news.sophos.com
Open in
urlscan Pro
2a04:fa87:fffd::c000:42e3
Public Scan
Submitted URL: http://blogs.sophos.com/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack-infographic/
Effective URL: https://news.sophos.com/en-us/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack-infographic/
Submission: On June 09 via manual from GB — Scanned from GB
Effective URL: https://news.sophos.com/en-us/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack-infographic/
Submission: On June 09 via manual from GB — Scanned from GB
Summary
This website contacted 9 IPs
in 4 countries
across 10 domains to perform 31 HTTP transactions.
The main IP is 2a04:fa87:fffd::c000:42e3, located in
Ireland and
belongs to AUTOMATTIC, US.
The main domain is news.sophos.com.
The Cisco Umbrella rank of the primary domain is 600476.
TLS certificate: Issued by R3 on June 2nd 2023. Valid for: 3 months.
This is the only time news.sophos.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on June 2nd 2023. Valid for: 3 months.
This is the only time news.sophos.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 21 | 2a04:fa87:fff... 2a04:fa87:fffd::c000:42e3 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
| 2 | 2a00:1450:400... 2a00:1450:4001:82b::2008 | 15169 (GOOGLE) (GOOGLE) | |
| 2 | 2a04:fa87:fff... 2a04:fa87:fffe::c000:4902 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
| 1 | 2a04:4e42:200... 2a04:4e42:200::485 | 54113 (FASTLY) (FASTLY) | |
| 2 | 192.0.76.3 192.0.76.3 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
| 1 3 | 2a00:1450:400... 2a00:1450:400c:c0c::9d | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 184.25.216.9 184.25.216.9 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
| 1 1 | 2a00:1450:400... 2a00:1450:4001:828::2004 | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:80e::2003 | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 2001:4860:480... 2001:4860:4802:32::36 | 15169 (GOOGLE) (GOOGLE) | |
| 31 | 9 |
2
2a00:1450:4001:82b::2008
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE, US)
ASN15169 (GOOGLE, US)
| www.googletagmanager.com |
1
184.25.216.9
(Frankfurt am Main, Germany)
ASN16625 (AKAMAI-AS, US)
PTR: a184-25-216-9.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS, US)
PTR: a184-25-216-9.deploy.static.akamaitechnologies.com
| img03.en25.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 21 |
sophos.com
2 redirects
blogs.sophos.com news.sophos.com — Cisco Umbrella Rank: 600476 |
713 KB |
| 3 |
doubleclick.net
1 redirects
stats.g.doubleclick.net — Cisco Umbrella Rank: 121 |
17 KB |
| 2 |
wp.com
stats.wp.com — Cisco Umbrella Rank: 2949 pixel.wp.com — Cisco Umbrella Rank: 2679 |
5 KB |
| 2 |
gravatar.com
secure.gravatar.com — Cisco Umbrella Rank: 2017 |
38 KB |
| 2 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 75 |
174 KB |
| 1 |
google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 1892 |
254 B |
| 1 |
google.co.uk
www.google.co.uk — Cisco Umbrella Rank: 2809 |
408 B |
| 1 |
google.com
1 redirects
www.google.com — Cisco Umbrella Rank: 3 |
486 B |
| 1 |
en25.com
img03.en25.com — Cisco Umbrella Rank: 23028 |
3 KB |
| 1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 377 |
9 KB |
| 31 | 10 |
| Domain | Requested by | |
|---|---|---|
| 20 | news.sophos.com |
1 redirects
news.sophos.com
|
| 3 | stats.g.doubleclick.net |
1 redirects
news.sophos.com
|
| 2 | secure.gravatar.com |
news.sophos.com
|
| 2 | www.googletagmanager.com |
news.sophos.com
www.googletagmanager.com |
| 1 | region1.google-analytics.com |
www.googletagmanager.com
|
| 1 | www.google.co.uk |
news.sophos.com
|
| 1 | www.google.com | 1 redirects |
| 1 | pixel.wp.com |
news.sophos.com
|
| 1 | img03.en25.com |
news.sophos.com
|
| 1 | stats.wp.com |
