urlscan.io logo urlscan.io
SecurityTrails logo

www.bleepingcomputer.com Open in urlscan Pro
104.20.60.209  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://ejyazl.clicks.mlsend.com/te/cl/eyJ2Ijoie1wiYVwiOjEwOTEyMSxcImxcIjo2MjUyMTU1ODk0MzQwMTM0MixcInJcIjo2MjYxMDczMzY2MTE2MTE3NH...
Effective URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=news...
Submission: On August 05 via api from CA — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 119 IPs in 8 countries across 120 domains to perform 468 HTTP transactions. The main IP is 104.20.60.209, located in and belongs to CLOUDFLARENET, US. The main domain is www.bleepingcomputer.com. The Cisco Umbrella rank of the primary domain is 58080.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 11th 2022. Valid for: a year.
This is the only time www.bleepingcomputer.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700::68... 13335 (CLOUDFLAR...)
1 104.20.60.209 13335 (CLOUDFLAR...)
2 2607:f8b0:400... 15169 (GOOGLE)
32 104.26.13.6 13335 (CLOUDFLAR...)
5 2606:4700:20:... 13335 (CLOUDFLAR...)
2 2607:f8b0:400... 15169 (GOOGLE)
1 3 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
16 2607:f8b0:400... 15169 (GOOGLE)
7 23.208.216.126 16625 (AKAMAI-AS)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 18 151.101.194.137 54113 (FASTLY)
1 108.138.106.5 16509 (AMAZON-02)
6 52.85.61.114 16509 (AMAZON-02)
6 2607:f8b0:400... 15169 (GOOGLE)
1 142.251.40.166 15169 (GOOGLE)
1 184.29.129.105 16625 (AKAMAI-AS)
3 2607:f8b0:400... 15169 (GOOGLE)
1 184.29.129.187 16625 (AKAMAI-AS)
5 35.201.71.192 15169 (GOOGLE)
1 3 108.138.106.4 16509 (AMAZON-02)
7 2607:f8b0:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
8 142.250.64.66 15169 (GOOGLE)
3 151.101.66.137 54113 (FASTLY)
1 35.241.45.217 15169 (GOOGLE)
2 151.101.1.194 54113 (FASTLY)
3 2607:f8b0:400... 15169 (GOOGLE)
1 1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
2 184.29.129.7 16625 (AKAMAI-AS)
1 2607:f8b0:400... 15169 (GOOGLE)
3 2607:f8b0:400... 15169 (GOOGLE)
2 151.101.193.140 54113 (FASTLY)
3 3.143.83.164 16509 (AMAZON-02)
2 3 104.18.19.126 13335 (CLOUDFLAR...)
6 6 54.146.59.225 14618 (AMAZON-AES)
14 15 52.223.40.198 16509 (AMAZON-02)
3 3 68.67.160.75 29990 (ASN-APPNEX)
3 3 23.3.125.24 16625 (AKAMAI-AS)
10 23.1.200.83 16625 (AKAMAI-AS)
1 1 35.186.193.173 15169 (GOOGLE)
4 9 35.190.60.146 15169 (GOOGLE)
2 2 192.35.249.127 11742 (SPOTX-IAD)
1 3.128.4.146 16509 (AMAZON-02)
7 13 68.67.160.24 29990 (ASN-APPNEX)
2 104.36.115.98 62713 (AS-PUBMATIC)
1 74.119.119.129 19750 (AS-CRITEO)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
2 35.227.238.208 15169 (GOOGLE)
1 2600:9000:220... 16509 (AMAZON-02)
4 108.138.109.24 16509 (AMAZON-02)
2 3.230.217.116 14618 (AMAZON-AES)
2 4 2620:116:800b... 27281 (QUANTCAST)
1 184.29.129.81 16625 (AKAMAI-AS)
1 35.211.165.199 19527 (GOOGLE-2)
1 34.195.22.64 14618 (AMAZON-AES)
4 52.201.176.252 14618 (AMAZON-AES)
4 34.236.83.94 14618 (AMAZON-AES)
3 27 104.18.18.126 13335 (CLOUDFLAR...)
2 54.225.229.70 14618 (AMAZON-AES)
1 34.107.148.139 15169 (GOOGLE)
1 5 34.98.64.218 15169 (GOOGLE)
2 34.225.50.230 14618 (AMAZON-AES)
1 2602:803:c002... 26667 (RUBICONPR...)
1 34.149.20.76 15169 (GOOGLE)
1 108.138.106.62 16509 (AMAZON-02)
1 23.217.153.125 16625 (AKAMAI-AS)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
1 2600:9000:220... 16509 (AMAZON-02)
1 2 52.72.103.54 14618 (AMAZON-AES)
1 162.19.138.120 16276 (OVH)
1 52.85.61.52 16509 (AMAZON-02)
2 141.95.98.71 16276 (OVH)
6 2607:f8b0:400... 15169 (GOOGLE)
1 34.102.146.192 396982 (GOOGLE-CL...)
1 2620:100:a001::4 19750 (AS-CRITEO)
1 108.138.128.34 16509 (AMAZON-02)
3 27 172.66.41.9 13335 (CLOUDFLAR...)
1 34.120.135.53 396982 (GOOGLE-CL...)
2 5 2620:100:a001::c 19750 (AS-CRITEO)
2 21 209.54.182.161 16509 (AMAZON-02)
5 5 151.101.194.49 54113 (FASTLY)
2 17 35.244.159.8 15169 (GOOGLE)
3 8 2600:1f13:d60... 16509 (AMAZON-02)
21 32 142.251.40.162 15169 (GOOGLE)
3 74.119.119.139 19750 (AS-CRITEO)
1 3 67.202.105.31 32748 (STEADFAST)
1 3 51.222.39.185 16276 (OVH)
14 14 8.28.7.82 62713 (AS-PUBMATIC)
9 9 8.28.7.83 62713 (AS-PUBMATIC)
4 8 104.36.115.114 62713 (AS-PUBMATIC)
5 8 107.178.246.49 15169 (GOOGLE)
8 9 52.45.33.138 14618 (AMAZON-AES)
7 7 199.127.204.142 26120 (RHYTHMONE)
8 8 64.202.112.63 23352 (SERVERCEN...)
5 5 184.50.205.90 16625 (AKAMAI-AS)
5 12 35.71.139.29 16509 (AMAZON-02)
1 34.252.120.220 16509 (AMAZON-02)
2 2 54.86.39.214 14618 (AMAZON-AES)
1 1 34.197.236.209 14618 (AMAZON-AES)
3 4 63.251.86.49 10913 (INTERNAP-BLK)
5 5 199.38.167.128 54312 (ROCKETFUEL)
13 13 67.202.105.21 32748 (STEADFAST)
1 2 52.85.61.71 16509 (AMAZON-02)
1 108.139.29.15 16509 (AMAZON-02)
3 3 75.126.248.142 36351 (SOFTLAYER)
8 54.161.197.14 14618 (AMAZON-AES)
1 1 199.187.193.181 47043 (SMARTADSE...)
12 12 2606:ae80:147... 26762 (CNVR-US-EAST)
4 3.66.208.67 16509 (AMAZON-02)
4 184.29.128.213 16625 (AKAMAI-AS)
1 52.205.90.144 14618 (AMAZON-AES)
3 198.148.27.140 19189 (PULSEPOINT)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 1 3.142.67.21 16509 (AMAZON-02)
1 2607:f8b0:400... 15169 (GOOGLE)
14 16 35.211.178.172 15169 (GOOGLE)
1 1 204.62.13.72 46636 (NATCOWEB)
11 34.117.239.71 15169 (GOOGLE)
7 7 216.200.232.253 30419 (MEDIAMATH...)
4 4 2620:112:f002... 6336 (TURN-US-ASN)
3 3 54.157.83.177 14618 (AMAZON-AES)
1 1 23.21.31.186 14618 (AMAZON-AES)
2 2 192.132.33.46 18568 (BIDTELLECT)
3 23.92.190.69 29791 (VOXEL-DOT...)
1 1 213.19.162.90 26667 (RUBICONPR...)
3 3 35.207.24.140 15169 (GOOGLE)
1 1 34.102.163.6 15169 (GOOGLE)
2 2 54.85.233.220 14618 (AMAZON-AES)
3 3 3.82.84.88 14618 (AMAZON-AES)
1 1 8.43.72.98 26667 (RUBICONPR...)
2 8.28.7.81 62713 (AS-PUBMATIC)
5 8 8.43.72.97 26667 (RUBICONPR...)
1 2001:4998:14:... 14777 (YAHOO)
1 52.95.126.160 16509 (AMAZON-02)
2 3 2620:1ec:21::14 8068 (MICROSOFT...)
11 2607:f8b0:400... 15169 (GOOGLE)
1 1 159.203.145.121 14061 (DIGITALOC...)
1 1 199.187.193.182 47043 (SMARTADSE...)
1 1 54.211.243.57 14618 (AMAZON-AES)
12 23.41.168.23 16625 (AKAMAI-AS)
1 151.101.193.108 54113 (FASTLY)
3 3 35.190.90.30 15169 (GOOGLE)
1 2 108.138.128.44 16509 (AMAZON-02)
1 2 104.18.101.194 13335 (CLOUDFLAR...)
2 2 35.211.141.197 19527 (GOOGLE-2)
1 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2 35.186.253.211 15169 (GOOGLE)
1 1 52.54.63.203 14618 (AMAZON-AES)
3 3 207.198.113.90 13768 (COGECO-PEER1)
4 4 107.178.254.65 15169 (GOOGLE)
2 2 34.98.67.3 15169 (GOOGLE)
1 169.197.150.7 398989 (DEEPINTENT)
3 4 185.167.164.42 198622 (ADFORM)
1 1 150.136.156.92 31898 (ORACLE-BM...)
1 18.215.195.104 14618 (AMAZON-AES)
1 6 23.205.72.10 16625 (AKAMAI-AS)
1 1 74.119.119.150 19750 (AS-CRITEO)
2 2 3.225.208.56 14618 (AMAZON-AES)
1 1 54.198.77.107 14618 (AMAZON-AES)
4 4 54.235.126.54 14618 (AMAZON-AES)
1 1 2620:112:f002... 6336 (TURN-US-ASN)
1 2600:1f18:444... 14618 (AMAZON-AES)
1 1 18.211.160.120 14618 (AMAZON-AES)
2 2 2606:4700:440... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 8.28.7.84 ()
468 119
1    2606:4700::6811:6bef (United States)

ASN13335 (CLOUDFLARENET, US)
ejyazl.clicks.mlsend.com
1    104.20.60.209 (None, )

ASN13335 (CLOUDFLARENET, US)
www.bleepingcomputer.com
2    2607:f8b0:4006:822::200a (New York, United States)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
32    104.26.13.6 (United States)

ASN13335 (CLOUDFLARENET, US)
www.bleepstatic.com
5    2606:4700:20::681a:18b (United States)

ASN13335 (CLOUDFLARENET, US)
a.pub.network
2    2607:f8b0:4006:824::2008 (New York, United States)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
3    2607:f8b0:4006:822::2004 (New York, United States)

ASN15169 (GOOGLE, US)
www.google.com
1    2607:f8b0:4006:820::2003 (New York, United States)

ASN15169 (GOOGLE, US)
www.gstatic.com
16    2607:f8b0:4006:81d::2002 (New York, United States)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
7    23.208.216.126 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-208-216-126.deploy.static.akamaitechnologies.com
s9.addthis.com
v1.addthisedge.com
m.addthis.com
s7.addthis.com
api-public.addthis.com
1    2606:4700:440e::6812:2fe6 (United States)

ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com
18    151.101.194.137 (United States)

ASN54113 (FASTLY, US)
cd.connatix.com
cds.connatix.com
capi.connatix.com
img.connatix.com
cks.connatix.com
1    108.138.106.5 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-106-5.jfk50.r.cloudfront.net
ecdn.analysis.fi
6    52.85.61.114 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-114.ewr53.r.cloudfront.net
ecdn.firstimpression.io
cdn.firstimpression.io
6    2607:f8b0:4006:806::2003 (New York, United States)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    142.251.40.166 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s81-in-f6.1e100.net
ad.doubleclick.net
1    184.29.129.105 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-29-129-105.deploy.static.akamaitechnologies.com
widgets.outbrain.com
3    2607:f8b0:4006:80b::200e (New York, United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    184.29.129.187 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-29-129-187.deploy.static.akamaitechnologies.com
z.moatads.com
5    35.201.71.192 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 192.71.201.35.bc.googleusercontent.com
d.pub.network
c.pub.network
3    108.138.106.4 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-106-4.jfk50.r.cloudfront.net
sb.scorecardresearch.com
7    2607:f8b0:4006:806::2002 (New York, United States)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
adservice.google.ca
1    2606:4700::6810:5614 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
8    142.250.64.66 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s30-in-f2.1e100.net
securepubads.g.doubleclick.net
partner.googleadservices.com
3    151.101.66.137 (United States)

ASN54113 (FASTLY, US)
ins.connatix.com
vid.connatix.com
1    35.241.45.217 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 217.45.241.35.bc.googleusercontent.com
pghub.io
2    151.101.1.194 (United States)

ASN54113 (FASTLY, US)
confiant-integrations.global.ssl.fastly.net
3    2607:f8b0:4006:81f::2002 (New York, United States)

ASN15169 (GOOGLE, US)
www.googletagservices.com
1    2606:4700:20::681a:832 (United States)

ASN13335 (CLOUDFLARENET, US)
freestar-io.videoplayerhub.com
1    2606:4700:20::681a:68b (United States)

ASN13335 (CLOUDFLARENET, US)
btloader.com
2    184.29.129.7 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-29-129-7.deploy.static.akamaitechnologies.com
js-sec.indexww.com
1    2607:f8b0:4006:809::2002 (New York, United States)

ASN15169 (GOOGLE, US)
adservice.google.ca
3    2607:f8b0:4006:80c::2002 (New York, United States)

ASN15169 (GOOGLE, US)
adservice.google.com
2    151.101.193.140 (United States)

ASN54113 (FASTLY, US)
www.reddit.com
3    3.143.83.164 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-143-83-164.us-east-2.compute.amazonaws.com
capi-tier-1-us-east-2.connatix.com
3    104.18.19.126 (None, )

ASN13335 (CLOUDFLARENET, US)
ssum.casalemedia.com
as-sec.casalemedia.com
6    54.146.59.225 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-146-59-225.compute-1.amazonaws.com
match.prod.bidr.io
15    52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
match.adsrvr.org
data.adsrvr.org
3    68.67.160.75 (New York, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
secure.adnxs.com
3    23.3.125.24 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-3-125-24.deploy.static.akamaitechnologies.com
secure-assets.rubiconproject.com
10    23.1.200.83 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-1-200-83.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
1    35.186.193.173 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com
i.ctnsnet.com
9    35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com
id.rlcdn.com
idsync.rlcdn.com
2    192.35.249.127 (Ashburn, United States)

ASN11742 (SPOTX-IAD, US)
sync.search.spotxchange.com
1    3.128.4.146 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-128-4-146.us-east-2.compute.amazonaws.com
tv.springserve.com
13    68.67.160.24 (New York, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
ib.adnxs.com
2    104.36.115.98 (United States)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
1    74.119.119.129 (United States)

ASN19750 (AS-CRITEO, US)
PTR: bidder.va1.vip.prod.criteo.com
bidder.criteo.com
2    2606:4700:20::681a:246 (United States)

ASN13335 (CLOUDFLARENET, US)
ad-delivery.net
2    35.227.238.208 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 208.238.227.35.bc.googleusercontent.com
api.floors.dev
1    2600:9000:2209:8c00:15:6f6c:b180:93a1 (United States)

ASN16509 (AMAZON-02, US)
vpaid.springserve.com
4    108.138.109.24 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-109-24.jfk50.r.cloudfront.net
c.amazon-adsystem.com
2    3.230.217.116 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-230-217-116.compute-1.amazonaws.com
c2shb.pubgw.yahoo.com
4    2620:116:800b:21:b08a:1dc5:659b:4055 (United States)

ASN27281 (QUANTCAST, US)
secure.quantserve.com
pixel.quantserve.com
1    184.29.129.81 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-29-129-81.deploy.static.akamaitechnologies.com
s.ntv.io
1    35.211.165.199 (North Charleston, United States)

ASN19527 (GOOGLE-2, US)
PTR: 199.165.211.35.bc.googleusercontent.com
grid.bidswitch.net
1    34.195.22.64 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-195-22-64.compute-1.amazonaws.com
tlx.3lift.com
4    52.201.176.252 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-201-176-252.compute-1.amazonaws.com
ads.yieldmo.com
4    34.236.83.94 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-236-83-94.compute-1.amazonaws.com
c2shb.pubgw.yahoo.com
c2shb.ssp.yahoo.com
27    104.18.18.126 (None, )

ASN13335 (CLOUDFLARENET, US)
htlb.casalemedia.com
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
dsum.casalemedia.com
r.casalemedia.com
2    54.225.229.70 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-225-229-70.compute-1.amazonaws.com
c.deployads.com
1    34.107.148.139 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 139.148.107.34.bc.googleusercontent.com
prebid.media.net
5    34.98.64.218 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com
freestar-d.openx.net
google-bidout-d.openx.net
us-u.openx.net
u.openx.net
eu-u.openx.net
2    34.225.50.230 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-225-50-230.compute-1.amazonaws.com
btlr.sharethrough.com
1    2602:803:c002:200::42 (United States)

ASN26667 (RUBICONPROJECT, US)
fastlane.rubiconproject.com
1    34.149.20.76 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 76.20.149.34.bc.googleusercontent.com
ssc.33across.com
1    108.138.106.62 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-106-62.jfk50.r.cloudfront.net
ats.rlcdn.com
1    23.217.153.125 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-217-153-125.deploy.static.akamaitechnologies.com
secure.cdn.fastclick.net
2    2606:4700:10::6816:3456 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.id5-sync.com
1    2600:9000:2209:f800:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
rules.quantcount.com
2    52.72.103.54 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-103-54.compute-1.amazonaws.com
jadserve.postrelease.com
1    162.19.138.120 (France)

ASN16276 (OVH, FR)
PTR: ns31533571.ip-162-19-138.eu
lb.eu-1-id5-sync.com
1    52.85.61.52 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-52.ewr53.r.cloudfront.net
geo.privacymanager.io
2    141.95.98.71 (France)

ASN16276 (OVH, FR)
PTR: ns3216577.ip-141-95-98.eu
id5-sync.com
6    2607:f8b0:4006:817::2001 (New York, United States)

ASN15169 (GOOGLE, US)
123a2100834ae971547f5f25bc6644f9.safeframe.googlesyndication.com
tpc.googlesyndication.com
1    34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com
oa.openxcdn.net
1    2620:100:a001::4 (United States)

ASN19750 (AS-CRITEO, US)
static.criteo.net
1    108.138.128.34 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-128-34.jfk50.r.cloudfront.net
tags.crwdcntrl.net
27    172.66.41.9 (United States)

ASN13335 (CLOUDFLARENET, US)
resources.infolinks.com
router.infolinks.com
rt3055.infolinks.com
1    34.120.135.53 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 53.135.120.34.bc.googleusercontent.com
oajs.openx.net
5    2620:100:a001::c (United States)

ASN19750 (AS-CRITEO, US)
gum.criteo.com
21    209.54.182.161 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
5    151.101.194.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
17    35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com
us-u.openx.net
8    2600:1f13:d60:4f01:bbc5:ac74:cf42:940a (Boardman, United States)

ASN16509 (AMAZON-02, US)
pr-bh.ybp.yahoo.com
32    142.251.40.162 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s81-in-f2.1e100.net
cm.g.doubleclick.net
googleads4.g.doubleclick.net
3    74.119.119.139 (United States)

ASN19750 (AS-CRITEO, US)
mug.criteo.com
3    67.202.105.31 (United States)

ASN32748 (STEADFAST, US)
PTR: ip31.67-202-105.static.steadfastdns.net
de.tynt.com
hde.tynt.com
3    51.222.39.185 (Canada)

ASN16276 (OVH, FR)
PTR: ip185.ip-51-222-39.net
onetag-sys.com
14    8.28.7.82 (United States)

ASN62713 (AS-PUBMATIC, US)
image8.pubmatic.com
9    8.28.7.83 (United States)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
simage2.pubmatic.com
8    104.36.115.114 (United States)

