997115d7aa04d0
d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe
d40f19e68c8968918a79bb79b0dfb71761eff751f9767c30ebe60fb7464ae64f
d93cea00230540bc488dbe3afab54b37f88bd1b65aeb9bb576edaa7b8d0b4035
d97ca913935c9897ac4e255d17e14c8a3f0d8513681fe5b6736c4921fc5dd078
de35cf1643aec2d5e935a162565bac412cdd96ce8f980a46feadcd71ad10b4ee
de9485aee0805fc555984a4286697dccb8a9762fa9240c6a47b4dd478d282e74
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed069a73aa9c7e004ba2483c7daab5396bb64f26265e4d411155d40059503595
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631
f927844e8c953560f5a67112c5dfaab926df93df57f3d8cd062028f1ca80b530

news.sophos.com Open in urlscan Pro 2a04:fa87:fffd::c000:42e3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

70 Requests

94 %HTTPS

41 %IPv6

29 Domains

41 Subdomains

35 IPs

6 Countries

963 kBTransfer

2156 kBSize

44 Cookies

19 Outgoing links

Page URL History

Redirected requests

70 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

news.sophos.com Open in urlscan Pro
2a04:fa87:fffd::c000:42e3 Public Scan

Screenshot
Live screenshot

Full Image

70
Requests

94 %
HTTPS

41 %
IPv6

29
Domains

41
Subdomains

35
IPs

6
Countries

963 kB
Transfer

2156 kB
Size

44
Cookies

70 HTTP transactions
0 data transactions