news.sophos.com
|
| 1 | cdn.jsdelivr.net |
news.sophos.com
|
| 1 | blogs.sophos.com | 1 redirects |
| 31 | 12 |
This site contains links to these domains. Also see Links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| news.sophos.com R3 |
2023-06-02 - 2023-08-31 |
3 months | crt.sh |
| *.google-analytics.com GTS CA 1C3 |
2023-05-19 - 2023-08-11 |
3 months | crt.sh |
| *.gravatar.com Sectigo ECC Domain Validation Secure Server CA |
2022-11-23 - 2023-12-24 |
a year | crt.sh |
| jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4 |
2022-12-23 - 2024-01-24 |
a year | crt.sh |
| *.wp.com Sectigo ECC Domain Validation Secure Server CA |
2022-11-14 - 2023-12-15 |
a year | crt.sh |
| *.g.doubleclick.net GTS CA 1C3 |
2023-05-19 - 2023-08-11 |
3 months | crt.sh |
| *.en25.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-05-21 - 2024-05-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://news.sophos.com/en-us/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack-infographic/
Frame ID: 8C7FD15265B2785A2F56C241E2CDEC5B
Requests: 31 HTTP requests in this frame
Screenshot
Page Title
How malware works: Anatomy of a drive-by download web attack (Infographic) – Sophos NewsPage URL History Show full URLs
-
http://blogs.sophos.com/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack-infog...
HTTP 307
https://blogs.sophos.com/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack-infog... HTTP 301
https://news.sophos.com/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack-infog... HTTP 302
https://news.sophos.com/en-us/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack... Page URL
Detected technologies
WordPress
(CMS)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
- /wp-(?:content|includes)/
Alpine.js
(JavaScript frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /alpine(?:\.min)?\.js
Google Analytics
(Analytics)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
Google Tag Manager
(Tag Managers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <!-- (?:End )?Google Tag Manager -->
- googletagmanager\.com/gtm\.js
- googletagmanager\.com/gtag/js
jsDelivr
(CDN)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
29 Outgoing links
These are links going to different origins than the main page.
URL: https://nakedsecurity.sophos.com/
Title: Security News
Title: Security News
Search URL Search Domain Scan URL
URL: https://www.sophos.com/en-us/products/intercept-x.aspx?cmp=26103
Title: DEEP LEARNING FOR DEEPER CYBERSECURITY Watch Video
Title: DEEP LEARNING FOR DEEPER CYBERSECURITY Watch Video
Search URL Search Domain Scan URL
URL: http://blogs.sophos.com/2014/01/20/keep-your-website-secure-from-exploit-kits-and-hacker-attacks-video/
Title: exploit kit
Title: exploit kit
Search URL Search Domain Scan URL
URL: http://blogs.sophos.com/2013/10/08/5-ways-to-make-your-web-browser-more-secure/
Title: web browser
Title: web browser
Search URL Search Domain Scan URL
URL: http://blogs.sophos.com/2014/03/12/sophoslabs-techniques-from-apts-showing-up-in-money-making-zbotzeus-malware/
Title: Zbot
Title: Zbot
Search URL Search Domain Scan URL
URL: http://blogs.sophos.com/2014/01/09/decoding-cryptolocker-how-it-works-and-how-to-protect-your-files-presentation/
Title: ransomware
Title: ransomware
Search URL Search Domain Scan URL
URL: http://www.sophos.com/en-us/medialibrary/Gated%20Assets/white%20papers/checklist-of-technology-tools-and-tactics-for-effective-web-protection.pdf
Title: checklist of technology, tools and tactics for effective web protection
Title: checklist of technology, tools and tactics for effective web protection
Search URL Search Domain Scan URL