ASN62713 (AS-PUBMATIC, US)
image4.pubmatic.com
8    107.178.246.49 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 49.246.178.107.bc.googleusercontent.com
pixel.tapad.com
9    52.45.33.138 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-33-138.compute-1.amazonaws.com
ups.analytics.yahoo.com
7    199.127.204.142 (United States)

ASN26120 (RHYTHMONE, US)
sync.1rx.io
sync.targeting.unrulymedia.com
8    64.202.112.63 (Leesburg, United States)

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com
b1sync.zemanta.com
5    184.50.205.90 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-50-205-90.deploy.static.akamaitechnologies.com
stags.bluekai.com
tags.bluekai.com
12    35.71.139.29 (United States)

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com
eb2.3lift.com
1    34.252.120.220 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-252-120-220.eu-west-1.compute.amazonaws.com
s.cpx.to
2    54.86.39.214 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-86-39-214.compute-1.amazonaws.com
ad.360yield.com
1    34.197.236.209 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-197-236-209.compute-1.amazonaws.com
pixel.advertising.com
4    63.251.86.49 (United States)

ASN10913 (INTERNAP-BLK, US)
ap.lijit.com
5    199.38.167.128 (United States)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
13    67.202.105.21 (United States)

ASN32748 (STEADFAST, US)
PTR: ip21.67-202-105.static.steadfastdns.net
ssc-cms.33across.com
2    52.85.61.71 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-71.ewr53.r.cloudfront.net
sync.intentiq.com
sync1.intentiq.com
1    108.139.29.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-29-15.jfk50.r.cloudfront.net
api.intentiq.com
3    75.126.248.142 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 8e.f8.7e4b.ip4.static.sl-reverse.com
um.simpli.fi
8    54.161.197.14 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-161-197-14.compute-1.amazonaws.com
sync.bfmio.com
1    199.187.193.181 (Canada)

ASN47043 (SMARTADSERVER, CA)
ssbsync-us.smartadserver.com
12    2606:ae80:1471:15::440 (United States)

ASN26762 (CNVR-US-EAST, US)
amazon-tam-match.dotomi.com
33across-match.dotomi.com
pulsepoint-match.dotomi.com
yieldmo-match.dotomi.com
medianet-match.dotomi.com
casale-match.dotomi.com
4    3.66.208.67 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-66-208-67.eu-central-1.compute.amazonaws.com
match.sharethrough.com
4    184.29.128.213 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-29-128-213.deploy.static.akamaitechnologies.com
ads.pubmatic.com
1    52.205.90.144 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-90-144.compute-1.amazonaws.com
sync-amz.ads.yieldmo.com
3    198.148.27.140 (New York, United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
1    2606:4700:20::ac43:4a81 (United States)

ASN13335 (CLOUDFLARENET, US)
ad4m.at
1    3.142.67.21 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-142-67-21.us-east-2.compute.amazonaws.com
sync.adotmob.com
1    2607:f8b0:4006:820::200a (New York, United States)

ASN15169 (GOOGLE, US)
imasdk.googleapis.com
16    35.211.178.172 (North Charleston, United States)

ASN15169 (GOOGLE, US)
PTR: 172.178.211.35.bc.googleusercontent.com
x.bidswitch.net
1    204.62.13.72 (Clifton, United States)

ASN46636 (NATCOWEB, US)
inv-nets.admixer.net
11    34.117.239.71 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 71.239.117.34.bc.googleusercontent.com
events-ssc.33across.com
cms-xch-chicago.33across.com
7    216.200.232.253 (Frederick, United States)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
4    2620:112:f002:bbbb::21 (United States)

ASN6336 (TURN-US-ASN, US)
ad.turn.com
3    54.157.83.177 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-157-83-177.compute-1.amazonaws.com
pm.w55c.net
1    23.21.31.186 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-21-31-186.compute-1.amazonaws.com
nep.advangelists.com
2    192.132.33.46 (United States)

ASN18568 (BIDTELLECT, US)
PTR: 46.bidtellect.com
bttrack.com
3    23.92.190.69 (United States)

ASN29791 (VOXEL-DOT-NET, US)
ce.lijit.com
1    213.19.162.90 (United Kingdom)

ASN26667 (RUBICONPROJECT, US)
pixel-eu.rubiconproject.com
3    35.207.24.140 (North Charleston, United States)

ASN15169 (GOOGLE, US)
PTR: 140.24.207.35.bc.googleusercontent.com
rtb.mfadsrvr.com
1    34.102.163.6 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 6.163.102.34.bc.googleusercontent.com
ad.mrtnsvr.com
2    54.85.233.220 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-85-233-220.compute-1.amazonaws.com
vop.sundaysky.com
3    3.82.84.88 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-82-84-88.compute-1.amazonaws.com
sync.srv.stackadapt.com
1    8.43.72.98 (United States)

ASN26667 (RUBICONPROJECT, US)
pixel-us-east.rubiconproject.com
2    8.28.7.81 (United States)

ASN62713 (AS-PUBMATIC, US)
image6.pubmatic.com
8    8.43.72.97 (United States)

ASN26667 (RUBICONPROJECT, US)
token.rubiconproject.com
pixel.rubiconproject.com
1    2001:4998:14:800::1001 (United States)

ASN14777 (YAHOO, US)
ads.yahoo.com
1    52.95.126.160 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
aax-eu.amazon-adsystem.com
3    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
11    2607:f8b0:4006:80e::2006 (New York, United States)

ASN15169 (GOOGLE, US)
s0.2mdn.net
1    159.203.145.121 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
cs.chocolateplatform.com
1    199.187.193.182 (Canada)

ASN47043 (SMARTADSERVER, CA)
ssbsync.smartadserver.com
1    54.211.243.57 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-211-243-57.compute-1.amazonaws.com
beacon.lynx.cognitivlabs.com
12    23.41.168.23 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-41-168-23.deploy.static.akamaitechnologies.com
contextual.media.net
1    151.101.193.108 (United States)

ASN54113 (FASTLY, US)
acdn.adnxs.com
3    35.190.90.30 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 30.90.190.35.bc.googleusercontent.com
odr.mookie1.com
2    108.138.128.44 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-128-44.jfk50.r.cloudfront.net
aa.agkn.com
2    104.18.101.194 (None, )

ASN13335 (CLOUDFLARENET, US)
p.adsymptotic.com
2    35.211.141.197 (North Charleston, United States)

ASN19527 (GOOGLE-2, US)
PTR: 197.141.211.35.bc.googleusercontent.com
m.fg8dgt.com
1    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.bing.com
2    35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com
rtb.openx.net
1    52.54.63.203 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-63-203.compute-1.amazonaws.com
sync.ipredictive.com
3    207.198.113.90 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
pixel-sync.sitescout.com
4    107.178.254.65 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com
pippio.com
2    34.98.67.3 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 3.67.98.34.bc.googleusercontent.com
tags.rd.linksynergy.com
1    169.197.150.7 (United States)

ASN398989 (DEEPINTENT, US)
PTR: g.deepintent.com
match.deepintent.com
4    185.167.164.42 (Denmark)

ASN198622 (ADFORM, DK)
c1.adform.net
1    150.136.156.92 (Ashburn, United States)

ASN31898 (ORACLE-BMC-31898, US)
sync.technoratimedia.com
1    18.215.195.104 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-215-195-104.compute-1.amazonaws.com
rtb.adentifi.com
6    23.205.72.10 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-205-72-10.deploy.static.akamaitechnologies.com
hbx.media.net
cs.media.net
c21lg-d.media.net
1    74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)
dis.criteo.com
2    3.225.208.56 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-208-56.compute-1.amazonaws.com
t.pswec.com
1    54.198.77.107 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-198-77-107.compute-1.amazonaws.com
i.w55c.net
4    54.235.126.54 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-235-126-54.compute-1.amazonaws.com
i.liadm.com
1    2620:112:f002:bbbb::23 (United States)

ASN6336 (TURN-US-ASN, US)
d.turn.com
1    2600:1f18:444a:4602:377c:45e6:1b19:7050 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
i6.liadm.com
1    18.211.160.120 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-211-160-120.compute-1.amazonaws.com
aorta.clickagy.com
2    2606:4700:4400::6812:230b (United States)

ASN13335 (CLOUDFLARENET, US)
a.tribalfusion.com
s.tribalfusion.com
1    2606:4700::6812:c4c (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.indexww.com
1    8.28.7.84 (None, )

ASN- ()
simage4.pubmatic.com
Apex Domain
Subdomains		 Transfer
45 doubleclick.net
ad.doubleclick.net — Cisco Umbrella Rank: 214
googleads.g.doubleclick.net — Cisco Umbrella Rank: 55
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 222
cm.g.doubleclick.net — Cisco Umbrella Rank: 208
googleads4.g.doubleclick.net — Cisco Umbrella Rank: 313
253 KB
40 pubmatic.com
hbopenbid.pubmatic.com — Cisco Umbrella Rank: 518
image8.pubmatic.com — Cisco Umbrella Rank: 577
image2.pubmatic.com — Cisco Umbrella Rank: 869
image4.pubmatic.com — Cisco Umbrella Rank: 884
ads.pubmatic.com — Cisco Umbrella Rank: 496
image6.pubmatic.com — Cisco Umbrella Rank: 636
simage2.pubmatic.com — Cisco Umbrella Rank: 610
simage4.pubmatic.com
44 KB
32 bleepstatic.com
www.bleepstatic.com — Cisco Umbrella Rank: 95240
651 KB
30 casalemedia.com
ssum.casalemedia.com — Cisco Umbrella Rank: 1365
htlb.casalemedia.com — Cisco Umbrella Rank: 560 Failed
as-sec.casalemedia.com — Cisco Umbrella Rank: 1330
ssum-sec.casalemedia.com — Cisco Umbrella Rank: 453
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 530
dsum.casalemedia.com — Cisco Umbrella Rank: 1258
r.casalemedia.com — Cisco Umbrella Rank: 713
27 KB
27 infolinks.com
resources.infolinks.com — Cisco Umbrella Rank: 7198
router.infolinks.com — Cisco Umbrella Rank: 3377
rt3055.infolinks.com — Cisco Umbrella Rank: 81866
334 KB
26 amazon-adsystem.com
c.amazon-adsystem.com — Cisco Umbrella Rank: 323
s.amazon-adsystem.com — Cisco Umbrella Rank: 288
aax-eu.amazon-adsystem.com — Cisco Umbrella Rank: 1264
62 KB
25 33across.com
ssc.33across.com — Cisco Umbrella Rank: 1917
ssc-cms.33across.com — Cisco Umbrella Rank: 897
events-ssc.33across.com — Cisco Umbrella Rank: 1781
cms-xch-chicago.33across.com — Cisco Umbrella Rank: 6307
20 KB
25 openx.net
firstimpression-d.openx.net Failed
freestar-d.openx.net — Cisco Umbrella Rank: 7860
oajs.openx.net — Cisco Umbrella Rank: 3853
google-bidout-d.openx.net — Cisco Umbrella Rank: 3639
us-u.openx.net — Cisco Umbrella Rank: 396
u.openx.net — Cisco Umbrella Rank: 719
rtb.openx.net — Cisco Umbrella Rank: 1516
eu-u.openx.net — Cisco Umbrella Rank: 2047
5 KB
24 yahoo.com
c2shb.pubgw.yahoo.com — Cisco Umbrella Rank: 910
c2shb.ssp.yahoo.com — Cisco Umbrella Rank: 1033
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 474
ups.analytics.yahoo.com — Cisco Umbrella Rank: 277
ads.yahoo.com — Cisco Umbrella Rank: 2334
11 KB
24 rubiconproject.com
secure-assets.rubiconproject.com — Cisco Umbrella Rank: 1040
eus.rubiconproject.com — Cisco Umbrella Rank: 588
fastlane.rubiconproject.com — Cisco Umbrella Rank: 528 Failed
token.rubiconproject.com — Cisco Umbrella Rank: 707 Failed
pixel-eu.rubiconproject.com — Cisco Umbrella Rank: 2288
pixel-us-east.rubiconproject.com — Cisco Umbrella Rank: 954
pixel.rubiconproject.com — Cisco Umbrella Rank: 326
59 KB
24 connatix.com
cd.connatix.com — Cisco Umbrella Rank: 3596
cds.connatix.com — Cisco Umbrella Rank: 3700
capi.connatix.com — Cisco Umbrella Rank: 3936
ins.connatix.com — Cisco Umbrella Rank: 5078
capi-tier-1-us-east-2.connatix.com — Cisco Umbrella Rank: 4188
vid.connatix.com — Cisco Umbrella Rank: 4429
img.connatix.com — Cisco Umbrella Rank: 4278
cks.connatix.com — Cisco Umbrella Rank: 5012
508 KB
22 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 124
123a2100834ae971547f5f25bc6644f9.safeframe.googlesyndication.com
tpc.googlesyndication.com — Cisco Umbrella Rank: 160
444 KB
19 media.net
prebid.media.net — Cisco Umbrella Rank: 1356
contextual.media.net — Cisco Umbrella Rank: 526
hbx.media.net — Cisco Umbrella Rank: 1427
cs.media.net — Cisco Umbrella Rank: 1437
c21lg-d.media.net — Cisco Umbrella Rank: 1912
45 KB
17 bidswitch.net
grid.bidswitch.net — Cisco Umbrella Rank: 1170
x.bidswitch.net — Cisco Umbrella Rank: 292
7 KB
17 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 462
ib.adnxs.com — Cisco Umbrella Rank: 238
acdn.adnxs.com — Cisco Umbrella Rank: 584
44 KB
15 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 381
data.adsrvr.org — Cisco Umbrella Rank: 5939
8 KB
13 3lift.com
tlx.3lift.com — Cisco Umbrella Rank: 652
eb2.3lift.com — Cisco Umbrella Rank: 411
5 KB
12 dotomi.com
amazon-tam-match.dotomi.com — Cisco Umbrella Rank: 5702
33across-match.dotomi.com — Cisco Umbrella Rank: 4160
pulsepoint-match.dotomi.com — Cisco Umbrella Rank: 3426
yieldmo-match.dotomi.com — Cisco Umbrella Rank: 5434
medianet-match.dotomi.com — Cisco Umbrella Rank: 9806
casale-match.dotomi.com — Cisco Umbrella Rank: 3082
4 KB
11 2mdn.net
s0.2mdn.net — Cisco Umbrella Rank: 289
240 KB
10 criteo.com
bidder.criteo.com — Cisco Umbrella Rank: 732
gum.criteo.com — Cisco Umbrella Rank: 401
mug.criteo.com — Cisco Umbrella Rank: 2755
dis.criteo.com — Cisco Umbrella Rank: 699
10 KB
10 rlcdn.com
id.rlcdn.com — Cisco Umbrella Rank: 611
ats.rlcdn.com — Cisco Umbrella Rank: 1366
api.rlcdn.com Failed
idsync.rlcdn.com — Cisco Umbrella Rank: 309
111 KB
10 pub.network
a.pub.network — Cisco Umbrella Rank: 6132
d.pub.network — Cisco Umbrella Rank: 6365
c.pub.network — Cisco Umbrella Rank: 6399
393 KB
8 bfmio.com
sync.bfmio.com — Cisco Umbrella Rank: 1558
4 KB
8 zemanta.com
b1sync.zemanta.com — Cisco Umbrella Rank: 551
5 KB
8 tapad.com
pixel.tapad.com — Cisco Umbrella Rank: 469
1 KB
7 mathtag.com
sync.mathtag.com — Cisco Umbrella Rank: 484
4 KB
7 lijit.com
ap.lijit.com — Cisco Umbrella Rank: 679 Failed
ce.lijit.com — Cisco Umbrella Rank: 960
7 KB
7 gstatic.com
www.gstatic.com
fonts.gstatic.com
100 KB
6 sharethrough.com
btlr.sharethrough.com — Cisco Umbrella Rank: 1301
match.sharethrough.com — Cisco Umbrella Rank: 521
2 KB
6 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 494
3 KB
6 firstimpression.io
ecdn.firstimpression.io — Cisco Umbrella Rank: 18569
cdn.firstimpression.io — Cisco Umbrella Rank: 18940
314 KB
6 addthis.com
s9.addthis.com — Cisco Umbrella Rank: 145037
m.addthis.com — Cisco Umbrella Rank: 1429
s7.addthis.com — Cisco Umbrella Rank: 1505 Failed
api-public.addthis.com — Cisco Umbrella Rank: 4330
218 KB
6 google.com
www.google.com — Cisco Umbrella Rank: 10
adservice.google.com — Cisco Umbrella Rank: 98
2 KB
5 liadm.com
i.liadm.com — Cisco Umbrella Rank: 576
i6.liadm.com — Cisco Umbrella Rank: 1609
3 KB
5 turn.com
ad.turn.com — Cisco Umbrella Rank: 791
d.turn.com — Cisco Umbrella Rank: 987
2 KB
5 rfihub.com
p.rfihub.com — Cisco Umbrella Rank: 741
4 KB
5 bluekai.com
stags.bluekai.com — Cisco Umbrella Rank: 495
tags.bluekai.com — Cisco Umbrella Rank: 508
4 KB
5 1rx.io
sync.1rx.io — Cisco Umbrella Rank: 550
4 KB
5 everesttech.net
sync-tm.everesttech.net — Cisco Umbrella Rank: 623
1 KB
5 yieldmo.com
ads.yieldmo.com — Cisco Umbrella Rank: 701
sync-amz.ads.yieldmo.com — Cisco Umbrella Rank: 6373
2 KB
4 adform.net
c1.adform.net — Cisco Umbrella Rank: 603
2 KB
4 pippio.com
pippio.com — Cisco Umbrella Rank: 753
1 KB
4 w55c.net
pm.w55c.net — Cisco Umbrella Rank: 784
i.w55c.net — Cisco Umbrella Rank: 1782
3 KB
4 id5-sync.com
cdn.id5-sync.com — Cisco Umbrella Rank: 1443
id5-sync.com — Cisco Umbrella Rank: 541
26 KB
4 quantserve.com
secure.quantserve.com — Cisco Umbrella Rank: 983
pixel.quantserve.com — Cisco Umbrella Rank: 465
11 KB
3 sitescout.com
pixel-sync.sitescout.com — Cisco Umbrella Rank: 597
2 KB
3 mookie1.com
odr.mookie1.com — Cisco Umbrella Rank: 925
810 B
3 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 361
1 KB
3 stackadapt.com
sync.srv.stackadapt.com — Cisco Umbrella Rank: 749
1 KB
3 mfadsrvr.com
rtb.mfadsrvr.com — Cisco Umbrella Rank: 886
1 KB
3 contextweb.com
bh.contextweb.com — Cisco Umbrella Rank: 531
3 KB
3 simpli.fi
um.simpli.fi — Cisco Umbrella Rank: 826
1 KB
3 intentiq.com
sync.intentiq.com — Cisco Umbrella Rank: 1350
sync1.intentiq.com — Cisco Umbrella Rank: 4010
api.intentiq.com — Cisco Umbrella Rank: 1962
3 KB
3 onetag-sys.com
onetag-sys.com — Cisco Umbrella Rank: 792
1 KB
3 tynt.com
de.tynt.com — Cisco Umbrella Rank: 1523
hde.tynt.com — Cisco Umbrella Rank: 4911
6 KB
3 google.ca
adservice.google.ca — Cisco Umbrella Rank: 12886
1 KB
3 indexww.com
js-sec.indexww.com — Cisco Umbrella Rank: 592
cdn.indexww.com — Cisco Umbrella Rank: 1470
15 KB
3 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 187
114 KB
3 scorecardresearch.com
sb.scorecardresearch.com — Cisco Umbrella Rank: 145
3 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 52
20 KB
3 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 67
imasdk.googleapis.com — Cisco Umbrella Rank: 448 Failed
127 KB
2 tribalfusion.com
a.tribalfusion.com — Cisco Umbrella Rank: 804
s.tribalfusion.com — Cisco Umbrella Rank: 2199
1 KB
2 pswec.com
t.pswec.com — Cisco Umbrella Rank: 3999
1 KB
2 linksynergy.com
tags.rd.linksynergy.com — Cisco Umbrella Rank: 3841
691 B
2 fg8dgt.com
m.fg8dgt.com — Cisco Umbrella Rank: 4960
773 B
2 adsymptotic.com
p.adsymptotic.com — Cisco Umbrella Rank: 428
551 B
2 agkn.com
aa.agkn.com — Cisco Umbrella Rank: 451
1 KB
2 sundaysky.com
vop.sundaysky.com — Cisco Umbrella Rank: 2548
1 KB
2 bttrack.com
bttrack.com — Cisco Umbrella Rank: 736
1 KB
2 smartadserver.com
ssbsync-us.smartadserver.com — Cisco Umbrella Rank: 6345
ssbsync.smartadserver.com — Cisco Umbrella Rank: 924
693 B
2 360yield.com
ad.360yield.com — Cisco Umbrella Rank: 649
646 B
2 unrulymedia.com
sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1056
1 KB
2 postrelease.com
jadserve.postrelease.com — Cisco Umbrella Rank: 1375
1 KB
2 deployads.com
c.deployads.com — Cisco Umbrella Rank: 4137
1 KB
2 floors.dev
api.floors.dev — Cisco Umbrella Rank: 7520
5 KB
2 ad-delivery.net
ad-delivery.net — Cisco Umbrella Rank: 1324
1 KB
2 springserve.com
tv.springserve.com — Cisco Umbrella Rank: 25550
vpaid.springserve.com — Cisco Umbrella Rank: 8972
90 KB
2 spotxchange.com
sync.search.spotxchange.com — Cisco Umbrella Rank: 516
1 KB
2 reddit.com
www.reddit.com — Cisco Umbrella Rank: 2881
3 KB
2 fastly.net
confiant-integrations.global.ssl.fastly.net — Cisco Umbrella Rank: 1354
78 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 94
115 KB
1 clickagy.com
aorta.clickagy.com — Cisco Umbrella Rank: 1604
433 B
1 adentifi.com
rtb.adentifi.com — Cisco Umbrella Rank: 1251
1 technoratimedia.com
sync.technoratimedia.com — Cisco Umbrella Rank: 1111
786 B
1 deepintent.com
match.deepintent.com — Cisco Umbrella Rank: 903
222 B
1 ipredictive.com
sync.ipredictive.com — Cisco Umbrella Rank: 1038
469 B
1 bing.com
c.bing.com — Cisco Umbrella Rank: 195
669 B
1 cognitivlabs.com
beacon.lynx.cognitivlabs.com — Cisco Umbrella Rank: 1445
491 B
1 chocolateplatform.com
cs.chocolateplatform.com — Cisco Umbrella Rank: 1836
393 B
1 mrtnsvr.com
ad.mrtnsvr.com — Cisco Umbrella Rank: 2659
241 B
1 advangelists.com
nep.advangelists.com — Cisco Umbrella Rank: 2373
232 B
1 admixer.net
inv-nets.admixer.net — Cisco Umbrella Rank: 2584
586 B
1 adotmob.com
sync.adotmob.com — Cisco Umbrella Rank: 1387
706 B
1 ad4m.at
ad4m.at — Cisco Umbrella Rank: 2303
1 advertising.com
pixel.advertising.com — Cisco Umbrella Rank: 871
191 B
1 cpx.to
s.cpx.to — Cisco Umbrella Rank: 2299
945 B
1 crwdcntrl.net
tags.crwdcntrl.net — Cisco Umbrella Rank: 1275
bcp.crwdcntrl.net — Cisco Umbrella Rank: 834 Failed
sync.crwdcntrl.net Failed
id.crwdcntrl.net Failed
29 KB
1 criteo.net
static.criteo.net — Cisco Umbrella Rank: 627
13 KB
1 openxcdn.net
oa.openxcdn.net — Cisco Umbrella Rank: 4006
8 KB
1 privacymanager.io
geo.privacymanager.io — Cisco Umbrella Rank: 1424
594 B
1 eu-1-id5-sync.com
lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 1685
338 B
1 quantcount.com
rules.quantcount.com — Cisco Umbrella Rank: 953
1 KB
1 fastclick.net
secure.cdn.fastclick.net — Cisco Umbrella Rank: 1620
17 KB
1 ntv.io
s.ntv.io — Cisco Umbrella Rank: 2841
135 KB
1 ctnsnet.com
i.ctnsnet.com — Cisco Umbrella Rank: 2957
451 B
1 googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 862
473 B
1 btloader.com
btloader.com — Cisco Umbrella Rank: 1206
42 KB
1 videoplayerhub.com
freestar-io.videoplayerhub.com — Cisco Umbrella Rank: 7274
535 B
1 pghub.io
pghub.io — Cisco Umbrella Rank: 1809
4 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 423
10 KB
1 addthisedge.com
v1.addthisedge.com — Cisco Umbrella Rank: 1674
855 B
1 moatads.com
z.moatads.com — Cisco Umbrella Rank: 442
1 KB
1 outbrain.com
widgets.outbrain.com — Cisco Umbrella Rank: 1157
3 KB
1 analysis.fi
ecdn.analysis.fi — Cisco Umbrella Rank: 22367
5 KB
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 1249
5 KB
1 bleepingcomputer.com
www.bleepingcomputer.com — Cisco Umbrella Rank: 58080
16 KB
1 mlsend.com
ejyazl.clicks.mlsend.com
747 B
0 inmobi.com Failed
sync.inmobi.com Failed
0 sonobi.com Failed
sync.go.sonobi.com Failed
0 emxdgt.com Failed
hb.emxdgt.com Failed
468 120
Domain Requested by
32 www.bleepstatic.com www.bleepingcomputer.com
www.bleepstatic.com
30 cm.g.doubleclick.net 21 redirects google-bidout-d.openx.net
googleads.g.doubleclick.net
www.bleepingcomputer.com
eb2.3lift.com
21 s.amazon-adsystem.com 2 redirects c.amazon-adsystem.com
s.amazon-adsystem.com
ssum-sec.casalemedia.com
bh.contextweb.com
ap.lijit.com
sync-amz.ads.yieldmo.com
eus.rubiconproject.com
www.bleepingcomputer.com
eb2.3lift.com
us-u.openx.net
contextual.media.net
18 dsum-sec.casalemedia.com 2 redirects ssum-sec.casalemedia.com
googleads.g.doubleclick.net
18 us-u.openx.net 2 redirects google-bidout-d.openx.net
a.pub.network
us-u.openx.net
de.tynt.com
18 router.infolinks.com 3 redirects resources.infolinks.com
router.infolinks.com
ssum-sec.casalemedia.com
16 x.bidswitch.net 14 redirects sync-amz.ads.yieldmo.com
www.bleepingcomputer.com
16 pagead2.googlesyndication.com www.bleepingcomputer.com
pagead2.googlesyndication.com
blank
googleads.g.doubleclick.net
tpc.googlesyndication.com
www.googletagservices.com
14 image8.pubmatic.com 14 redirects
14 match.adsrvr.org 13 redirects a.pub.network
13 ssc-cms.33across.com 13 redirects
13 ib.adnxs.com 7 redirects ecdn.firstimpression.io
a.pub.network
sync-amz.ads.yieldmo.com
googleads.g.doubleclick.net
acdn.adnxs.com
12 contextual.media.net a.pub.network
contextual.media.net
eus.rubiconproject.com
12 eb2.3lift.com 5 redirects a.pub.network
eb2.3lift.com
11 s0.2mdn.net googleads.g.doubleclick.net
www.bleepingcomputer.com
s0.2mdn.net
10 events-ssc.33across.com hde.tynt.com
eus.rubiconproject.com
de.tynt.com
us-u.openx.net
10 eus.rubiconproject.com cd.connatix.com
eus.rubiconproject.com
s.amazon-adsystem.com
hde.tynt.com
a.pub.network
contextual.media.net
9 ups.analytics.yahoo.com 8 redirects us-u.openx.net
8 sync.bfmio.com s.amazon-adsystem.com
sync.bfmio.com
8 b1sync.zemanta.com 8 redirects
8 pixel.tapad.com 5 redirects router.infolinks.com
us-u.openx.net
8 image4.pubmatic.com 4 redirects ads.pubmatic.com
8 pr-bh.ybp.yahoo.com 3 redirects google-bidout-d.openx.net
ssum-sec.casalemedia.com
www.bleepingcomputer.com
7 sync.mathtag.com 7 redirects
7 img.connatix.com www.bleepingcomputer.com
7 securepubads.g.doubleclick.net ecdn.firstimpression.io
securepubads.g.doubleclick.net
www.bleepingcomputer.com
6 resources.infolinks.com www.bleepingcomputer.com
router.infolinks.com
resources.infolinks.com
6 id.rlcdn.com 3 redirects www.bleepingcomputer.com
contextual.media.net
us-u.openx.net
6 match.prod.bidr.io 6 redirects
6 cks.connatix.com www.bleepingcomputer.com
6 fonts.gstatic.com fonts.googleapis.com
5 tpc.googlesyndication.com googleads.g.doubleclick.net
tpc.googlesyndication.com
pagead2.googlesyndication.com
www.bleepingcomputer.com
5 p.rfihub.com 5 redirects
5 sync.1rx.io 5 redirects
5 image2.pubmatic.com 5 redirects
5 ssum-sec.casalemedia.com 1 redirects router.infolinks.com
s.amazon-adsystem.com
ssum-sec.casalemedia.com
js-sec.indexww.com
5 sync-tm.everesttech.net 5 redirects
5 gum.criteo.com 2 redirects static.criteo.net
contextual.media.net
5 googleads.g.doubleclick.net pagead2.googlesyndication.com
googleads.g.doubleclick.net
5 a.pub.network www.bleepingcomputer.com
a.pub.network
4 i.liadm.com 4 redirects
4 simage2.pubmatic.com 4 redirects
4 c1.adform.net 3 redirects ads.pubmatic.com
4 pippio.com 4 redirects
4 pixel.rubiconproject.com 2 redirects eus.rubiconproject.com
4 ad.turn.com 4 redirects
4 ads.pubmatic.com s.amazon-adsystem.com
a.pub.network
ads.pubmatic.com
4 match.sharethrough.com s.amazon-adsystem.com
www.bleepingcomputer.com
ads.pubmatic.com
4 stags.bluekai.com 4 redirects
4 ads.yieldmo.com a.pub.network
sync-amz.ads.yieldmo.com
4 c2shb.pubgw.yahoo.com a.pub.network
4 c.amazon-adsystem.com a.pub.network
c.amazon-adsystem.com
4 token.rubiconproject.com eus.rubiconproject.com
4 ap.lijit.com ecdn.firstimpression.io
s.amazon-adsystem.com
4 ecdn.firstimpression.io www.bleepingcomputer.com
ecdn.firstimpression.io
3 cs.media.net 1 redirects contextual.media.net
3 idsync.rlcdn.com 1 redirects us-u.openx.net
ads.pubmatic.com
3 pixel-sync.sitescout.com 3 redirects
3 odr.mookie1.com 3 redirects
3 px.ads.linkedin.com 2 redirects eus.rubiconproject.com
3 sync.srv.stackadapt.com 3 redirects
3 rtb.mfadsrvr.com 3 redirects
3 ce.lijit.com ap.lijit.com
3 pm.w55c.net 3 redirects
3 bh.contextweb.com s.amazon-adsystem.com
bh.contextweb.com
3 um.simpli.fi 3 redirects
3 rt3055.infolinks.com resources.infolinks.com
www.bleepingcomputer.com
3 onetag-sys.com 1 redirects router.infolinks.com
googleads.g.doubleclick.net
3 mug.criteo.com www.bleepingcomputer.com
3 pixel.quantserve.com 2 redirects www.bleepingcomputer.com
3 secure-assets.rubiconproject.com 3 redirects
3 secure.adnxs.com 3 redirects
3 capi-tier-1-us-east-2.connatix.com cd.connatix.com
3 adservice.google.com pagead2.googlesyndication.com
securepubads.g.doubleclick.net
3 adservice.google.ca pagead2.googlesyndication.com
securepubads.g.doubleclick.net
3 www.googletagservices.com a.pub.network
securepubads.g.doubleclick.net
googleads.g.doubleclick.net
3 sb.scorecardresearch.com 1 redirects a.pub.network
www.bleepingcomputer.com
3 d.pub.network a.pub.network
3 s7.addthis.com s9.addthis.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
3 cds.connatix.com www.bleepingcomputer.com
cd.connatix.com
3 www.google.com 1 redirects googleads.g.doubleclick.net
tpc.googlesyndication.com
2 casale-match.dotomi.com 2 redirects
2 c21lg-d.media.net contextual.media.net
2 t.pswec.com 2 redirects
2 medianet-match.dotomi.com 2 redirects
2 tags.rd.linksynergy.com 2 redirects
2 rtb.openx.net 1 redirects us-u.openx.net
2 m.fg8dgt.com 2 redirects
2 p.adsymptotic.com 1 redirects eb2.3lift.com
2 aa.agkn.com 1 redirects us-u.openx.net
2 googleads4.g.doubleclick.net www.bleepingcomputer.com
2 image6.pubmatic.com ads.pubmatic.com
2 vop.sundaysky.com 2 redirects
2 yieldmo-match.dotomi.com 2 redirects
2 pulsepoint-match.dotomi.com 2 redirects
2 dsum.casalemedia.com ssum-sec.casalemedia.com
2 bttrack.com 2 redirects
2 33across-match.dotomi.com 2 redirects
2 amazon-tam-match.dotomi.com 2 redirects
2 ad.360yield.com 2 redirects
2 sync.targeting.unrulymedia.com 2 redirects
2 de.tynt.com 1 redirects a.pub.network
2 id5-sync.com cdn.id5-sync.com
2 c.pub.network a.pub.network
2 jadserve.postrelease.com 1 redirects s.ntv.io
2 cdn.id5-sync.com www.bleepingcomputer.com
securepubads.g.doubleclick.net
2 btlr.sharethrough.com a.pub.network
2 c.deployads.com a.pub.network
ads.pubmatic.com
2 c2shb.ssp.yahoo.com a.pub.network
2 api.floors.dev a.pub.network
2 ad-delivery.net www.bleepingcomputer.com
2 hbopenbid.pubmatic.com ecdn.firstimpression.io
a.pub.network
2 sync.search.spotxchange.com 2 redirects
2 ssum.casalemedia.com 2 redirects
2 www.reddit.com s9.addthis.com
2 js-sec.indexww.com a.pub.network
2 confiant-integrations.global.ssl.fastly.net a.pub.network
confiant-integrations.global.ssl.fastly.net
2 ins.connatix.com cd.connatix.com
2 cdn.firstimpression.io ecdn.firstimpression.io
2 www.googletagmanager.com www.bleepingcomputer.com
www.googletagmanager.com
2 fonts.googleapis.com www.bleepingcomputer.com
s0.2mdn.net
1 simage4.pubmatic.com ads.pubmatic.com
1 cdn.indexww.com ssum-sec.casalemedia.com
1 s.tribalfusion.com 1 redirects
1 a.tribalfusion.com 1 redirects
1 r.casalemedia.com ssum-sec.casalemedia.com
1 aorta.clickagy.com 1 redirects
1 i6.liadm.com us-u.openx.net
1 d.turn.com 1 redirects
1 eu-u.openx.net us-u.openx.net
1 i.w55c.net 1 redirects
1 dis.criteo.com 1 redirects
1 hbx.media.net contextual.media.net
1 rtb.adentifi.com ads.pubmatic.com
1 sync.technoratimedia.com 1 redirects
1 match.deepintent.com de.tynt.com
1 tags.bluekai.com 1 redirects
1 sync.ipredictive.com 1 redirects
1 c.bing.com eb2.3lift.com
1 acdn.adnxs.com a.pub.network
1 beacon.lynx.cognitivlabs.com 1 redirects
1 ssbsync.smartadserver.com 1 redirects
1 cs.chocolateplatform.com 1 redirects
1 aax-eu.amazon-adsystem.com eus.rubiconproject.com
1 ads.yahoo.com eus.rubiconproject.com
1 pixel-us-east.rubiconproject.com 1 redirects
1 ad.mrtnsvr.com 1 redirects
1 data.adsrvr.org 1 redirects
1 pixel-eu.rubiconproject.com 1 redirects
1 nep.advangelists.com 1 redirects
1 cms-xch-chicago.33across.com hde.tynt.com
1 inv-nets.admixer.net 1 redirects
1 sync.adotmob.com 1 redirects
1 ad4m.at ssum-sec.casalemedia.com
1 sync-amz.ads.yieldmo.com s.amazon-adsystem.com
1 ssbsync-us.smartadserver.com 1 redirects
1 api.intentiq.com resources.infolinks.com
1 sync1.intentiq.com router.infolinks.com
1 sync.intentiq.com 1 redirects
1 pixel.advertising.com 1 redirects
1 s.cpx.to router.infolinks.com
1 u.openx.net 1 redirects
1 hde.tynt.com router.infolinks.com
1 google-bidout-d.openx.net oa.openxcdn.net
1 oajs.openx.net oa.openxcdn.net
1 tags.crwdcntrl.net securepubads.g.doubleclick.net
1 static.criteo.net securepubads.g.doubleclick.net
1 oa.openxcdn.net securepubads.g.doubleclick.net
1 123a2100834ae971547f5f25bc6644f9.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 geo.privacymanager.io ats.rlcdn.com
1 lb.eu-1-id5-sync.com cdn.id5-sync.com
1 rules.quantcount.com secure.quantserve.com
1 secure.cdn.fastclick.net www.bleepingcomputer.com
1 ats.rlcdn.com www.bleepingcomputer.com
1 ssc.33across.com a.pub.network
1 freestar-d.openx.net a.pub.network
1 prebid.media.net a.pub.network
1 tlx.3lift.com a.pub.network
1 grid.bidswitch.net a.pub.network
1 s.ntv.io a.pub.network
1 secure.quantserve.com a.pub.network
1 vpaid.springserve.com cd.connatix.com
1 as-sec.casalemedia.com js-sec.indexww.com
1 htlb.casalemedia.com ecdn.firstimpression.io
a.pub.network
1 fastlane.rubiconproject.com ecdn.firstimpression.io
a.pub.network
1 bidder.criteo.com ecdn.firstimpression.io
1 tv.springserve.com cd.connatix.com
1 i.ctnsnet.com 1 redirects
1 vid.connatix.com cd.connatix.com
1 imasdk.googleapis.com cd.connatix.com
resources.infolinks.com
1 api-public.addthis.com s9.addthis.com
1 partner.googleadservices.com pagead2.googlesyndication.com
1 btloader.com www.bleepingcomputer.com
1 freestar-io.videoplayerhub.com 1 redirects
1 pghub.io a.pub.network
1 cdn.jsdelivr.net ecdn.firstimpression.io
1 capi.connatix.com cd.connatix.com
1 m.addthis.com s9.addthis.com
1 v1.addthisedge.com s9.addthis.com
1 z.moatads.com s9.addthis.com
1 widgets.outbrain.com www.bleepingcomputer.com
1 ad.doubleclick.net www.bleepingcomputer.com
1 ecdn.analysis.fi www.bleepingcomputer.com
1 cd.connatix.com 1 redirects
1 static.cloudflareinsights.com www.bleepingcomputer.com
1 s9.addthis.com www.bleepingcomputer.com
1 www.gstatic.com www.bleepingcomputer.com
1 www.bleepingcomputer.com
1 ejyazl.clicks.mlsend.com 1 redirects
0 api.rlcdn.com Failed a.pub.network
0 id.crwdcntrl.net Failed a.pub.network
0 sync.crwdcntrl.net Failed ssum-sec.casalemedia.com
ap.lijit.com
0 sync.inmobi.com Failed s.amazon-adsystem.com
0 bcp.crwdcntrl.net Failed tags.crwdcntrl.net
ap.lijit.com
0 sync.go.sonobi.com Failed router.infolinks.com
0 firstimpression-d.openx.net Failed ecdn.firstimpression.io
0 hb.emxdgt.com Failed ecdn.firstimpression.io
468 218

This site contains no links.