URL: https://www.sophos.com/en-us/security-news-trends/whitepapers/gated-wp/protecting-against-web-malware-attacks.aspx?utm_source=Non-campaign&utm_medium=Cross-link&utm_campaign=CL-CorpBlog
Title: Five Stages of a Web Malware Attack
Title: Five Stages of a Web Malware Attack
Search URL Search Domain Scan URL
URL: http://www.sophos.com/en-us/products/secure-web-gateway.aspx?utm_source=Non-campaign&utm_medium=Cross-link&utm_campaign=CL-CorpBlog
Title: Learn more about how we can secure the web for you
Title: Learn more about how we can secure the web for you
Search URL Search Domain Scan URL
URL: http://www.facebook.com/share.php?u=https://news.sophos.com/?p=25296&title=How%20malware%20works:%20Anatomy%20of%20a%20drive-by%20download%20web%20attack%20(Infographic)
Title: Share on Facebook
Title: Share on Facebook
Search URL Search Domain Scan URL
URL: http://twitter.com/intent/tweet?text=How%20malware%20works%3A%20Anatomy%20of%20a%20drive-by%20download%20web%20attack%20%28Infographic%29%20https%3A%2F%2Fnews.sophos.com%2F%3Fp%3D25296
Title: Share on Twitter
Title: Share on Twitter
Search URL Search Domain Scan URL
URL: http://www.linkedin.com/shareArticle?mini=true&url=https://news.sophos.com/en-us/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack-infographic/
Title: Share on LinkedIn
Title: Share on LinkedIn
Search URL Search Domain Scan URL
URL: http://blogs.sophos.com/2014/04/11/how-do-apts-work-the-lifecycle-of-advanced-persistent-threats-infographic/
Title: How do APTs work? The Lifecycle of Advanced Persistent Threats (Infographic) | Sophos Blog
Title: How do APTs work? The Lifecycle of Advanced Persistent Threats (Infographic) | Sophos Blog
Search URL Search Domain Scan URL
URL: http://blogs.sophos.com/2014/04/22/sophos-at-infosecurity-europe-2014-credit-card-crime-android-malware-and-a-look-inside-sophoslabs/
Title: Sophos at Infosecurity Europe 2014: Credit card crime, Android malware, and a look inside SophosLabs | Sophos Blog
Title: Sophos at Infosecurity Europe 2014: Credit card crime, Android malware, and a look inside SophosLabs | Sophos Blog
Search URL Search Domain Scan URL
URL: http://nakedsecurity.sophos.com/2014/09/04/5-things-you-should-know-about-email-unsubscribe-links-before-clicking/
Title: 5 things you should know about email unsubscribe links before clicking | Naked Security
Title: 5 things you should know about email unsubscribe links before clicking | Naked Security
Search URL Search Domain Scan URL
URL: https://stewilliams.com/5-things-you-should-know-about-email-unsubscribe-links-before-you-click/
Title: ste williams – 5 things you should know about email unsubscribe links before you click
Title: ste williams – 5 things you should know about email unsubscribe links before you click
Search URL Search Domain Scan URL
URL: http://www.lufsec.com/?p=2257
Title: Lufsec – 5 things you should know about email unsubscribe links before you click
Title: Lufsec – 5 things you should know about email unsubscribe links before you click
Search URL Search Domain Scan URL
URL: http://blogs.sophos.com/2014/12/12/the-top-6-retail-threats-and-how-to-stop-them/
Title: The top 6 retail threats and how to stop them | Sophos Blog
Title: The top 6 retail threats and how to stop them | Sophos Blog
Search URL Search Domain Scan URL
URL: http://blogs.sophos.com/2014/12/18/sophoslabs-research-spotlights-rising-threat-of-vawtrak-financial-malware/
Title: SophosLabs research spotlights rising threat of Vawtrak financial malware | Sophos Blog
Title: SophosLabs research spotlights rising threat of Vawtrak financial malware | Sophos Blog
Search URL Search Domain Scan URL
URL: http://inbirdyseyes.net/2014/09/15/when-you-unsubscribe/
Title: When You Unsubscribe - In Birdys Eyes
Title: When You Unsubscribe - In Birdys Eyes
Search URL Search Domain Scan URL