Subject Issuer Validity Valid
bleepingcomputer.com
Sectigo RSA Domain Validation Secure Server CA		 2022-05-11 -
2023-05-11		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-07-18 -
2022-10-10		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-05-16 -
2023-05-16		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-07-18 -
2022-10-10		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-07-18 -
2022-10-10		 3 months crt.sh
odc-addthis-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2022-02-27 -
2023-02-28		 a year crt.sh
analysis.fi
Amazon		 2021-12-04 -
2023-01-01		 a year crt.sh
*.firstimpression.io
Sectigo RSA Domain Validation Secure Server CA		 2021-11-21 -
2022-12-05		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2022-07-18 -
2022-10-10		 3 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2022-07-18 -
2022-10-10		 3 months crt.sh
*.outbrain.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-04-03 -
2023-04-04		 a year crt.sh
moatads.com
DigiCert SHA2 Secure Server CA		 2021-11-27 -
2022-11-29		 a year crt.sh
*.pub.network
Go Daddy Secure Certificate Authority - G2		 2022-03-19 -
2023-04-20		 a year crt.sh
*.connatix.com
Go Daddy Secure Certificate Authority - G2		 2021-08-20 -
2022-09-21		 a year crt.sh
*.scorecardresearch.com
Amazon		 2022-01-29 -
2023-02-27		 a year crt.sh
*.pghub.io
DigiCert TLS RSA SHA256 2020 CA1		 2022-02-02 -
2023-02-17		 a year crt.sh
*.freetls.fastly.net
GlobalSign Atlas R3 DV TLS CA 2022 Q2		 2022-05-04 -
2023-06-05		 a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2021-12-12 -
2022-12-13		 a year crt.sh
*.google.ca
GTS CA 1C3		 2022-07-18 -
2022-10-10		 3 months crt.sh
*.google.com
GTS CA 1C3		 2022-07-18 -
2022-10-10		 3 months crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-07-03 -
2022-12-30		 6 months crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-03-17 -
2023-04-04		 a year crt.sh
*.springserve.com
Amazon		 2021-09-27 -
2022-10-26		 a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2022-02-11 -
2023-03-14		 a year crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1		 2022-06-13 -
2023-07-14		 a year crt.sh
*.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-06-15 -
2022-09-18		 3 months crt.sh
api.floors.dev
GTS CA 1D4		 2022-06-10 -
2022-09-08		 3 months crt.sh
c.amazon-adsystem.com
Amazon		 2022-05-09 -
2023-04-18		 a year crt.sh
web.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2022-08-02 -
2023-01-25		 6 months crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-22 -
2022-09-21		 a year crt.sh
*.ntv.io
DigiCert SHA2 Secure Server CA		 2021-12-04 -
2022-12-06		 a year crt.sh
*.bidswitch.net
Sectigo RSA Domain Validation Secure Server CA		 2022-04-05 -
2023-05-04		 a year crt.sh
*.3lift.com
Amazon		 2022-05-13 -
2023-06-11		 a year crt.sh
*.yieldmo.com
Amazon		 2021-10-12 -
2022-11-10		 a year crt.sh
*.deployads.com
Amazon		 2022-05-04 -
2023-06-02		 a year crt.sh
*.media.net
Sectigo RSA Domain Validation Secure Server CA		 2022-04-06 -
2023-05-04		 a year crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2022-07-21 -
2023-08-21		 a year crt.sh
*.sharethrough.com
Amazon		 2022-07-14 -
2023-08-12		 a year crt.sh
ssc.33across.com
GTS CA 1D4		 2022-07-17 -
2022-10-15		 3 months crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2022-02-03 -
2023-02-25		 a year crt.sh
secure.cdn.fastclick.net
DigiCert SHA2 Secure Server CA		 2022-01-15 -
2023-01-17		 a year crt.sh
*.postrelease.com
Amazon		 2021-12-28 -
2023-01-25		 a year crt.sh
*.eu-1-id5-sync.com
R3		 2022-06-01 -
2022-08-30		 3 months crt.sh
*.privacymanager.io
Amazon		 2021-09-25 -
2022-10-24		 a year crt.sh
*.id5-sync.com
R3		 2022-05-31 -
2022-08-29		 3 months crt.sh
oa.openxcdn.net
GTS CA 1D4		 2022-06-12 -
2022-09-10		 3 months crt.sh
*.criteo.net
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-06-21 -
2022-09-23		 3 months crt.sh
*.crwdcntrl.net
Go Daddy Secure Certificate Authority - G2		 2022-05-01 -
2023-06-02		 a year crt.sh
s.amazon-adsystem.com
Amazon		 2022-05-09 -
2023-04-21		 a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2022-06-14 -
2022-12-07		 6 months crt.sh
*.tynt.com
Sectigo RSA Domain Validation Secure Server CA		 2021-09-23 -
2022-09-30		 a year crt.sh
*.onetag-sys.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-01-10 -
2023-01-03		 a year crt.sh
*.intentiq.com
Amazon		 2022-03-20 -
2023-04-17		 a year crt.sh
*.bfmio.com
Amazon		 2022-04-16 -
2023-05-15		 a year crt.sh
*.ads.yieldmo.com
Amazon		 2022-04-25 -
2023-05-24		 a year crt.sh
*.contextweb.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-04-07 -
2023-05-08		 a year crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2022-06-27 -
2023-06-05		 a year crt.sh
aax-eu.amazon-adsystem.com
Amazon		 2022-07-20 -
2023-07-19		 a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2022-03-31 -
2023-05-02		 a year crt.sh
cdn.adnxs.com
GeoTrust TLS RSA CA G1		 2022-03-11 -
2023-04-11		 a year crt.sh
www.bing.com
Microsoft RSA TLS CA 01		 2022-06-10 -
2022-12-10		 6 months crt.sh
*.tapad.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-13 -
2022-10-14		 a year crt.sh
ups.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2022-06-07 -
2022-11-30		 6 months crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2022-05-02 -
2023-06-03		 a year crt.sh
track.adform.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-06 -
2022-10-07		 a year crt.sh
adentifi.com
Amazon		 2022-08-05 -
2023-09-03		 a year crt.sh
events-ssc.33across.com
GTS CA 1D4		 2022-07-21 -
2022-10-19		 3 months crt.sh
*.agkn.com
RapidSSL RSA CA 2018		 2020-07-25 -
2022-09-18		 2 years crt.sh

This page contains 59 frames:

Primary Page: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Frame ID: C995D0557414F8E7C7EB12CB567A0846
Requests: 175 HTTP requests in this frame

Frame: https://cds.connatix.com/p/174545/connatix.playspace.js
Frame ID: A76CE5FFE996DC5DD3447E17A3EBF4E0
Requests: 15 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 4D99FDAF32383D6A779AD711B3148075
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 9E78C585877E02720A425EF47542FB78
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220803/r20190131/zrt_lookup.html
Frame ID: E806D627C149E301E16A134A9CF48121
Requests: 1 HTTP requests in this frame

Frame: https://ecdn.firstimpression.io/static/js/fiamp.js
Frame ID: 213BFCB73AB0C51647EF3F48A20A5CFC
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1659026025&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710460273&bpp=4&bdt=658&idt=235&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&abxe=1&correlator=2768181573619&frm=20&pv=2&ga_vid=1170813820.1659710460&ga_sid=1659710461&ga_hid=1896539107&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4087&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763505%2C31068775&oid=2&pvsid=369477549655474&tmod=1475282787&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=MhpC7LwGAx&p=https%3A//www.bleepingcomputer.com&dtd=257
Frame ID: CF5C2C046210B225AEB126C0ADA8ADD5
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1659026025&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710460289&bpp=2&bdt=673&idt=274&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&abxe=1&prev_fmts=834x500&nras=1&correlator=2768181573619&frm=20&pv=1&ga_vid=1170813820.1659710460&ga_sid=1659710461&ga_hid=1896539107&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763505%2C31068775&oid=2&pvsid=369477549655474&tmod=1475282787&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=282
Frame ID: E87E77E87DAE11C7AFB5871AE8D7383A
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Frame ID: 3D41B6ED895E773054C892AEA553CB59
Requests: 3 HTTP requests in this frame

Frame: https://123a2100834ae971547f5f25bc6644f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 3FE5F394CC27CC2C6CAEFE86EBD90EBD
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.bleepingcomputer.com
Frame ID: 9AF317EED8A20998FC8ADB1F3AED896C
Requests: 2 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: 619C58378F33623CB40FD81B86CB4D1D
Requests: 6 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&dcc=t
Frame ID: 9EAACAAB242A86E0044191DF6CFEA5C2
Requests: 1 HTTP requests in this frame

Frame: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Frame ID: C1AAC038FF9558B33126FB0967E0C18A
Requests: 17 HTTP requests in this frame

Frame: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Frame ID: 27E41A803A8E0EE90D86A8520B084E78
Requests: 6 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Frame ID: F05C6E9CB2398FA3FB17E06F7C4D56DE
Requests: 10 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Frame ID: 33D24E4637EB2FED981248105BCD22CF
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Frame ID: 54B661B5BEF3A9E6A3AB12542F0F4A5C
Requests: 4 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Frame ID: 66E68EB56C4B2045BBB8D70848C3CFDE
Requests: 10 HTTP requests in this frame

Frame: https://sync.bfmio.com/syncb?pid=137
Frame ID: 28F97335901533B918B6D0A0060B1912
Requests: 8 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=1063148059880476994&gdpr=0&gdpr_consent=
Frame ID: 569FD45E8CBC9FA09FF9C6606595A9BA
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAADKEQUwXTcGQMhVuXhAAAAAAA&expiration=1659796862&is_secure=true
Frame ID: C659C6BC6E0C47083657444E9173317E
Requests: 1 HTTP requests in this frame

Frame: https://sync.inmobi.com/TAM?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D
Frame ID: 1158200AF2C0C32D2BDB805F87634644
Requests: 1 HTTP requests in this frame

Frame: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Frame ID: 0897A3E642AE3E24C056B166DCD66D5A
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Frame ID: 68FC983F1AA52F5281BB0577639309AF
Requests: 2 HTTP requests in this frame

Frame: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Frame ID: 70654680F8270CD3E9AEF97A15E79B88
Requests: 7 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Frame ID: 1184BF51A73D8470D54D3CA75C216486
Requests: 2 HTTP requests in this frame

Frame: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint
Frame ID: 9100DAC68ACE78A39C89E8771099B453
Requests: 4 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?id=2739567155738641687&ex=appnexus.com
Frame ID: B422D65D0E1B8615447F716E120466F4
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Frame ID: 013C4EA3D0792E6C643F12040857A82E
Requests: 7 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4526249851231332969674
Frame ID: 903D52EB65B731A1A81126243AD35A39
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Frame ID: CB936352C8C35206ECB6621E3C455DF9
Requests: 11 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Frame ID: E1B03F070757D506023C3611B13953B0
Requests: 7 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220803/r20190131/zrt_lookup.html
Frame ID: 419F5D5E5E297A2E8F5E19BEAE68C527
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Frame ID: 676C4AA17E28206EE1A1CDF69B25A5EE
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDOyFUYqtv-lwEwAQ&v=APEucNWND8EUByXZtiZvN2_kdnYY2z38_2PYL6SMoYurrBVjNW1Bkux4C68C6B08hQ-fqTh9G10ZO6j58eIyjMUrBtyuD0Katw
Frame ID: 4ECC0E98BB4ED711FAF8EB58AB111952
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 9A096703D9427EA4CC18F0AFD27B488B
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: C47A6CAED013C5274B18379945A0C19F
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/14586128274924466605/index.html
Frame ID: CFDBBDE0A88329AAC93C01C35C2D35BE
Requests: 10 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 2B128ADE5E96B9F0201CDCD598EA9057
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 39226F072F67307F32DDD6734A31F6BD
Requests: 2 HTTP requests in this frame

Frame: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Frame ID: 18C953671A99A5F22FE4495A2716CE72
Requests: 6 HTTP requests in this frame

Frame: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Frame ID: 1DAB29CABF8BC54E36702CA3F490B916
Requests: 11 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Frame ID: 75966DEABB182B70B28305EC67D497F4
Requests: 9 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync
Frame ID: 4891EF1BC2B4F09C9A7194485EA369F2
Requests: 11 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156696
Frame ID: 3B52DF78B6C0CABD1FDBA56BFACBA587
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Frame ID: B25DDDF3225B3A415230EEF1D26263AB
Requests: 18 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: A59CFC7D65B18E240A125ACE131FF4CA
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 3940465434FFA7FD5EDC86D46DC31958
Requests: 3 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: A07850C605901E55CC1E03D7DCE44EED
Requests: 2 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bleepingcomputer.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Frame ID: E619BD77E764B831FAE8581E39E702F3
Requests: 10 HTTP requests in this frame

Frame: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Frame ID: C9EE24A4A2E2FFE53E7FE8EEEDF4DA08
Requests: 12 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=52C108B0-611A-4584-A232-D339F84A7A29
Frame ID: 4D172F03A5B4016A4AE04173EE1BE8A2
Requests: 1 HTTP requests in this frame

Frame: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=52C108B0-611A-4584-A232-D339F84A7A29
Frame ID: D07B08351697A0866F1E13C0D76B00A5
Requests: 1 HTTP requests in this frame

Frame: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=52C108B0-611A-4584-A232-D339F84A7A29
Frame ID: 0B63D95D8C0123DCCB6A688DA8E62DE3
Requests: 1 HTTP requests in this frame

Frame: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Frame ID: 00A0232E213D332FC2F94FC7B5A565F2
Requests: 1 HTTP requests in this frame

Frame: https://c.deployads.com/cs/pubm?b=52C108B0-611A-4584-A232-D339F84A7A29
Frame ID: 52F44400B6019F3CFDC86857464D94BE
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=medianet
Frame ID: 64363FA4272415C2DC8A5E2B5CDDE600
Requests: 3 HTTP requests in this frame

Frame: https://contextual.media.net/cksync.html?cs=8&vsid=3027120641454728000V10&type=rkt&refUrl=&vid=97104649183027120641454728000V10&ovsid=1797288115146808421
Frame ID: 2F07AAC68BEBEEB73F0BD6B573CE9299
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://ejyazl.clicks.mlsend.com/te/cl/eyJ2Ijoie1wiYVwiOjEwOTEyMSxcImxcIjo2MjUyMTU1ODk0MzQwMTM0MixcInJcIjo2Mj... HTTP 302
    https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetec... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • addthis\.com/js/
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • googletagservices\.com/tag/js/gpt(?:_mobile)?\.js
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • moatads\.com
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • adnxs\.com/[^"]*(?:prebid|/pb\.js)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • \.quantserve\.com/quant\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • \.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

468
Requests

65 %
HTTPS

23 %
IPv6

120
Domains

218
Subdomains

119
IPs

8
Countries

4784 kB
Transfer

13029 kB
Size

239
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ejyazl.clicks.mlsend.com/te/cl/eyJ2Ijoie1wiYVwiOjEwOTEyMSxcImxcIjo2MjUyMTU1ODk0MzQwMTM0MixcInJcIjo2MjYxMDczMzY2MTE2MTE3NH0iLCJzIjoiNGNlOTJiZGRkNGE5ZDY1NyJ9 HTTP 302
    https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12
  • https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en HTTP 301
  • https://www.gstatic.com/prose/brandjs.js
Request Chain 24
  • https://cd.connatix.com/connatix.playspace.js HTTP 302
  • https://cds.connatix.com/p/174545/connatix.playspace.js
Request Chain 73
  • https://sb.scorecardresearch.com/b?c1=2&c2=23384447&cs_ucfr=&cs_it=b3&cv=3.8.0.210223&ns__t=1659710460416&ns_c=UTF-8&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&c8=Cyberspies%20use%20Google%20Chrome%20extension%20to%20steal%20emails%20undetected&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=23384447&cs_ucfr=&cs_it=b3&cv=3.8.0.210223&ns__t=1659710460416&ns_c=UTF-8&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&c8=Cyberspies%20use%20Google%20Chrome%20extension%20to%20steal%20emails%20undetected&c9=
Request Chain 79
  • https://freestar-io.videoplayerhub.com/gallery.js HTTP 301
  • https://btloader.com/tag?h=freestar-io&upapi=true
Request Chain 98
  • https://ssum.casalemedia.com/usermatchredir?s=190549&cb=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d17%26ev%3d933fd47c58244ca6a52cbcf58f42109f%26pname%3dIndex%26api-tier%3d1%26uid%3d HTTP 302
  • https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D17%26ev%3D933fd47c58244ca6a52cbcf58f42109f%26pname%3DIndex%26api-tier%3D1%26uid%3D&s=190549&C=1 HTTP 302
  • https://cks.connatix.com/cks?pid=17&ev=933fd47c58244ca6a52cbcf58f42109f&pname=Index&api-tier=1&uid=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140
Request Chain 99
  • https://match.prod.bidr.io/cookie-sync/connatix?redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d15%26ev%3d933fd47c58244ca6a52cbcf58f42109f%26pname%3dBeeswax%26api-tier%3d1%26uid%3d{userid} HTTP 303
  • https://match.prod.bidr.io/cookie-sync/connatix?redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D15%26ev%3D933fd47c58244ca6a52cbcf58f42109f%26pname%3DBeeswax%26api-tier%3D1%26uid%3D%7Buserid%7D&_bee_ppp=1 HTTP 303
  • https://cks.connatix.com/cks?pid=15&ev=933fd47c58244ca6a52cbcf58f42109f&pname=Beeswax&api-tier=1&uid=AABCo07F2lgAABCPtU3Fvw
Request Chain 100
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gapzaid&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=gapzaid&ttd_tpi=1 HTTP 302
  • https://cks.connatix.com/cks?pid=19&uid=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttl=1662302460
Request Chain 101
  • https://secure.adnxs.com/getuid?https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d6%26ev%3d933fd47c58244ca6a52cbcf58f42109f%26pname%3dAppNexus%26api-tier%3d1%26uid%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fcks.connatix.com%252fcks%253fpid%253d6%2526ev%253d933fd47c58244ca6a52cbcf58f42109f%2526pname%253dAppNexus%2526api-tier%253d1%2526uid%253d%2524UID HTTP 302
  • https://cks.connatix.com/cks?pid=6&ev=933fd47c58244ca6a52cbcf58f42109f&pname=AppNexus&api-tier=1&uid=2739567155738641687
Request Chain 102
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=19564_2&endpoint=us-east HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Request Chain 103
  • https://i.ctnsnet.com/int/cm?exc=24&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d28%26ev%3d933fd47c58244ca6a52cbcf58f42109f%26pname%3dCrimtan%26api-tier%3d1%26uid%3d%5Buser_id%5D HTTP 302
  • https://cks.connatix.com/cks?pid=28&ev=933fd47c58244ca6a52cbcf58f42109f&pname=Crimtan&api-tier=1&uid=5cfe8a2639f640e5b1695c208dac0136
Request Chain 104
  • https://id.rlcdn.com/712202.gif?cparams=933fd47c58244ca6a52cbcf58f42109f HTTP 307
  • https://id.rlcdn.com/1000.gif?memo=CIq8KxoNCPzXtJcGEgUI6AcQAEIASiA5MzNmZDQ3YzU4MjQ0Y2E2YTUyY2JjZjU4ZjQyMTA5Zg
Request Chain 105
  • https://sync.search.spotxchange.com/partner?adv_id=8600&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d10%26ev%3d933fd47c58244ca6a52cbcf58f42109f%26pname%3dSpotX%26api-tier%3d1%26uid%3d%24SPOTX_USER_ID HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=8600&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d10%26ev%3d933fd47c58244ca6a52cbcf58f42109f%26pname%3dSpotX%26api-tier%3d1%26uid%3d%24SPOTX_USER_ID&__user_check__=1&sync_id=9ff5e8ef-14cc-11ed-a211-1e3873bf0203 HTTP 302
  • https://cks.connatix.com/cks?pid=10&ev=933fd47c58244ca6a52cbcf58f42109f&pname=SpotX&api-tier=1&uid=9ff5e893-14cc-11ed-a211-1e3873bf0203
Request Chain 193
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain HTTP 302
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&dcc=t
Request Chain 198
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=Yu0r-gAENBckxgA0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=Yu0r-gAENBckxgA0&_test=Yu0r-gAENBckxgA0
Request Chain 200
  • https://match.adsrvr.org/track/cmf/openx?oxid=5bf4df6b-f83b-7b68-d2e1-d230cbf67939&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttd_puid=5bf4df6b-f83b-7b68-d2e1-d230cbf67939&gdpr=0&gdpr_consent=
Request Chain 202
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENLwFsJqwzXQ3RZTmXe8fcE&google_cver=1
Request Chain 203
  • https://gum.criteo.com/sid/json?origin=publishertagids&domain=bleepingcomputer.com&sn=ChromeSyncframe&so=0&topUrl=www.bleepingcomputer.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=mMF0QXxhSHNPOXNMKzBUU1MvczIrd3pWbmNMLzNza0NaMEw4YkxyWjZPM3o1ejRSTjM4MGg5Wm5ESVNMUS9iWHA5Z3pSaUxBRWdydDNvQlNRRzhzR3oxalZJL2ZOZW9XcTA0SVlpT20rVUl0Q2EzUFNhdFJOUm0zVzhTSk8ySVFaMnR1L25weTF0SWRZKzFGRHgzYVFoK2xDNHVxdHdMbmI2bFF6MzhTWFYwUStscUhKSWNCMCt0YnZSRVJQS0JPRzZCWlZ2aXlidnJmQWFXbEgzRWVQOURwUnk0U0kvYU9kQndvaGQySkFGUzNvRU1maUxLeEVUN3l0OVoxZENqQ0cwcWJhVDdGZkhLeGl1UW9yZW94N05HN0tWUT09fA&cppv=2
Request Chain 204
  • https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV HTTP 307
  • https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Request Chain 207
  • https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fpbm-usync%253Fuid%253D%2523PMUID HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fpbm-usync%253Fuid%253D%2523PMUID&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NTJDMTA4QjAtNjExQS00NTg0LUEyMzItRDMzOUY4NEE3QTI5&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3D52C108B0-611A-4584-A232-D339F84A7A29 HTTP 302
  • https://router.infolinks.com/dyn/pbm-usync?uid=52C108B0-611A-4584-A232-D339F84A7A29 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3356&partner_device_id=52C108B0-611A-4584-A232-D339F84A7A29 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3356&partner_device_id=52C108B0-611A-4584-A232-D339F84A7A29 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=922f411c-87a1-4cd3-9a9c-aaee6eaa8133%252C&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttd_puid=922f411c-87a1-4cd3-9a9c-aaee6eaa8133%2C
Request Chain 208
  • https://ib.adnxs.com/getuid?https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fapn-usync%3Fuser_id%3D%24UID HTTP 302
  • https://router.infolinks.com/dyn/apn-usync?user_id=2739567155738641687
Request Chain 209
  • https://u.openx.net/w/1.0/cm?id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D HTTP 302
  • https://router.infolinks.com/dyn/ox-usync?uid=7063fdfa-ebef-4ce4-932e-e5c23351dcac
Request Chain 210
  • https://ups.analytics.yahoo.com/ups/58422/occ HTTP 302
  • https://router.infolinks.com/dyn/VR-usync?uid=y-XfMAf1hE2uFXgX1lXrm6Q.5N3nduaJ3oehpLkx0-~A
Request Chain 211
  • https://sync.1rx.io/usersync2/infolinks HTTP 302
  • https://sync.1rx.io/usersync2/infolinks?zcc=1&cb=1659710462746 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3979130734 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/5e1b1e00-4929-4a58-9799-282bf9b88b13 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fr1-usync%3Fuid%3DRX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005 HTTP 302
  • https://router.infolinks.com/dyn/r1-usync?uid=RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005
Request Chain 212
  • https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__ HTTP 302
  • https://stags.bluekai.com/site/23178?id=GZWay77ga066zVKhv2Jj&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TPOV2GK4RONFXGM33MNFXGW4ZOMNXW2L3EPFXC66TNNYWXK43ZNZRT6ZLYMNUGC3THMU6WS3TGN5WGS3TLOMTHK2LEHVDVUV3BPE3TOZ3BGA3DM6SWJNUHMMSKNI HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TPOV2GK4RONFXGM33MNFXGW4ZOMNXW2L3EPFXC66TNNYWXK43ZNZRT6ZLYMNUGC3THMU6WS3TGN5WGS3TLOMTHK2LEHVDVUV3BPE3TOZ3BGA3DM6SWJNUHMMSKNI HTTP 302
  • https://router.infolinks.com/dyn/zmn-usync?uid=GZWay77ga066zVKhv2Jj
Request Chain 213
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Ftplift%3Fuid%3D%24UID HTTP 302
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Ftplift%3Fuid%3D%24UID HTTP 302
  • https://router.infolinks.com/dyn/tplift?uid=4526249851231332969674
Request Chain 215
  • https://ib.adnxs.com/getuid?https://s.cpx.to/ca.png?ref=https%253A%252F%252Fwww.bleepingcomputer.com%252Fnews%252Fsecurity%252Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%252F%253Futm_source%253Dnewsletter%2526utm_medium%253Demail%2526utm_term%253D2022-08-05%2526utm_campaign%253DFw%252BItalian%252BInternal%252BRevenue%252BService%252BBreached%252BAudius%252BHacked%252BPrestaShop%252BZero-Day%252BFlaw&pid=12306&adnxs_uid=$UID HTTP 302
  • https://s.cpx.to/ca.png?ref=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&pid=12306&adnxs_uid=2739567155738641687
Request Chain 216
  • https://ad.360yield.com/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531 HTTP 302
  • https://ad.360yield.com/ul_cb/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531 HTTP 302
  • https://router.infolinks.com/dyn/imd-usync?user_id=3c0f15ce-8eea-410e-b543-893a366e7f9d&partner_id=1531
Request Chain 217
  • https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true HTTP 302
  • https://router.infolinks.com/dyn/outh-usync?uid=y-PWSL87RE2uGK26blnBCsq2vu5MyjQIet~A
Request Chain 218
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID HTTP 307
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID&sovrn_retry=true HTTP 307
  • https://router.infolinks.com/dyn/sovrn-usync?uid=FGHRhPZHXp7Ir1doSteX52FA
Request Chain 219
  • https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fusersync%253Fpmuservalue%253D%2523PMUID HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fusersync%253Fpmuservalue%253D%2523PMUID&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NjNGM0UzMjgtNTBDRS00QjUyLUI2M0YtQUM3MEU5RjNCMjdG&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3D52C108B0-611A-4584-A232-D339F84A7A29 HTTP 302
  • https://router.infolinks.com/dyn/pbm-usync?uid=52C108B0-611A-4584-A232-D339F84A7A29 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3356&partner_device_id=52C108B0-611A-4584-A232-D339F84A7A29 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3356&partner_device_id=52C108B0-611A-4584-A232-D339F84A7A29 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=922f411c-87a1-4cd3-9a9c-aaee6eaa8133%252C&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttd_puid=922f411c-87a1-4cd3-9a9c-aaee6eaa8133%2C
Request Chain 220
  • https://p.rfihub.com/cm?pub=43153&in=1 HTTP 302
  • https://router.infolinks.com/dyn/zeta-usync?uid=1797288115146808422
Request Chain 221
  • https://ssc-cms.33across.com/ps/?ri=0010b00002CpYhEAAV&ru=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F33a-usync%3Fuid%3D33XUSERID33X HTTP 302
  • https://router.infolinks.com/dyn/33a-usync?uid=2278742228126
Request Chain 222
  • https://router.infolinks.com/dyn/iq-usync HTTP 302
  • https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=fcc31345-e707-4a86-89ae-6ca63cf6247f&3rddpi=2023874098&3rdpcid=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140&3rddpi=1639354730&3rdpcid=&3rddpi=445262707&3rdpcid=&3rddpi=1634346717&3rdpcid=&3rddpi=1402230080&3rdpcid=&3rddpi=541745869&3rdpcid=&3rddpi=1177082855&3rdpcid=&3rddpi=1213503647&3rdpcid=y-XfMAf1hE2uFXgX1lXrm6Q.5N3nduaJ3oehpLkx0-%7EA&3rddpi=1541423991&3rdpcid=&3rddpi=1239766150&3rdpcid=7063fdfa-ebef-4ce4-932e-e5c23351dcac HTTP 302
  • https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=fcc31345-e707-4a86-89ae-6ca63cf6247f&3rddpi=2023874098&3rdpcid=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140&3rddpi=1639354730&3rdpcid=&3rddpi=445262707&3rdpcid=&3rddpi=1634346717&3rdpcid=&3rddpi=1402230080&3rdpcid=&3rddpi=541745869&3rdpcid=&3rddpi=1177082855&3rdpcid=&3rddpi=1213503647&3rdpcid=y-XfMAf1hE2uFXgX1lXrm6Q.5N3nduaJ3oehpLkx0-%7EA&3rddpi=1541423991&3rdpcid=&3rddpi=1239766150&3rdpcid=7063fdfa-ebef-4ce4-932e-e5c23351dcac&ckls=true&ci=81Dwmi4JAK&nc=false&trid=-1325236451
Request Chain 228
  • https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=ADE529A5AF7E4EC0BD84D098CEDEE4E8&ex=simpli.fi&status=ok
Request Chain 229
  • https://jadserve.postrelease.com/suid/101959?ntv_r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dnativo.com%26id%3DNTV_USER_ID HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=nativo.com&id=dd31867c-6418-41ee-a987-e71c2b6b8bca
Request Chain 230
  • https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__ HTTP 302
  • https://stags.bluekai.com/site/23178?id=jTKicE_GJ9EQ0uhYWhcr&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZSXQY3IMFXGOZJ5MFWWC6TPNZPXIYLNEZUWIPLKKRFWSY2FL5DUUOKFKEYHK2CZK5UGG4Q HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZSXQY3IMFXGOZJ5MFWWC6TPNZPXIYLNEZUWIPLKKRFWSY2FL5DUUOKFKEYHK2CZK5UGG4Q HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=jTKicE_GJ9EQ0uhYWhcr
Request Chain 233
  • https://ssbsync-us.smartadserver.com/api/sync?callerId=2 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=1063148059880476994&gdpr=0&gdpr_consent=
Request Chain 234
  • https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D HTTP 302
  • https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=25213108a47a08e6&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAADKEQUwXTcGQMhVuXhAAAAAAA&expiration=1659796862&is_secure=true
Request Chain 241
  • https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=appnexus.com HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=2739567155738641687&ex=appnexus.com
Request Chain 242
  • https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com HTTP 302
  • https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Request Chain 243
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4526249851231332969674
Request Chain 244
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=Yu0r-GZu4dfEMT1ZXkpk7AAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEGOuU3crHOa3YpqFdRUe8Sg&google_cver=1
Request Chain 246
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEEsaPvdAb1kqHavq2blKq1o&google_cver=1
Request Chain 247
  • https://match.adsrvr.org/track/cmf/casale HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=5e1b1e00-4929-4a58-9799-282bf9b88b13&expiration=1662302462&gdpr=0&gdpr_consent=
Request Chain 249
  • https://sync.adotmob.com/cookie/indexexchange?r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D13%26external_user_id%3D%7bamob_user_id%7d%26expiration%3D%5bEXPIRATION%5d HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=07fa220407856ba7fed99db8&expiration=[EXPIRATION]
Request Chain 250
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Yu0r-gAENBckxgA0
Request Chain 251
  • https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2739567155738641687
Request Chain 258
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy= HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Request Chain 259
  • https://x.bidswitch.net/sync?ssp=the33across&us_privacy= HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=the33across&us_privacy= HTTP 302
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&gdpr=&consent=&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dthe33across%26bsw_param%3Dcf57a75d-4f5e-49b9-b35a-536b2987624c%26gdpr%3D%26consent%3D%26gdpr_pd%3D%26expires%3D7 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=354&user_id=70192a28055842dbbc24a64288fe5dd7&ssp=the33across&bsw_param=cf57a75d-4f5e-49b9-b35a-536b2987624c&gdpr=&consent=&gdpr_pd=&expires=7 HTTP 302
  • https://ssc-cms.33across.com/ps/?xi=10&us_privacy=&xu=cf57a75d-4f5e-49b9-b35a-536b2987624c HTTP 302
  • https://events-ssc.33across.com/match?bidder_id=10&external_user_id=cf57a75d-4f5e-49b9-b35a-536b2987624c&ts=1659710462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 260
  • https://ssc-cms.33across.com/ps/?us_privacy=&ts=1659710462549.3&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fevents-ssc.33across.com%252Fmatch%253Fliv%253Dh%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D1%2526external_user_id%253D%255BMM_UUID%255D HTTP 302
  • https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D HTTP 302
  • https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=3d9b62ed-2bff-4400-97d4-14b35df0617d
Request Chain 261
  • https://ups.analytics.yahoo.com/ups/58350/sync?redir=true HTTP 302
  • https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-VSL73VZE2uHRLs_SnVEgsfJolKZkVLqu~A HTTP 302
  • https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-VSL73VZE2uHRLs_SnVEgsfJolKZkVLqu%7EA&ts=1659710462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 262
  • https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy= HTTP 302
  • https://33across-match.dotomi.com/match/bounce/current?DotomiTest=5575f6903a850da3&is_secure=true&networkId=78390&version=1&us_privacy= HTTP 302
  • https://ssc-cms.33across.com/ps?xi=64&xu=AAADKEQUwXTcHAMKEXmTAAAAAAA&expiration=1659796862&is_secure=true&us_privacy= HTTP 302
  • https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAADKEQUwXTcHAMKEXmTAAAAAAA&ts=1659710462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 263
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy= HTTP 302
  • https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1662302462%26external_user_id%3D5e1b1e00-4929-4a58-9799-282bf9b88b13 HTTP 302
  • https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1662302462&external_user_id=5e1b1e00-4929-4a58-9799-282bf9b88b13
Request Chain 265
  • https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/casale/Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB
Request Chain 266
  • https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=5b3662ed-2bfe-4400-8a13-d2fbbcb60e53
Request Chain 267
  • https://ad.turn.com/r/cs?pid=21 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=3305665001870070297
Request Chain 268
  • https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_ HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_ HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=fYkDlbmh1OjYvA5
Request Chain 269
  • https://nep.advangelists.com/xp/user-sync?acctid=405&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D195%26external_user_id%3D%7BPARTNER_VISITOR_ID%7D%0A HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-4eabf8d8-ed30-4315-9f9e-4cd80da18c86
Request Chain 270
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48 HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=48 HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341%26partner_url%3Dhttps%253A%252F%252Fr.casalemedia.com%252Frum%253Fcm_dsp_id%253D64%2526external_user_id%253D677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341%2526gdpr%253D0%2526gdpr_consent%253D
Request Chain 271
  • https://bttrack.com/pixel/cookiesync?source=67e94f23-25d6-4008-8236-375d1743c2e0&secure=1 HTTP 302
  • https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=060b4244-ee38-489d-b7ed-1a0a44b9f67a
Request Chain 273
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=dXpoeDFZcW1ITjBhaHdFdEpQSG40dw&gdpr=0&gdpr_consent= HTTP 302
  • https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEDnhnNckMBR8zwGZusKjj3o&google_cver=1
Request Chain 274
  • https://pulsepoint-match.dotomi.com/match/bounce/current?networkId=14200&version=1&nuid= HTTP 302
  • https://pulsepoint-match.dotomi.com/match/bounce/current?DotomiTest=6b31a9342ec708e5&is_secure=true&networkId=14200&version=1&nuid= HTTP 302
  • https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAADKPn7AX7OtANm4FZhAAAAAAA&expiration=1659796862&nuid=&is_secure=true
Request Chain 277
  • https://p.rfihub.com/cm?in=1&pub=1827&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=10&3pid=1797288115146808421
Request Chain 278
  • https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=83&3pid=L6GKR815-T-8KOJ&gdpr=0
Request Chain 279
  • https://bcp.crwdcntrl.net/5/c=5436/tp=SVRN/tpid=FGHRhPZHXp7Ir1doSteX52FA/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://bcp.crwdcntrl.net/5/ct=y/c=5436/tp=SVRN/tpid=FGHRhPZHXp7Ir1doSteX52FA/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent=
Request Chain 280
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=${gdpr}&gdpr_consent=${gdpr_consent}&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=23&gdpr=${gdpr}&gdpr_consent=${gdpr_consent}&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341%26partner_url%3Dhttps%253A%252F%252Fce.lijit.com%252Fmerge%253Fpid%253D16%25263pid%253D677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341%2526gdpr%253D0%2526gdpr_consent%253D
Request Chain 281
  • https://data.adsrvr.org/track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=27&3pid=5e1b1e00-4929-4a58-9799-282bf9b88b13&gdpr=0&gdpr_consent=
Request Chain 283
  • https://rtb.mfadsrvr.com/sync?&ssp=yieldmo HTTP 302
  • https://rtb.mfadsrvr.com/ul_cb/sync?&ssp=yieldmo HTTP 302
  • https://ads.yieldmo.com/v000/sync?pn_id=mf&userid=6d33763a-bcfb-43c0-8f79-5c0c6a498cb9&gdpr=&gdpr_pd=&gdpr_consent=
Request Chain 284
  • https://ib.adnxs.com/getuid?&https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an HTTP 302
  • https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=2739567155738641687&pn_id=an
Request Chain 286
  • https://match.adsrvr.org/track/cmf/generic?&ttd_pid=yieldmo&ttd_tpi=1&ttd_puid=g5f6a31a35d593f3acba HTTP 302
  • https://ads.yieldmo.com/v000/sync?tdid=5e1b1e00-4929-4a58-9799-282bf9b88b13
Request Chain 287
  • https://yieldmo-match.dotomi.com/match/bounce/current?&networkId=42851&version=1 HTTP 302
  • https://yieldmo-match.dotomi.com/match/bounce/current?DotomiTest=3e7cb12905e508e3&is_secure=true&=&networkId=42851&version=1 HTTP 302
  • https://ads.yieldmo.com/sync?pn_id=eps&id=AAADKPn7AX7OtwMQet6pAAAAAAA&expiration=1659796862&=&is_secure=true
Request Chain 288
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=rwuq9ny&ttd_tpi=1 HTTP 302
  • https://sync.bfmio.com/sync?pid=106&uid=5e1b1e00-4929-4a58-9799-282bf9b88b13
Request Chain 289
  • https://ad.mrtnsvr.com/sync/beachfront HTTP 302
  • https://sync.bfmio.com/sync?pid=187&uid=6GCOCGpaM
Request Chain 290
  • https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fsync.bfmio.com%2Fsync%3Fpid%3D147%26uid%3D%24%7Bssky_uuid%7D HTTP 302
  • https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fsync.bfmio.com%2Fsync%3Fpid%3D147%26uid%3D%24%7Bssky_uuid%7D&_cvt=t HTTP 302
  • https://sync.bfmio.com/sync?pid=147&uid=d6.b25b5b9e55d14e60b452d4f769bb00e9
Request Chain 291
  • https://pr-bh.ybp.yahoo.com/sync/beachfront/2df08b5ac2c78c417229d472540ea751825d7839 HTTP 302
  • https://sync.bfmio.com/sync?pid=157&uid=y-ckmjeWBE2pI1NHQJpXW4LYcjh2egbfsA1CcthmIV6A--~A
Request Chain 292
  • https://sync.srv.stackadapt.com/sync?nid=157 HTTP 302
  • https://sync.bfmio.com/sync?pid=172&uid=6_XrCJGTQqVPxVrU8Wo7oJU4mbM
Request Chain 293
  • https://ad.turn.com/r/cs?pid=60 HTTP 302
  • https://sync.bfmio.com/sync?pid=169&uid=3089492219756286489
Request Chain 297
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&khaos=L6GKR815-T-8KOJ HTTP 302
  • https://ssc-cms.33across.com/ps/?xi=1&xu=L6GKR815-T-8KOJ HTTP 302
  • https://events-ssc.33across.com/match?bidder_id=30&external_user_id=L6GKR815-T-8KOJ&ts=1659710463&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 299
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1 HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/wu8HPCuX9oXu76-G6KxIsg?csrc= HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2934465120902061054
Request Chain 300
  • https://id.rlcdn.com/709414.gif HTTP 307
  • https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
Request Chain 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPSy4vXo05hMd4iyFVNjz0w&google_cver=1
Request Chain 303
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id= HTTP 302
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=-Ic5wTu9QduNWv2Cl6xoVg&rk=usync-na HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=-Ic5wTu9QduNWv2Cl6xoVg
Request Chain 304
  • https://token.rubiconproject.com/token?pid=26594 HTTP 302
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L6GKR815-T-8KOJ&sigv=1&esig=2~37f3595e8bf98ade4f5a719a80beb48de97d6101
Request Chain 306
  • https://token.rubiconproject.com/token?pid=36584 HTTP 302
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L6GKR815-T-8KOJ
Request Chain 323
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGOuU3crHOa3YpqFdRUe8Sg&google_cver=1
Request Chain 324
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yu0r-GZu4dfEMT1ZXkpk7AAA HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGOuU3crHOa3YpqFdRUe8Sg&google_cver=1
Request Chain 325
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEA0SQWSRG65ATDRFMjLdsD0&google_cver=1
Request Chain 326
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjczOTU2NzE1NTczODY0MTY4Nw%3D%3D
Request Chain 333
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEFSVClrlHMWQCPncsLiIn5A&google_cver=1&google_push=AehlK4CmhXNS7NDQAkeMQFxpS6qSMiR2E1AyNOlfAInGnX9lX2hqjjdpKMKkXjs1QpJoM2wvZxEbWaW04UONbZ9I4mgoWzM9fyKUMgKHqxsdI8ZJ50HN_zbYfQrNzaGOdRVnWqCJTB1JmIlXT5kGkT9fpFg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=PZti7Sv_RACX1BSzXfBhfQ&google_push=AehlK4CmhXNS7NDQAkeMQFxpS6qSMiR2E1AyNOlfAInGnX9lX2hqjjdpKMKkXjs1QpJoM2wvZxEbWaW04UONbZ9I4mgoWzM9fyKUMgKHqxsdI8ZJ50HN_zbYfQrNzaGOdRVnWqCJTB1JmIlXT5kGkT9fpFg