URL: http://chip.da3ch.com/?p=183
Title: Frage zu Drive By Downloads topx | chip
Title: Frage zu Drive By Downloads topx | chip
Search URL Search Domain Scan URL
URL: http://klausjochem.me/2015/01/24/how-to-mitigate-drive-by-downloads/
Title: How to mitigate Drive-by-Downloads | IT Security Matters
Title: How to mitigate Drive-by-Downloads | IT Security Matters
Search URL Search Domain Scan URL
URL: http://nakedsecurity.sophos.com/
Title: Mark Stockley
Title: Mark Stockley
Search URL Search Domain Scan URL
URL: https://www.sophos.com/en-us/legal/sophos-website.aspx
Title: Terms
Title: Terms
Search URL Search Domain Scan URL
URL: https://www.sophos.com/en-us/legal/sophos-group-privacy-policy.aspx
Title: Privacy Notice
Title: Privacy Notice
Search URL Search Domain Scan URL
URL: https://www.sophos.com/en-us/legal/cookie-information.aspx
Title: Cookies
Title: Cookies
Search URL Search Domain Scan URL
URL: https://www.sophos.com/en-us/legal.aspx
Title: General
Title: General
Search URL Search Domain Scan URL
URL: https://www.sophos.com/en-us/legal/modern-slavery-act-transparency-statement.aspx
Title: Modern Slavery Statement
Title: Modern Slavery Statement
Search URL Search Domain Scan URL
URL: https://secure.ethicspoint.eu/domain/media/en/gui/104916/index.html
Title: Speak Out
Title: Speak Out
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://blogs.sophos.com/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack-infographic/
HTTP 307
https://blogs.sophos.com/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack-infographic/ HTTP 301
https://news.sophos.com/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack-infographic/ HTTP 302
https://news.sophos.com/en-us/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack-infographic/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 27- https://stats.g.doubleclick.net/r/__utm.gif?utmwv=5.7.2dc&utms=1&utmn=506195258&utmhn=news.sophos.com&utme=8(4!CampaignID)9(4!70130000001xKqzAAE)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=How%20malware%20works%3A%20Anatomy%20of%20a%20drive-by%20download%20web%20attack%20(Infographic)%20%E2%80%93%20Sophos%20News&utmhid=1022715061&utmr=-&utmp=%2Fcorpblog%2Fen-us%2F2014%2F03%2F26%2Fhow-malware-works-anatomy-of-a-drive-by-download-web-attack-infographic%2F&utmht=1686300666726&utmac=UA-737537-1&utmcc=__utma%3D1.199454646.1686300667.1686300667.1686300667.1%3B%2B__utmz%3D1.1686300667.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1071987980&utmredir=3&utmu=q1CAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=199454646.1686300667&jid=1071987980&_v=5.7.2dc&z=506195258 HTTP 302
- https://www.google.co.uk/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-737537-1&cid=199454646.1686300667&jid=1071987980&_v=5.7.2dc&z=506195258&slf_rd=1&random=2281201314
31 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
news.sophos.com/en-us/2014/03/26/how-malware-works-anatomy-of-a-drive-by-download-web-attack-infographic/ Redirect Chain
|
89 KB 21 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.min.css
news.sophos.com/wp-includes/css/dist/block-library/ |
95 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
news.sophos.com/_static/ |
15 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
news.sophos.com/_static/ |
512 B 354 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gtm.js
www.googletagmanager.com/ |
313 KB 99 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wp-emoji-release.min.js
news.sophos.com/wp-includes/js/ |
18 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
news.sophos.com/_static/ |
153 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
news.sophos.com/_static/ |
101 KB 35 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