Request Chain 334
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESECobgsKr9wzzmr4WCu3dJBU&google_cver=1&google_push=AehlK4BkJ2pKgBUH1cqE1dI1On0n27sQYkp7BKUXNFaZgdv_P3OSwQGcG3t_9dlwUdPlTbSwGjoquhqcMfTf9VjwQJlYjQyv0lQVs9arDJrgYa7wkOTrGV-qLa73PweByPYU7PZeGLpeqZP8UPVUE-tvnxQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WXUwci1nQUVOQmNreGdBMA==&google_gid=CAESECobgsKr9wzzmr4WCu3dJBU&google_cver=1&google_push=AehlK4BkJ2pKgBUH1cqE1dI1On0n27sQYkp7BKUXNFaZgdv_P3OSwQGcG3t_9dlwUdPlTbSwGjoquhqcMfTf9VjwQJlYjQyv0lQVs9arDJrgYa7wkOTrGV-qLa73PweByPYU7PZeGLpeqZP8UPVUE-tvnxQ
Request Chain 336
  • https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESEMSRXfIwJ-BWb4D5n1km8es&google_cver=1&google_push=AehlK4CuXnkAOOO7FYATt5IbhSmr77IK9uG0nIV1zo5saMLKgQzb1EX75b9VyQkZ_JA_SwiC7riEtDKTFakSFFAgwFcuD8djs1F988frZLQ3-TlZbMRla9j5EtKQ6AHtP1uVATUIdRAKPsD0VcMYdv0SO58 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNDdiMjlkMTA1M2ViNDdkZjQ1OTgxYTA0ZTQ2OGM1YmM=&google_push=AehlK4CuXnkAOOO7FYATt5IbhSmr77IK9uG0nIV1zo5saMLKgQzb1EX75b9VyQkZ_JA_SwiC7riEtDKTFakSFFAgwFcuD8djs1F988frZLQ3-TlZbMRla9j5EtKQ6AHtP1uVATUIdRAKPsD0VcMYdv0SO58
Request Chain 337
  • https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEFDBM13GnD9KbGPCkrzxVeI&google_cver=1&google_push=AehlK4DXfc0s-tWx0SjNrDwbutotGveusytzbOpzvepYfJDR1YnmqC_G-KsYzY5FrjQK0HKt2ZJj_4X2ks3Na6El6cYUjOYPc3bcQPls_BNCKXFp22IGB1W7qhezO-h5L-qPVo1vPL6Dif7WNS_JUyQA_uY HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AehlK4DXfc0s-tWx0SjNrDwbutotGveusytzbOpzvepYfJDR1YnmqC_G-KsYzY5FrjQK0HKt2ZJj_4X2ks3Na6El6cYUjOYPc3bcQPls_BNCKXFp22IGB1W7qhezO-h5L-qPVo1vPL6Dif7WNS_JUyQA_uY&google_hm=MTA2MzE0ODA1OTg4MDQ3Njk5NA%3D%3D
Request Chain 338
  • https://beacon.lynx.cognitivlabs.com/adx.gif?google_gid=CAESEDaespbaxs288joV50ELP-4&google_cver=1&google_push=AehlK4DWoOkpAklJlC16ArHhDzf6ayc09p051iSSCeiy87vGIO_g_qrwaGKzfWSxZ52Nk-RVeaIARrIvLwN4n8jkKdYMa12URTnPbd8Ds1MBF8cLu__lOCLKOwnKD9zievPq9G5PHzeGkyRuZkZhBrxtfYBL HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=XIcEtx8rZ0WutDY8-ZJloA&google_push=AehlK4DWoOkpAklJlC16ArHhDzf6ayc09p051iSSCeiy87vGIO_g_qrwaGKzfWSxZ52Nk-RVeaIARrIvLwN4n8jkKdYMa12URTnPbd8Ds1MBF8cLu__lOCLKOwnKD9zievPq9G5PHzeGkyRuZkZhBrxtfYBL
Request Chain 339
  • https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEBtgb0Vr1CODq_iWAlubP1U&google_cver=1&google_push=AehlK4B0iigA9LIea05s2pQ_97Y6Nb_MGbAvMECIsoTok98HpJKcAbaoY5A0Y7Hs8LIrjF9vAHP1OQsrBglLjTbkNAVZ2po5FfHwb-kljQnh0z-8KY-n3jNHrOU08vTJ5kZGQSYGgcp9bScgGnD6Z5YIKa4 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AehlK4B0iigA9LIea05s2pQ_97Y6Nb_MGbAvMECIsoTok98HpJKcAbaoY5A0Y7Hs8LIrjF9vAHP1OQsrBglLjTbkNAVZ2po5FfHwb-kljQnh0z-8KY-n3jNHrOU08vTJ5kZGQSYGgcp9bScgGnD6Z5YIKa4 HTTP 302
  • https://onetag-sys.com/match/?int_id=19&google_error=5
Request Chain 364
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2F&domain=www.bleepingcomputer.com&cw=1&pbt=1&lsw=1 HTTP 302
  • https://mug.criteo.com/sid?cpp=jcH9Z3xFaXcycHYrOUhwNGk5M3oremRmdEtackdXMVFkSFN6V2FVY3BnaXhqckMwQ2xRN1lJMkMxbWJiSFJ0dVo2b0V3RVJiakZ2cTJBcDAwVXhBV2lKTHhld2k2QmIva2ZYMEZRRHhldHlmMGZOemVZK1pPcEF5Ymswd0pBQklHUDJ0cFdmMlZ5ZUU4RytYdWtEQ3h4OUkxTWtJVHZWT1JNNlI2djJGZEZIVEJaTzNrY3ZJalc3YzB5NkR1cDdkNkx1SDRLTU5FUzNsZkRvMWYwY25qa0d4QjBacDkxbTBkdDQrT2J6YkJSWkxoNjUwR3B1SThGZWlmRnJIcTlSZXhnWEwvNjBZRXJxbUs3VjQ4OUdzMFJIZkc2blI4TUdxc1FHSW1LdGtwQTB0UUpRMD18&cppv=2
Request Chain 368
  • https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined HTTP 302
  • https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Request Chain 377
  • https://x.bidswitch.net/sync?ssp=themediagrid HTTP 302
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=themediagrid HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=1797288115146808421&expires=30&ssp=themediagrid
Request Chain 378
  • https://image8.pubmatic.com/AdServer/ImgSync?p=156557&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156557%26pr%3Dhttps%253A%252F%252Fmatch.sharethrough.com%252Fsync%252Fv1%253Fsource_id%253DuFFr5RFBYgoUJbWMAWGEZKS3%2526source_user_id%253D%2523PMUID HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJFHW0DnIkRIkugAM465Eh4&google_cver=1 HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/pubmatic/52C108B0-611A-4584-A232-D339F84A7A29?gdpr=0&gdpr_consent=
Request Chain 380
  • https://x.bidswitch.net/sync?ssp=sharethrough&user_id=1cc8f12c-ff67-49af-b90c-db7e6770443c&gdpr=0&gdpr_consent=&gdpr_pd=1&usprivacy= HTTP 302
  • https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=cf57a75d-4f5e-49b9-b35a-536b2987624c&ssp=sharethrough&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10596055133603141835&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.visitorid%3D%24%7BTA_DEVICE_ID%7D%26ssp%3Dsharethrough%26gdpr_consent%3D%26gdpr%3D0 HTTP 302
  • https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=922f411c-87a1-4cd3-9a9c-aaee6eaa8133&ssp=sharethrough&gdpr_consent=&gdpr=0 HTTP 302
  • https://aa.agkn.com/adscores/g.pixel?sid=9212302828&puid=10596055133603141835&ssp=sharethrough&gdpr=0&gdpr_consent= HTTP 302
  • https://odr.mookie1.com/t/v2?tagid=V2_785409&src.visitorId=213110604234007076984&ssp=sharethrough&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=419&user_id=10596055133603141835&ssp=sharethrough&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=bf2b131f1f7eff9d8892972c&source_user_id=cf57a75d-4f5e-49b9-b35a-536b2987624c&seat_user_id=&seat_key=&gdpr=0&gdpr_consent=&gdpr_pd=&usprivacy=
Request Chain 382
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=3658&xuid=5e1b1e00-4929-4a58-9799-282bf9b88b13&dongle=0cfd
Request Chain 383
  • https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDUyNjI0OTg1MTIzMTMzMjk2OTY3NA%3D%3D HTTP 302
  • https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Request Chain 384
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELokJl2lTRApBMfDiwk995E&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 385
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDUyNjI0OTg1MTIzMTMzMjk2OTY3NA%3D%3D
Request Chain 386
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=4526249851231332969674&dbredirect=true&gdpr=0&consent= HTTP 302
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=4526249851231332969674&dbredirect=true&gdpr=0&consent=&cookiesTest=true HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=acd100cd-9f14-4234-ad6e-0c82957994d0&_noobservation=1 HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=acd100cd-9f14-4234-ad6e-0c82957994d0&_noobservation=1&_expected_cookie=f4afa80c45c1ed9c138786b2ab937a45
Request Chain 387
  • https://x.bidswitch.net/sync?ssp=triplelift&user_id=4526249851231332969674&gdpr=0&gdpr_consent= HTTP 302
  • https://m.fg8dgt.com/sync?ssp=bidswitch&bidswitch_ssp_id=triplelift&ssp_uuid=cf57a75d-4f5e-49b9-b35a-536b2987624c HTTP 302
  • https://m.fg8dgt.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=triplelift&ssp_uuid=cf57a75d-4f5e-49b9-b35a-536b2987624c HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=108&expires=14&ssp=triplelift&user_id=746fa3a7-1e1f-4377-a42d-1e8b819f2547 HTTP 302
  • https://eb2.3lift.com/xuid?mid=2409&xuid=cf57a75d-4f5e-49b9-b35a-536b2987624c&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 389
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/4526249851231332969674?gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-OKIEeTRE2oTybGZDEg5GxI06owRkWL9enHmArKmn3w--~A&dongle=0883
Request Chain 391
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent= HTTP 302
  • https://stags.bluekai.com/site/23178?id=jTKicE_GJ9EQ0uhYWhcr&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5NJKEW2LDIVPUOSRZIVITA5LILFLWQY3S&gdpr=0 HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5NJKEW2LDIVPUOSRZIVITA5LILFLWQY3S HTTP 302
  • https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=jTKicE_GJ9EQ0uhYWhcr
Request Chain 393
  • https://rtb.openx.net/sync/dds HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=hKJVV1G9wkY0lZ6HGO9Dgw==&ox_sc=1&ox_init=1 HTTP 302
  • https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Request Chain 394
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=536872786&val=3d9b62ed-2bff-4400-97d4-14b35df0617d
Request Chain 395
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID} HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073028&val=52c14264-5a43-426b-bee4-a3fcf6f47bcd
Request Chain 396
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072977&val=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&gdpr=0&gdpr_consent=
Request Chain 399
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D HTTP 302
  • https://id.rlcdn.com/464246.gif?partner_uid=0e32a00d-357c-4d08-8d98-52c3f26d18e1 HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=efd7dac1fb47182e4e5df67f4ab694c6ec5c4bb52befa568d585b2a064f21d53791426b5417dce21&_=2 HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBlZmQ3ZGFjMWZiNDcxODJlNGU1ZGY2N2Y0YWI2OTRjNmVjNWM0YmI1MmJlZmE1NjhkNTg1YjJhMDY0ZjIxZDUzNzkxNDI2YjU0MTdkY2UyMRAAGgwIgdi0lwYSBAgCEABCAEoA HTTP 302
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBlZmQ3ZGFjMWZiNDcxODJlNGU1ZGY2N2Y0YWI2OTRjNmVjNWM0YmI1MmJlZmE1NjhkNTg1YjJhMDY0ZjIxZDUzNzkxNDI2YjU0MTdkY2UyMRAAGgwIgdi0lwYSBAgCEABCAEoA&google_gid=CAESEJRCSiZLJsg2L-nAIvUGkfQ&google_cver=1 HTTP 307
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
  • https://idsync.rlcdn.com/458249.gif?partner_uid=04452166-234d-4562-b3c0-e0a51d5b50f5
Request Chain 400
  • https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072399&val=2739567155738641687
Request Chain 402
  • https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=3305665001870070297&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 405
  • https://ssc-cms.33across.com/ps/?us_privacy=&ts=1659710464819.3&ri=70&ru=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fcm%3Fid%3Dc6a5ba0d-ce02-41bd-a1ea-842c68bd5108%26ph%3D8f5ed5d4-642c-4222-968a-d709c87ac3c8%26us_privacy%3D%24%7BUS_PRIVACY%7D%26r%3Dhttps%253A%252F%252Fevents-ssc.33across.com%252Fmatch%253Fliv%253Dg%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D70%2526external_user_id%253D HTTP 302
  • https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Request Chain 406
  • https://ssc-cms.33across.com/ps/?us_privacy=&ts=1659710464819.1&ri=2&ru=https%3A%2F%2Fssum-sec.casalemedia.com%2Fusermatchredir%3Fs%3D191740%26us_privacy%3D%24%7BUS_PRIVACY%7D%26cb%3Dhttps%253A%252F%252Fevents-ssc.33across.com%252Fmatch%253Fliv%253Dg%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D2%2526external_user_id%253D HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=191740&us_privacy=&cb=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D2%26external_user_id%3D HTTP 302
  • https://events-ssc.33across.com/match?liv=g&us_privacy=&bidder_id=2&external_user_id=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140
Request Chain 407
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=104&us_privacy=&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D%26xi%3D45%26xu%3D%7BuserId%7D HTTP 302
  • https://tags.bluekai.com/site/17724?id=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D%26xi%3D45%26xu%3D677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341 HTTP 302
  • https://ssc-cms.33across.com/ps/?us_privacy=&xi=45&xu=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341 HTTP 302
  • https://events-ssc.33across.com/match?bidder_id=45&external_user_id=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&ts=1659710465&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 408
  • https://ssc-cms.33across.com/ps/?us_privacy=&ts=1659710464819.4&ri=90&ru=https%3A%2F%2Fib.adnxs.com%2Fgetuid%3Fhttps%253A%252F%252Fevents-ssc.33across.com%252Fmatch%253Fliv%253Dg%2526us_privacy%253D%24%7BUS_PRIVACY%7D%2526bidder_id%253D90%2526external_user_id%253D%2524UID HTTP 302
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D90%26external_user_id%3D%24UID HTTP 302
  • https://events-ssc.33across.com/match?liv=g&us_privacy=&bidder_id=90&external_user_id=2739567155738641687
Request Chain 410
  • https://bttrack.com/pixel/cookiesync?source=2c3b95b9-6513-42b2-beb7-260851c73b75&secure=1&us_privacy=&cb=1659710464819.6 HTTP 302
  • https://ssc-cms.33across.com/ps/?xi=66&us_privacy=&xu=060b4244-ee38-489d-b7ed-1a0a44b9f67a HTTP 302
  • https://events-ssc.33across.com/match?bidder_id=66&external_user_id=060b4244-ee38-489d-b7ed-1a0a44b9f67a&ts=1659710464&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 412
  • https://c1.adform.net/serving/cookie/match?party=14&cid=52C108B0-611A-4584-A232-D339F84A7A29 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=52C108B0-611A-4584-A232-D339F84A7A29
Request Chain 413
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Yu0r-gAENBckxgA0&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D52C108B0-611A-4584-A232-D339F84A7A29 HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=52C108B0-611A-4584-A232-D339F84A7A29
Request Chain 414
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:3d9b62ed-2bff-4400-97d4-14b35df0617d&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D52C108B0-611A-4584-A232-D339F84A7A29 HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=52C108B0-611A-4584-A232-D339F84A7A29
Request Chain 415
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent= HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCQ28wN0YybGdBQUJDUHRVM0Z2dw&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
  • https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AABCo07F2lgAABCPtU3Fvw&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsas%252Cpp%252Cpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2 HTTP 307
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas,pp,pm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=2 HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABCo07F2lgAABCPtU3Fvw HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Request Chain 417
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=UsEIsGEaRYSiMtM5-Ep6KQ%3D%3D HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Request Chain 418
  • https://idsync.rlcdn.com/420486.gif?partner_uid=52C108B0-611A-4584-A232-D339F84A7A29 HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=efd7dac1fb47182e4e5df67f4ab694c6ec5c4bb52befa568d585b2a064f21d53791426b5417dce21&_=2 HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBlZmQ3ZGFjMWZiNDcxODJlNGU1ZGY2N2Y0YWI2OTRjNmVjNWM0YmI1MmJlZmE1NjhkNTg1YjJhMDY0ZjIxZDUzNzkxNDI2YjU0MTdkY2UyMRAAGgwIgdi0lwYSBAgCEABCAEoA HTTP 302
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBlZmQ3ZGFjMWZiNDcxODJlNGU1ZGY2N2Y0YWI2OTRjNmVjNWM0YmI1MmJlZmE1NjhkNTg1YjJhMDY0ZjIxZDUzNzkxNDI2YjU0MTdkY2UyMRAAGgwIgdi0lwYSBAgCEABCAEoA&google_gid=CAESEJRCSiZLJsg2L-nAIvUGkfQ&google_cver=1 HTTP 307
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
  • https://idsync.rlcdn.com/458249.gif?partner_uid=ebe91ff2-a33a-4611-a642-90ff34fac4c9
Request Chain 419
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=3d9b62ed-2bff-4400-97d4-14b35df0617d
Request Chain 420
  • https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:ADE529A5AF7E4EC0BD84D098CEDEE4E8 HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=52C108B0-611A-4584-A232-D339F84A7A29&redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-4CvjToBE2uUBlwqXOzxMEp7UMYq80nw-~A&gdpr=0&gdpr_consent=
Request Chain 421
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3305665001870070297&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=52C108B0-611A-4584-A232-D339F84A7A29&redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-4CvjToBE2uUBlwqXOzxMEp7UMYq80nw-~A&gdpr=0&gdpr_consent=
Request Chain 422
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=5e1b1e00-4929-4a58-9799-282bf9b88b13 HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=52C108B0-611A-4584-A232-D339F84A7A29&redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-4CvjToBE2uUBlwqXOzxMEp7UMYq80nw-~A&gdpr=0&gdpr_consent=
Request Chain 425
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=medianet HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=medianet
Request Chain 426
  • https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Drkt%26refUrl%3D%26vid%3D97104649183027120641454728000V10%26ovsid%3D%7Buserid%7D HTTP 302
  • https://contextual.media.net/cksync.html?cs=8&vsid=3027120641454728000V10&type=rkt&refUrl=&vid=97104649183027120641454728000V10&ovsid=1797288115146808421
Request Chain 427
  • https://medianet-match.dotomi.com/match/bounce/current?version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Dcon%26refUrl%3D%26vid%3D97104649183027120641454728000V10%26ovsid%3D%24UID HTTP 302
  • https://medianet-match.dotomi.com/match/bounce/current?DotomiTest=26846092957208e6&is_secure=true&version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Dcon%26refUrl%3D%26vid%3D97104649183027120641454728000V10%26ovsid%3D%24UID HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=con&refUrl=&vid=97104649183027120641454728000V10&ovsid=AAADKVTuFEs4ugNmwCf-AAAAAAA&expiration=1659796865&is_secure=true
Request Chain 428
  • https://us-u.openx.net/w/1.0/cm?id=78e2dffc-bb89-4bb2-ae92-f592d006518b&ph=6a16560a-f6c6-4851-b7b5-0b2c0190166a&r=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Dopx%26refUrl%3D%26vid%3D97104649183027120641454728000V10%26ovsid%3D HTTP 302
  • https://contextual.media.net/cksync.html?cs=8&vsid=3027120641454728000V10&type=opx&refUrl=&vid=97104649183027120641454728000V10&ovsid=93d8b6f4-533b-4188-b1ae-ac5e7919ebe5
Request Chain 429
  • https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Dmma%26refUrl%3D%26vid%3D97104649183027120641454728000V10%26ovsid%3D%5BMM_UUID%5D HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=mma&refUrl=&vid=97104649183027120641454728000V10&ovsid=3d9b62ed-2bff-4400-97d4-14b35df0617d
Request Chain 430
  • https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Dr1%26refUrl%3D%26vid%3D97104649183027120641454728000V10%26ovsid%3D%5BRX_UUID%5D HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005&rndcb=4897966379 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=cf57a75d-4f5e-49b9-b35a-536b2987624c&google_hm=Y2Y1N2E3NWQtNGY1ZS00OWI5LWIzNWEtNTM2YjI5ODc2MjRj HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEPKjyge_kAq5cXxKreIHl68&google_cver=1&ssp=adconductor&bsw_param=cf57a75d-4f5e-49b9-b35a-536b2987624c HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/cf57a75d-4f5e-49b9-b35a-536b2987624c?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005?redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Dr1%26refUrl%3D%26vid%3D97104649183027120641454728000V10%26ovsid%3DRX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005 HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=r1&refUrl=&vid=97104649183027120641454728000V10&ovsid=RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005
Request Chain 431
  • https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MzAyNzEyMDY0MTQ1NDcyODAwMFYxMA%3D%3D&google_sc=1 HTTP 302
  • https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEFgMg3usawxqdfA6VaByDpo&google_cver=1
Request Chain 432
  • https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Ddxu%26refUrl%3D%26vid%3D97104649183027120641454728000V10%26ovsid%3D_wfivefivec_ HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=dxu&refUrl=&vid=97104649183027120641454728000V10&ovsid=fYkDlbmh1OjYvA5
Request Chain 433
  • https://dis.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40 HTTP 302
  • https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=bf233d43-c5a0-435a-a69f-8266f03c4e1a
Request Chain 434
  • https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1 HTTP 302
  • https://t.pswec.com/bsw_sync?ssp=medianet&bsw_user_id=cf57a75d-4f5e-49b9-b35a-536b2987624c HTTP 302
  • https://t.pswec.com/ul_cb/bsw_sync?ssp=medianet&bsw_user_id=cf57a75d-4f5e-49b9-b35a-536b2987624c HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=2&user_id=73f090ab-bdec-4945-8da9-a0da1a2d146b&expires=3&user_group=1&ssp=medianet HTTP 302
  • https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=cf57a75d-4f5e-49b9-b35a-536b2987624c&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 435
  • https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Dzem%26refUrl%3D%26vid%3D97104649183027120641454728000V10%26ovsid%3D__ZUID__ HTTP 302
  • https://stags.bluekai.com/site/23178?id=jTKicE_GJ9EQ0uhYWhcr&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPLKKRFWSY2FL5DUUOKFKEYHK2CZK5UGG4RGOJSWMVLSNQ6SM5DZOBST26TFNUTHM2LEHU4TOMJQGQ3DIOJRHAZTAMRXGEZDANRUGE2DKNBXGI4DAMBQKYYTAJTWONUWIPJTGAZDOMJSGA3DIMJUGU2DOMRYGAYDAVRRGA HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPLKKRFWSY2FL5DUUOKFKEYHK2CZK5UGG4RGOJSWMVLSNQ6SM5DZOBST26TFNUTHM2LEHU4TOMJQGQ3DIOJRHAZTAMRXGEZDANRUGE2DKNBXGI4DAMBQKYYTAJTWONUWIPJTGAZDOMJSGA3DIMJUGU2DOMRYGAYDAVRRGA HTTP 302
  • https://contextual.media.net/cksync.php?cs=8&ovsid=jTKicE_GJ9EQ0uhYWhcr&refUrl=&type=zem&vid=97104649183027120641454728000V10&vsid=3027120641454728000V10
Request Chain 436
  • https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=3027120641454728000V10 HTTP 302
  • https://contextual.media.net/cksync.php?type=mf&ovsid=6d33763a-bcfb-43c0-8f79-5c0c6a498cb9&cs=1
Request Chain 438
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cs.media.net/cksync?cs=1&type=ttd&ovsid=5e1b1e00-4929-4a58-9799-282bf9b88b13
Request Chain 439
  • https://cs.media.net/cksync?cs=35&type=tam&ovsid=setstatuscode&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fdcm%3Fpid%3Ddcd3b62c-7a4b-4d79-a73e-c47474a8ab42%26id%3D3027120641454728000V10%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=dcd3b62c-7a4b-4d79-a73e-c47474a8ab42&id=3027120641454728000V10&gdpr=0&gdpr_consent=
Request Chain 442
  • https://i.w55c.net/ping_match.gif?ei=OPENX&rurl=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_ HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072979&val=fYkDlbmh1OjYvA5
Request Chain 443
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=1339413300440423216
Request Chain 444
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=d8Xn0XOV5NFsweeCIMevjXCSu4NslrvWcpGMBTMp
Request Chain 445
  • https://x.bidswitch.net/sync?ssp=openx HTTP 302
  • https://sync.srv.stackadapt.com/sync?nid=50&gdpr=&gdpr_consent=&gdpr_pd=&ssp=openx HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=188&user_id=6_XrCJGTQqVPxVrU8Wo7oJU4mbM&user_group=1&ssp=openx HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072968&val=cf57a75d-4f5e-49b9-b35a-536b2987624c&gdpr=&gdpr_consent=
Request Chain 446
  • https://p.rfihub.com/cm?pub=25&in=1 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073062&val=1797288115146808421
Request Chain 447
  • https://um.simpli.fi/ox_match HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072966&val=ADE529A5AF7E4EC0BD84D098CEDEE4E8
Request Chain 448
  • https://i.liadm.com/s/57424?bidder_id=206088&bidder_uuid=5b4203ef-cfe1-4119-9067-2e364160b8d6 HTTP 303
  • https://i.liadm.com/s/57424?bidder_id=206088&bidder_uuid=5b4203ef-cfe1-4119-9067-2e364160b8d6&_li_chk=true&previous_uuid=d0f383f5f9f147d296c8c7af8c030420 HTTP 303
  • https://i.liadm.com/s/64716?md5=&sha1=&sha2=&bidder_id=206088&bidder_uuid=5b4203ef-cfe1-4119-9067-2e364160b8d6&previous_uuid=9e1f8546616546049fd55f7b5b6c237f HTTP 303
  • https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!{TURN_UUID} HTTP 302
  • https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=3305665001870070297 HTTP 303
  • https://i6.liadm.com/s/53233?bidder_id=183658&bidder_uuid=3305665001870070297
Request Chain 451
  • https://aorta.clickagy.com/pixel.gif?ch=4&cm=447aeb8e-aa41-4726-a474-49712fc47708&redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537073026%26val%3D%7Bvisitor_id%7D HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073026&val=c:cc7af9c12b90d058d68105cfddcc4a9b
Request Chain 452
  • https://match.prod.bidr.io/cookie-sync/ie HTTP 303
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AABCo07F2lgAABCPtU3Fvw&expiration=1660920065
Request Chain 453
  • https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1 HTTP 302
  • https://casale-match.dotomi.com/match/bounce/current?DotomiTest=44d15bf32c1a08e4&is_secure=true&networkId=19998&version=1 HTTP 302
  • https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAADKVTuFEs4vgNvsPt1AAAAAAA&expiration=1659796865&is_secure=true
Request Chain 454
  • https://c1.adform.net/serving/cookie/match?party=29 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=1339413300440423216&expiration=1660920065
Request Chain 455
  • https://pixel.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=SZI6v03COb9SljrsHpBy407FZu1SwWa4TMZK_mqi
Request Chain 456
  • https://sync.srv.stackadapt.com/sync?nid=68 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=6_XrCJGTQqVPxVrU8Wo7oJU4mbM
Request Chain 457
  • https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB&gdpr_consent=&us_privacy=&gdpr= HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/casale/Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB
Request Chain 458
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48 HTTP 302
  • https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&gdpr=0&gdpr_consent=
Request Chain 459
  • https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum&cm_dsp_id=131&cm_user_id=Yu0r-GZu4dfEMT1ZXkpk7AAA HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum&cm_dsp_id=131&cm_user_id=Yu0r-GZu4dfEMT1ZXkpk7AAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662292708841638
Request Chain 464
  • https://pixel.rubiconproject.com/exchange/sync.php?p=medianet&khaos=L6GKR815-T-8KOJ HTTP 302
  • https://contextual.media.net/cksync.php?type=rbcn&ovsid=L6GKR815-T-8KOJ

468 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/
Redirect Chain
  • https://ejyazl.clicks.mlsend.com/te/cl/eyJ2Ijoie1wiYVwiOjEwOTEyMSxcImxcIjo2MjUyMTU1ODk0MzQwMTM0MixcInJcIjo2MjYxMDczMzY2MTE2MTE3NH0iLCJzIjoiNGNlOTJiZGRkNGE5ZDY1NyJ9
  • https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+...
70 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.60.209 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
45ee3b2409a4a573217d9cfda3544824c61cc2db05814b64e74aac8facdd4265
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-cache, no-store, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
73604a8189dfe768-EWR
content-encoding
br
content-security-policy
upgrade-insecure-requests;
content-type
text/html; charset=UTF-8
date
Fri, 05 Aug 2022 14:40:59 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
0
last-modified
Thu, 28 Jul 2022 16:33:45 GMT
pragma
no-cache
server
cloudflare
vary
Accept-Encoding,User-Agent
x-frame-options
SAMEORIGIN

Redirect headers

cache-control
no-cache, private
cf-cache-status
DYNAMIC
cf-ray
73604a7e4ffc713c-YUL
content-type
text/html; charset=UTF-8
date
Fri, 05 Aug 2022 14:40:59 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location
https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bbq37Tmdh%2B23Gki4Oa4q%2BHGY%2Br14S1GRk67eptRHsk8Ax6vdjV6gEgmL7zykceTkCqoRgoPaZ69jQLHq6eDGExguwROgcqLsHP%2F43IgKG9njET7UatjkUKPMpdxRnp6aHI48nKlyxumcPa34Pxe9OLypVIpu7A%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=15724800; includeSubDomains
x-powered-by
PHP/8.0.13
css
fonts.googleapis.com/ 		13 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::200a New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
8c44af787f51e875d3ecc44f5bb1989fce5aeeaa1a48cc0851aec4344b5e6d73
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 05 Aug 2022 14:38:15 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Fri, 05 Aug 2022 14:40:59 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 05 Aug 2022 14:40:59 GMT
bootstrap.min.css
www.bleepstatic.com/js/redesign/bootstrap/css/ 		119 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/bootstrap/css/bootstrap.min.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
938
last-modified
Wed, 13 Feb 2019 14:22:49 GMT
server
cloudflare
etag
W/"624975547"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0KlsjrOGEj6vhpN0q0%2BGVZw7HqvIkBZ1jVGwcHPIH%2BId2bAgsIUheFmZdpJzjelrVs1QIbjd7LRPs29ntnuxps5RIEQq0eCGX30%2FBA8CW1LgjNiLSzJJSok8KDSuUmfMU3SA6qc%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
73604a850a763ff8-YYZ
expires
Tue, 10 May 2022 05:51:38 GMT
main.css
www.bleepstatic.com/css/redesign/ 		52 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0b37f3d8aa5e1f298bf71477c945f576745020ce44f048ec67e19a93cd285372

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3367
cf-polished
origSize=62676
last-modified
Tue, 27 Apr 2021 20:09:53 GMT
server
cloudflare
etag
W/"2761713618"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qvfwjtdGYM5erfcU49ZlGhEfoqosUZ7hH%2BDVuus0QRAGs019tgHNd1vwL890y3pOIMTbKJujNmKMkIiPBNZ7EEMPWbbtr7J34M%2FbH6AAfG2o4vh%2FOYyg4CSuTCzLL74Wrd0VLeo%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Tue, 10 May 2022 02:04:36 GMT
cache-control
max-age=3024000
cf-ray
73604a850a773ff8-YYZ
cf-bgj
minify
home.css
www.bleepstatic.com/css/redesign/ 		12 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/css/redesign/home.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca22345f969dd8077c21281572a34d4a51bc6a5ad9d764bd1338b2c12a68c3e3

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
5106
cf-polished
origSize=15024
last-modified
Sat, 21 Nov 2020 17:53:40 GMT
server
cloudflare
etag
W/"2807382579"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0%2BRNkWi3MGuM%2BJAAwlFNVey9U%2F7VSrNXTtdAf3KLqIfP%2BzKb1f3gRV%2BmnrP3T5VoEyryn83L9xwamj8xtOs2fsoaKtXyApGcHPZqgCMPCvy4T4J4%2B%2B7EgMfkRRJDpvT0Z3cQesU%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Fri, 08 Apr 2022 11:24:10 GMT
cache-control
max-age=3024000
cf-ray
73604a850a783ff8-YYZ
cf-bgj
minify
news.css
www.bleepstatic.com/css/redesign/ 		27 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/css/redesign/news.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4901b094a91ea6d5aba73774bb9803fdca22599cfca597ef81249225b5ed01b4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2489110
cf-polished
origSize=33102
last-modified
Tue, 24 Aug 2021 22:50:05 GMT
server
cloudflare
etag
W/"57477024"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=84X3RK2q8kxOO1OltZj2KX4QfufWN4EgNbUdhe2hMEFQm52e8FtEDjpiorfQWGtBgTtLPEd0DNQ95PwLBoJzanBCXYAPNHsEW%2FZQg3EkqXC%2BncC533uxrBiXjkWKbcmAOuGJ8MA%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Thu, 11 Aug 2022 19:15:49 GMT
cache-control
max-age=3024000
cf-ray
73604a850a793ff8-YYZ
cf-bgj
minify
jquery-3.5.1.min.js
www.bleepstatic.com/js/redesign/ 		87 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/jquery-3.5.1.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
6003
last-modified
Mon, 04 May 2020 23:02:39 GMT
server
cloudflare
etag
W/"1177690299"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SR5W%2F24N5%2FNGTeQy%2BHyr1X5nFW1%2F3%2BCe2M65G%2BXHQ49t6u3sBpAV9JVXLrHHJrM1Ik7YWhoN%2BpjilesN13MKDMLQnhnVnmZVjhL%2FsP%2FbiXea%2FcDMlLknbt3DvqCdelUJN3j8uWE%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
73604a850a7a3ff8-YYZ
expires
Fri, 08 Apr 2022 11:24:10 GMT
jquery-migrate-1.4.1.min.js
www.bleepstatic.com/js/redesign/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/jquery-migrate-1.4.1.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
6003
last-modified
Fri, 20 May 2016 01:26:30 GMT
server
cloudflare
etag
W/"2177127834"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=avWZoB2LTTbFRWpGfjH3e2Ylf8xRs%2BrEwO%2FawWovUTUu7eIixOKmJds2zDfrw87GPcvYf0ahmODa%2F6Hhk0VEdGP%2FP3XaGJSKXwlOfAUneR%2B%2BA1ewcKxi%2FBJra9YQr8eYxb2P0z8%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
73604a850a7b3ff8-YYZ
expires
Fri, 08 Apr 2022 18:29:01 GMT
news.js
www.bleepstatic.com/js/redesign/ 		183 B
470 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/news.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
827252be04765631f8ff21fee8ffe1028e27dfa52f62c08ef3182609a0a0e991

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2931
cf-polished
origSize=247
last-modified
Wed, 16 Dec 2015 15:41:46 GMT
server
cloudflare
etag
W/"4218930423"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ldkxlUDz%2F0W5uPFkMwRwoRIVxE09ysfAWs0FuN7NwJFCJrQhlzNXa9vFcnaxG8xPU90goHXlmHQMMNi%2BXYVkTEDKFqK7v13Xictr2TR33TE8SGrUS0p7gR%2BJc8sm4Lq4DKcE7sw%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
expires
Tue, 10 May 2022 05:51:37 GMT
cache-control
max-age=3024000
cf-ray
73604a858af33ff8-YYZ
cf-bgj
minify
cls.css
a.pub.network/core/pubfig/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/pubfig/cls.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d510e16e6e569e573980fd67a55221795d539fd56688ecaca8d284255e86ee6

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-goog-hash
crc32c=kjwd8A==, md5=KtQsmezne0blpCqFIHo3UA==
date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-guploader-uploadid
ADPycdt-blsW_Evg6Qs2xjJK9M0by4j3C3KeaOHKT6Ecd-wrZ_chFeiGKw2x4-iYkv3CgEvn9XDKJQqp5yumS05-8BbJddKcUYLT
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
content-type
text/css
last-modified
Tue, 11 May 2021 20:31:48 GMT
server
cloudflare
etag
W/"2ad42c99ece77b46e5a42a85207a3750"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z0jRBdPG6FBkHtd2C3luierQIa4zWrPgHQhsbYrYqkpVNWHwGEa9Go8NQVnXfdO5%2Fc6yfQLy0o3FscWELwflyKvKzR%2FstNhk9TIXG%2F6VwssWDbftvrtnvcl3HW7CRE6PFXoDw2BHTz28ses%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1620765108454625
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=3600
x-goog-stored-content-length
1752
cf-ray
73604a84e84e713e-YUL
expires
Fri, 05 Aug 2022 15:04:31 GMT
pubfig.min.js
a.pub.network/bleepingcomputer-com/ 		138 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7be08fa39b228a6d403237a8fb2be3078d3744e1ed3b325c50184172a2153767

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-goog-hash
crc32c=Sc03sQ==, md5=ZJo3K9sxndeEW7Inb4mNYQ==
date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-guploader-uploadid
ADPycdt_sSAJUuOwC3BO5NGT1oIYTP41EMWTO4s7FWSYYPvKlfVeCFbQ2e9tUFw2XSzqMKel92jjZhFKR9PYJyT9EdOEOKw6MH_X
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-type
application/javascript
last-modified
Thu, 28 Jul 2022 14:57:02 GMT
server
cloudflare
etag
W/"649a372bdb319dd7845bb2276f898d61"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E3%2FcK%2FkYY2vuQbMyehVOJeapbUEY9L%2FoWWzVYu9BkAK7BrfBwSVy%2BTT7vsLDhJSwPf%2F7QiBLl0%2BRYQEH%2FfqMwqgaiR6mYVVzuuhPydWkOnqaJJjaEJcM5zcWg7ZXILAAweaRRW3F6bN38bo%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1659020222021200
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=1800
x-goog-stored-content-length
141332
cf-ray
73604a85894b713e-YUL
expires
Tue, 02 Aug 2022 16:02:13 GMT
js
www.googletagmanager.com/gtag/ 		109 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-91740-1
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2008 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
54d48ce61e8a34b10a7664b5df1391be4d8d5b9569fa316a1c6d99bf0ddd4468
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42925
x-xss-protection
0
expires
Fri, 05 Aug 2022 14:40:59 GMT
logo.png
www.bleepstatic.com/images/site/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/logo.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
154200
cf-polished
origFmt=png, origSize=1882
content-disposition
inline; filename="logo.webp"
content-length
1152
last-modified
Sat, 04 Mar 2017 04:12:00 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kzITw4DKMoe0rCbzNM02l5%2FRZYSq2rFqywwIDrRy6UIpj%2BZWyAxaEn8oononwNYH4CJuEsmjSKuasPmsp6AMoNCSerJga7hwxg0INqIvdvdnWXibNinvuxhLQ4j%2BcJlolY13jmw%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 02 Sep 2022 19:50:59 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a858afa3ff8-YYZ
cf-bgj
imgq:85,h2pri
brandjs.js
www.gstatic.com/prose/
Redirect Chain
  • https://www.google.com/coop/cse/brand?form=cse-search-box&lang=en
  • https://www.gstatic.com/prose/brandjs.js
14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/prose/brandjs.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Server
2607:f8b0:4006:820::2003 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6395e6f9f6fbcd953f0ffa40615094c565d86c265fb5028e64dd2dc872b5ce69
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 04 Aug 2022 20:15:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
66303
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5807
x-xss-protection
0
last-modified
Tue, 06 Apr 2021 15:14:29 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type
text/javascript
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="prose-team"
expires
Fri, 05 Aug 2022 20:15:56 GMT