web-threats-infographic-image.jpg
news.sophos.com/wp-content/uploads/2014/03/ |
187 KB 188 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
9dc9c4f274c3087c15eadd281503db84
secure.gravatar.com/avatar/ |
35 KB 35 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
avatar-two.png
news.sophos.com/wp-content/themes/sophosnews-2017/img/avatars/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
avatar-one.png
news.sophos.com/wp-content/themes/sophosnews-2017/img/avatars/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
4a3accc0a742c1ee09af28a5dc893fa5
secure.gravatar.com/avatar/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
avatar-three.png
news.sophos.com/wp-content/themes/sophosnews-2017/img/avatars/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
news.sophos.com/_static/ |
135 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
alpine.min.js
cdn.jsdelivr.net/gh/alpinejs/alpine@v2.8.1/dist/ |
26 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
news.sophos.com/_static/ |
13 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
e-202323.js
stats.wp.com/ |
13 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sophos-ransomware-web-banner-1200x628px-option-2.png
news.sophos.com/wp-content/uploads/2021/05/ |
166 KB 166 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sophos-edr-news-blog-image-838x440px@2x.png
news.sophos.com/wp-content/uploads/2021/05/ |
21 KB 21 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sophos-xdr.png
news.sophos.com/wp-content/uploads/2021/05/ |
107 KB 107 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SophosSans-Light.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ |
25 KB 25 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SophosSans-Medium.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ |
26 KB 26 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SophosSans-Semibold.woff2
news.sophos.com/wp-content/themes/sophosnews-2017/fonts/ |
26 KB 26 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
dc.js
stats.g.doubleclick.net/ |
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
elqCfg.min.js
img03.en25.com/i/ |
6 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
g.gif
pixel.wp.com/ |
50 B 93 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
js
www.googletagmanager.com/gtag/ |
206 KB 74 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ga-audiences
www.google.co.uk/ads/ Redirect Chain
|
42 B 408 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
__utm.gif
stats.g.doubleclick.net/r/ |
35 B 111 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
collect
region1.google-analytics.com/g/ |
0 254 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
%20%E2%80%93%20Sophos%20News&utmhid=1022715061&utmr=-&utmp=%2Fen-us%2F2014%2F03%2F26%2Fhow-malware-works-anatomy-of-a-drive-by-download-web-attack-infographic%2F&utmht=1686300666729&utmac=UA-737537-53&utmcc=__utma%3D204943247.543127984.1686300667.1686300667.1686300667.1%3B%2B__utmz%3D204943247.1686300667.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=237498746&utmredir=3&utmmt=1&utmu=q1CgAAAAAAAAAAAAAAAAAAgE~){kind=link}
%20%E2%80%93%20Sophos%20News&utmhid=1022715061&utmr=-&utmp=%2Fen-us%2F2014%2F03%2F26%2Fhow-malware-works-anatomy-of-a-drive-by-download-web-attack-infographic%2F&utmht=1686300666729&utmac=UA-737537-53&utmcc=__utma%3D204943247.543127984.1686300667.1686300667.1686300667.1%3B%2B__utmz%3D204943247.1686300667.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=237498746&utmredir=3&utmmt=1&utmu=q1CgAAAAAAAAAAAAAAAAAAgE~){kind=link}
Verdicts & Comments Add Verdict or Comment
32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend object| dataLayer object| _wpemojiSettings object| twemoji object| wp undefined| $ function| jQuery object| PG8Data object| PG8 object| Sophos function| Cookies object| Stickyfill function| Spinner function| Tether function| Drop object| _gaq object| Alpine object| addComment object| _stq function| st_go function| linktracker_init object| wpcom object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data object| _gat object| gaGlobal object| _elqQ object| _elq13 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .sophos.com/ | Name: CampaignID Value: 70130000001xKqzAAE |
|
| .sophos.com/ | Name: __utma Value: 1.199454646.1686300667.1686300667.1686300667.1 |
|
| .sophos.com/ | Name: __utmc Value: 1 |
|
| .sophos.com/ | Name: __utmz Value: 1.1686300667.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
| .sophos.com/ | Name: __utmt Value: 1 |
|
| .sophos.com/ | Name: __utmb Value: 1.1.10.1686300667 |
|
| .news.sophos.com/ | Name: __utma Value: 204943247.543127984.1686300667.1686300667.1686300667.1 |
|
| .news.sophos.com/ | Name: __utmc Value: 204943247 |
|
| .news.sophos.com/ | Name: __utmz Value: 204943247.1686300667.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
| .news.sophos.com/ | Name: __utmt_news Value: 1 |
|
| .news.sophos.com/ | Name: __utmb Value: 204943247.1.10.1686300667 |
|
| .sophos.com/ | Name: _ga_V88TEQ7EYL Value: GS1.1.1686300666.1.0.1686300666.0.0.0 |
|
| .sophos.com/ | Name: _ga Value: GA1.1.701110293.1686300667 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
blogs.sophos.com
cdn.jsdelivr.net
img03.en25.com
news.sophos.com
pixel.wp.com
region1.google-analytics.com
secure.gravatar.com
stats.g.doubleclick.net
stats.wp.com
www.google.co.uk
www.google.com
www.googletagmanager.com
184.25.216.9
192.0.76.3
2001:4860:4802:32::36
2a00:1450:4001:80e::2003
2a00:1450:4001:828::2004
2a00:1450:4001:82b::2008
2a00:1450:400c:c0c::9d
2a04:4e42:200::485
2a04:fa87:fffd::c000:42e3
2a04:fa87:fffe::c000:4902
03163fb7b374fe2300420baafc172c762df151ebe6299d6b23c4d9d683c67c4e
04ad4c921bf8da03b20e88656f4e840ed22d6010290705a45a81072fc42af91e
16167a6fc3186023d68032ceeb040de421335560d1eef17d6c792458584e5888
1fa648f58cc0b3ce7d4574578aeb59038d1b5ddc00de3f568655be62a1d5c0ec
24f6225b24d4bd4d81d910df8032b372b3b4d554f6c8f2ea0ddb0dd98e12e20a
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
3d2c10cf69410c10177fc6e56937d05151b182841fa6aee36f651d587d91fbb8
487b3e0891812f6523c3959cd4eb84fe49797140db9ad395a3f565ac4f85e691
4c2cf7fa431fbdc22a30eaa3b547c5453f9598ac3ea8735d1afc744af19399e3
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
56c4c9c31e9c4febdaaed356a15c9566084977d2a7a86842b14e9af3a71f9baa
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
6a71b6aa693b3084d28e6dfd65755fe543c24278fac68b175b3b5fcdda059577
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83401668c3b006bab66b4a997353a519eff8b5b4dc78ee59b1a7a7e2e4fe3629
a36c1b591e0a043aef36da97ac4da5a313386c35ad3c92eb558e13d0291f8eff
ab8517f3d5171dd42a8b9c22af6a2f944b41d00e7ea54ba02b4ed71a6c59e543
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4
b85ed9ff65cb89798ff1ac4b0d9a9b2c2d14f27a949ac3c19bae5c228ecc8f38
cd4fc079ac2bea8007e736a186cc2f86c30b2b8911cf54139e7ef90217b9d3ee
d1fabd20a67738775bb84fda3b230d2f007a2c3a6629d327bc8ab4312cb5c0fe
d77f220e762f5b389a402c58a62884fd7c647e034948eccfbf5859d0e91129b8
d93cea00230540bc488dbe3afab54b37f88bd1b65aeb9bb576edaa7b8d0b4035
dabfe5e004cb6e7cbaf2aa26f9ab0d80104a898c7523904b0f6d3b658d38a4fe
de9485aee0805fc555984a4286697dccb8a9762fa9240c6a47b4dd478d282e74
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea0f02941083c346295eddf8118ad8f439fbb06eeb5da4d26ec180b228c0b110
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f4a2fb1bd486b246823cfb9750f25a4323a8f74c23968d4a6fcdd96a65511631
f927844e8c953560f5a67112c5dfaab926df93df57f3d8cd062028f1ca80b530