Redirect headers

date
Fri, 05 Aug 2022 14:20:29 GMT
x-content-type-options
nosniff
server
sffe
age
1230
content-type
text/html; charset=UTF-8
location
https://www.gstatic.com/prose/brandjs.js
cache-control
public, max-age=1800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
237
x-xss-protection
0
expires
Fri, 05 Aug 2022 14:50:29 GMT
man-in-hood-typing.jpg
www.bleepstatic.com/content/hl-images/2022/07/07/ 		107 KB
107 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/content/hl-images/2022/07/07/man-in-hood-typing.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2d133a459f387f3b40062c6d4c300ba6bb2ae97b51d2ab3a6f9529f947f71a1f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
944594
cf-polished
qual=85, origFmt=jpeg, origSize=364617
content-disposition
inline; filename="man-in-hood-typing.webp"
content-length
109364
last-modified
Thu, 07 Jul 2022 13:59:33 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RBNJ%2F20idgKAGCYd6P6bJBiq360GiEPRanF%2FEdILkb0OyRAwm7Zf9jolo5G%2Fos5GcNVSiYVfTY7DKD9odXzEseSj0faH8QunEnloGe0clVO9DD1G0cW%2FvATamX2nfw9nN44wssw%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Wed, 24 Aug 2022 16:17:45 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a858afb3ff8-YYZ
cf-bgj
imgq:85,h2pri
SHARPEXT-Process-Flow.png
www.bleepstatic.com/images/news/u/1109292/2022/ 		321 KB
321 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/news/u/1109292/2022/SHARPEXT-Process-Flow.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0b93c317eebe6c627afb454e7e0f8ac61be284b72294e285fa5075fe32eba70

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
688432
cf-polished
origFmt=png, origSize=537666
content-disposition
inline; filename="SHARPEXT-Process-Flow.webp"
content-length
328308
last-modified
Thu, 28 Jul 2022 14:44:01 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OmS6xkOtdISw6KEkHY%2Fe7vXC%2ByX%2FCdrmfjebcSgBsKEdrIMZwrIU08hWE5UoBZ1gwPGD2NNyysiJdFVmTvsz6%2BT6DyyUx1NrhEnnd2Ph3DsbQ3uOXtP4GxwuQc7%2FPEnqZegQ5S8%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 27 Aug 2022 15:27:07 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a858afe3ff8-YYZ
cf-bgj
imgq:85,h2pri
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		168 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3944260a019167894c628f2f937b1288fe4ed83c10afd0152b9af3f7d5e8c29f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
57343
x-xss-protection
0
server
cafe
etag
4354643195132295874
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 05 Aug 2022 14:41:00 GMT
twitter.png
www.bleepstatic.com/images/site/login/ 		282 B
639 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/login/twitter.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
151581
cf-polished
origFmt=png, origSize=475
content-disposition
inline; filename="twitter.webp"
content-length
282
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ogc19Z9mMyyOXb%2FK3acrn7T1q3En7f7ptQ81y%2FCH6sR5S3mSEKYyub3y2GWaU016JCoON5ZTYXgLJXM5q2mvuIQQlWHyCk06gLsmgZsrBqFNHcePQ8EtY73PMStCq9alZ%2BOpyNY%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 02 Sep 2022 20:34:38 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a858aff3ff8-YYZ
cf-bgj
imgq:85,h2pri
bootstrap.js
www.bleepstatic.com/js/redesign/bootstrap/js/ 		50 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/bootstrap/js/bootstrap.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c13d034eaf2fa73680d0abdbe02ac23b73e3128b5c7f0ee7018eb7b3fbe84a72

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
133
cf-polished
origSize=75484
last-modified
Wed, 13 Feb 2019 14:22:49 GMT
server
cloudflare
etag
W/"984724076"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ba3Ip61umKunPa1EjhB446uzuq8Z8j8yigNDiNLz7PT1vtLJ%2BuZ4b7D7zZZMGb2C0Vscms0HVrNrBmGXth0h2znp2h7m6rQFL78logka75Wpoy21O5Jlo5JT8miNOX25MoZ6rek%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
expires
Tue, 10 May 2022 05:51:38 GMT
cache-control
max-age=3024000
cf-ray
73604a858b013ff8-YYZ
cf-bgj
minify
blazy.min.js
www.bleepstatic.com/js/blazy/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/blazy/blazy.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f427d0f88a0698c955ff63bf13af4ca80c9b32f218b5e210847450da901a74f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
6003
last-modified
Thu, 16 Aug 2018 21:06:19 GMT
server
cloudflare
etag
W/"753357888"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VrsR7TqSgWO6G0pgDBeq0Y6w08N2y68xm3pGcxYKQZ49gen93nKtp7fvM2eps3hEPeX3vKostpk%2F2ZhLV0lk%2BGPJ1QYpX%2FFoTN%2BMJjecIlW8T%2FBVGx619wR3%2BsNxJTpHSd0KK1k%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
73604a853aaf3ff8-YYZ
expires
Mon, 25 Apr 2022 16:40:10 GMT
bleep.js
www.bleepstatic.com/js/redesign/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/bleep.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22e977346d45bab9f531ce1132d7ecfbe8e46868eaea790a0d4dcd1d0649d74b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2326
cf-polished
origSize=3600
last-modified
Mon, 01 Oct 2018 12:47:57 GMT
server
cloudflare
etag
W/"2696894447"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GHRBzimjUgZjaf145u7cICSxyQBzqUqBfrHejNxXM6IMZRGVA6uS4UvUtjWQ1lEy%2FNpOMuy5y8zLkxYVFpJcqC1vLum%2B%2FINMhESyXbL51kFM%2BxyvfsLymV1iJ5Nakzc3qukY6%2BQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
expires
Mon, 25 Apr 2022 16:40:10 GMT
cache-control
max-age=3024000
cf-ray
73604a858b023ff8-YYZ
cf-bgj
minify
jquery.fancybox.js
www.bleepstatic.com/js/redesign/fancybox/ 		31 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
31cd7d9398307ca2e6cfaa111bbe7b69d69cbaaed2ff74034412ebc5008671fd

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2931
cf-polished
origSize=48706
last-modified
Wed, 14 Oct 2015 20:25:51 GMT
server
cloudflare
etag
W/"327140449"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Iby8jQMy9T6Lsi9gmWxQSoMpr3MlV2GACARjVlDiVxkO5XYkytytnuZV%2Fl2533OV8iHw952s3LRK%2Bk9gm2CpgD65FmCLJrHQ%2FnvpBauj8G%2FUZ6Ln5cX%2BSWX4xs7ZMYTTy7RBJY8%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
expires
Tue, 10 May 2022 05:51:38 GMT
cache-control
max-age=3024000
cf-ray
73604a858b033ff8-YYZ
cf-bgj
minify
fixto.min.js
www.bleepstatic.com/js/fixto/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/fixto/fixto.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1771
last-modified
Sat, 13 Jun 2015 21:34:42 GMT
server
cloudflare
etag
W/"1740214911"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zX2C6ZaUyq5aS9osQ1upleAN4ZMJlhYkNEWvinyeTVskkhwTKYFwzMRWy6%2FKyAdHvQc3hCrkuJmWYGLvRsuci5xSuNZnCTnCkW2JzxY%2BvrlqLlHB1JsRgTFAmNEQoitZuu95DGI%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
73604a854aba3ff8-YYZ
expires
Sun, 24 Apr 2022 23:30:26 GMT
addthis_widget.js
s9.addthis.com/js/300/ 		353 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s9.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
cache-control
public, max-age=600
date
Fri, 05 Aug 2022 14:40:59 GMT
x-host
s9.addthis.com
content-length
116332
v652eace1692a40cfa3763df669d7439c1639079717194
static.cloudflareinsights.com/beacon.min.js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:440e::6812:2fe6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Referer
https://www.bleepingcomputer.com/
Origin
https://www.bleepingcomputer.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
gzip
last-modified
Thu, 09 Dec 2021 19:55:17 GMT
server
cloudflare
etag
W/2021.12.0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
73604a85bddc4bbf-YUL
connatix.playspace.js
cds.connatix.com/p/174545/ Frame A76C
Redirect Chain
  • https://cd.connatix.com/connatix.playspace.js
  • https://cds.connatix.com/p/174545/connatix.playspace.js
974 KB
221 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/174545/connatix.playspace.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e812a1ff304fda278e8742be6a70d0e2f0f6008c15d0ebfdb864219c3046eab9

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
last-modified
Fri, 05 Aug 2022 11:57:30 GMT
age
1249
etag
"f064ccf151e16576c9ca41c48c65a0c5"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
226161

Redirect headers

location
https://cds.connatix.com/p/174545/connatix.playspace.js
date
Fri, 05 Aug 2022 14:40:59 GMT
cache-control
no-cache, no-store, must-revalidate, max-age=0
accept-ranges
bytes
content-length
0
access-control-max-age
86400
fab.js
ecdn.analysis.fi/static/js/ 		4 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ecdn.analysis.fi/static/js/fab.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.106.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-106-5.jfk50.r.cloudfront.net
Software
nginx/1.20.0 /
Resource Hash
d8a34aeacc4054bd4e119e538c7eb4956421014f48a9b603d3f9314a7435b5a6

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:12:33 GMT
via
1.1 6104f765cfecf9c49eb7195c359eea46.cloudfront.net (CloudFront)
last-modified
Tue, 14 Dec 2021 15:30:51 GMT
server
nginx/1.20.0
age
1706
etag
"61b8b8ab-1090"
x-cache
Hit from cloudfront
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
x-amz-cf-pop
JFK50-P3
accept-ranges
bytes
content-length
4240
x-amz-cf-id
g9hfkS1FkVh346Jvdmfn-5S5NKrv-TcB_GrOMhY5ntO_cfXGixZrQw==
expires
Fri, 05 Aug 2022 15:12:33 GMT
fi_client.js
ecdn.firstimpression.io/ 		347 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ecdn.firstimpression.io/fi_client.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-114.ewr53.r.cloudfront.net
Software
nginx/1.20.0 / PHP/8.0.14
Resource Hash
32ca9c7e0e2a6157b7de311cff19c1549eeb9aae9a1735e5f885b44db5acd31d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 13:49:39 GMT
content-encoding
br
etag
W/"29af8451c24d2f5452fb5dfe052b9f9e"
last-modified
Fri, 05 Aug 2022 13:49:39 UTC
server
nginx/1.20.0
age
3080
x-powered-by
PHP/8.0.14
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 d7202b57803815a076179b3bb9bbd766.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR53-P1
x-amz-cf-id
waycBJZio2q299PLPZT-mqo8CpUWJyzTHd8lA-rYjkyfDUYuobHpjg==
x-xss-protection
0
truncated
/ 		37 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type
image/gif
login_bg.png
www.bleepstatic.com/images/site/ 		126 B
511 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/login_bg.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
160509
cf-polished
origFmt=png, origSize=187
content-disposition
inline; filename="login_bg.webp"
content-length
126
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PL3%2BNIE8anCAFPtmQTcD5%2BB4ysNc0N7ABfMZbq%2FbpvevHddBJfYIVEyV80hyoxGdfW2iOy5yZDfUdoUzxBXz%2B3jDmIyG42f0ehmGDTBC%2Fg4zIbZJrdI55Eob2n%2BtvzCgsHhD2bo%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 02 Sep 2022 18:05:49 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a858b043ff8-YYZ
cf-bgj
imgq:85,h2pri
nav_bg.png
www.bleepstatic.com/images/site/ 		72 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/nav_bg.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
154942
cf-polished
origFmt=png, origSize=83
content-disposition
inline; filename="nav_bg.webp"
content-length
72
last-modified
Sat, 04 Mar 2017 07:57:02 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LKsJGYsvkB8QqPA29AKrIVpPZ45QyNGNRF1ZK2augeNgBwvTGLXRENJNunWHZ8rMUJXqh%2BwF8UOCaHN5zsfxRUIKpJnvzBnHMSpVPfptnNqTPrbEMY%2Br8DD9fL3lM%2FpG50RTo9Q%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 02 Sep 2022 19:38:37 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a858b073ff8-YYZ
cf-bgj
imgq:85,h2pri
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::2003 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bleepingcomputer.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Wed, 03 Aug 2022 19:35:49 GMT
x-content-type-options
nosniff
age
155110
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 03 Aug 2023 19:35:49 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::2003 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bleepingcomputer.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Wed, 03 Aug 2022 19:31:57 GMT
x-content-type-options
nosniff
age
155342
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15860
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 03 Aug 2023 19:31:57 GMT
20x20-printer.png
www.bleepstatic.com/images/site/ 		422 B
805 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/20x20-printer.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
154174
cf-polished
origFmt=png, origSize=824
content-disposition
inline; filename="20x20-printer.webp"
content-length
422
last-modified
Sat, 03 Oct 2015 03:18:32 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fibrJ2a6VFuYCAtQKAAhRcK8kVrZTDMN8Z8z3Cuq4Ba1PWQpwFnhRjaeLMvd8oXXtAqF8pocrBQTstC5jf6IiwK%2BzVgko13ER%2BpxsEYfjQEQyC5BDT%2B8MXdkpKvE7WunV5BErUQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 02 Sep 2022 19:51:25 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a85ab1f3ff8-YYZ
cf-bgj
imgq:85,h2pri
calendar.png
www.bleepstatic.com/images/site/ 		86 B
464 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/calendar.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/news.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
161379
cf-polished
origFmt=png, origSize=129
content-disposition
inline; filename="calendar.webp"
content-length
86
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SWFa28Esy2vVWo1PbpIjKEf4hAcWFnobqj%2FhDZAybciUewT8Ksb6xXGnwOVaVakGO72S7%2FgxTO8gjqF7Vf15CiIbobJZli6ZEDZfdv6w5X9yhAMqAlhOIij1PIk3YfKAecxfDws%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 02 Sep 2022 17:51:20 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a85bb263ff8-YYZ
cf-bgj
imgq:85,h2pri
clock.png
www.bleepstatic.com/images/site/ 		252 B
678 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/clock.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9cdb6bfef8d4212d9bf634ca6724a28e85dfa69cd404e6f9d3760d70a7873949

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/news.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
149986
cf-polished
origFmt=png, origSize=1316
content-disposition
inline; filename="clock.webp"
content-length
252
last-modified
Fri, 29 May 2015 07:08:14 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FJseh%2Fx4aqYtpP7OxDeffMbr6P%2Fz5xLEmn5jawcBwkDgZxoDNFY1%2FOLmx%2FPrroCTGsmeHyKk3tQ6MtDGeTDycCSWFhnRMjd%2FHb51nyM%2FRVuFozhSsOuMX2VuqyShJCKhSrIpoi0%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 02 Sep 2022 21:01:13 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a85bb283ff8-YYZ
cf-bgj
imgq:85,h2pri
comment-light.png
www.bleepstatic.com/images/site/ 		94 B
652 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/comment-light.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/news.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cfac05f501d6d4d62e29fff1049569c3c2aa8732af8db3a36e8fa252f05f5861

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/news.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
155505
cf-polished
origFmt=png, origSize=1034
content-disposition
inline; filename="comment-light.webp"
content-length
94
last-modified
Fri, 29 May 2015 07:08:28 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6PyfgUEUGvrHrLksDiDqODv5V4nSVDdZl2MbpMmQDa6LOw8q%2BJY2VVIIQe5A4SlCQ%2Biz3T1btQX3pc9ZGUNbSAIflbnDM%2FYAhFAd4AUfcjRm9aVBAtMV460UdcrXUTEUt8enHRQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 02 Sep 2022 19:29:14 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a85bb293ff8-YYZ
cf-bgj
imgq:85,h2pri
32x32-printer.png
www.bleepstatic.com/images/site/ 		256 B
638 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/32x32-printer.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
153196
cf-polished
origFmt=png, origSize=618
content-disposition
inline; filename="32x32-printer.webp"
content-length
256
last-modified
Fri, 02 Oct 2015 21:57:19 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kXFnlmHGLixetlj3IIzVwfrjgzcphj2zdJg%2Fq1r5N83Jw6NXWl3CLlf2CD2ezQrmEpmmqJCC4FuARgr6nhLE73CdUELpU%2Btwzjr0dyvRFilaCzcBvOzxarif2poqybf51RENHX0%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 02 Sep 2022 20:07:42 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a85bb2a3ff8-YYZ
cf-bgj
imgq:85,h2pri
71f54ec34151fbdfe89e478d7b6e5ddf.jpg
www.bleepstatic.com/author/photos/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/author/photos/71f54ec34151fbdfe89e478d7b6e5ddf.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99887c8a3e382dd055b9504a2141c52fd90fa929ebf16f39ba8526a2c7110362

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
5474
cf-polished
degrade=85, origSize=6170, status=webp_bigger
content-length
5955
last-modified
Wed, 02 Jan 2019 02:04:38 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ps3NByvN9ZBmmeUX00KEheeOQ%2BLHOznJZpbn%2FBoY7X1uYM%2Fd055SGcUlRCq4L7dL0X%2F5HT2n2lcJSglbta%2BbC20qxLCN%2B6DeDvb4HNWQpkCM5enzu7Pw9Av7Fzqn55mRO%2BhnUlE%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
expires
Fri, 22 Apr 2022 18:57:33 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a85bb303ff8-YYZ
cf-bgj
imgq:85,h2pri
h4-bg.png
www.bleepstatic.com/images/site/ 		38 B
415 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/h4-bg.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
152604
cf-polished
origFmt=png, origSize=72
content-disposition
inline; filename="h4-bg.webp"
content-length
38
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8uPzWcylbyZzozUiHm2HIIYnVjyFBVtRQkVxR4z55jY9JZSehdoJVMo1455AEgUJgUWNN6iwxOKrI9Dug94rvNP58ZbqQp85QV8n%2FtmRIsZ8IF%2BJRjeGYxB0sXjtSBRtZ4Vo8to%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Fri, 02 Sep 2022 20:17:35 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a85bb313ff8-YYZ
cf-bgj
imgq:85,h2pri
news_email_icon.png
www.bleepstatic.com/images/site/ 		126 B
509 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/news_email_icon.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/home.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/home.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
588841
cf-polished
origFmt=png, origSize=1105
content-disposition
inline; filename="news_email_icon.webp"
content-length
126
last-modified
Fri, 29 May 2015 07:10:12 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R2igUMZTCWod0w3N%2F7MzqehuiasXgDWu7wmFK4QUMEme7ZcpJ0G1o19nbIJmTHS8%2BHoAFKdsyHgd9G3rsomXwPUenUIaNR9siYLLXTsrcNoerYB1k5XCPOK%2B63f804E11Wn0WfI%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sun, 28 Aug 2022 19:06:57 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a85bb323ff8-YYZ
cf-bgj
imgq:85,h2pri
news_footer_icon.png
www.bleepstatic.com/images/site/ 		110 B
521 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/images/site/news_footer_icon.png
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepstatic.com/css/redesign/main.css?v=04.27.21.7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2050
cf-polished
origFmt=png, origSize=186
content-disposition
inline; filename="news_footer_icon.webp"
content-length
110
last-modified
Sat, 04 Mar 2017 20:46:52 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bR4m25U8cFrNxp9b421%2FdKm%2B3wgtwbinDIsiDt7aooxKDeWsb%2B54vXIRCP%2FNe5BSUUiPesdUVVFGK4fIOoTI%2Fpr5mJHpVus2Xk%2BRWoVUOTqRtGKLmp6JXhA5c79H26RzprrH39Y%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Wed, 25 May 2022 18:30:01 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a85bb333ff8-YYZ
cf-bgj
imgq:85,h2pri
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::2003 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bleepingcomputer.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Wed, 03 Aug 2022 19:33:19 GMT
x-content-type-options
nosniff
age
155260
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15740
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 03 Aug 2023 19:33:19 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,300,500,700,900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::2003 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.bleepingcomputer.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Wed, 03 Aug 2022 19:32:09 GMT
x-content-type-options
nosniff
age
155330
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15920
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 03 Aug 2023 19:32:09 GMT
jquery.fancybox.css
www.bleepstatic.com/js/redesign/fancybox/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/js/redesign/fancybox/jquery.fancybox.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4581
cf-polished
origSize=4895
last-modified
Wed, 14 Oct 2015 20:25:51 GMT
server
cloudflare
etag
W/"9108074"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HBxVfB9J%2FqJVdO9uGzjHWV4LE9lCR23MkqMd1qmQpvKTfKxvInOEVRO7mbzAfnj0hYY%2B6KdZFjnUOmh%2FcHdHFs78CdyWHWt%2B1v52S35xfCjv8f467tJYQuoWbRmmavcKuz3CyYk%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Tue, 10 May 2022 07:58:58 GMT
cache-control
max-age=3024000
cf-ray
73604a865ba93ff8-YYZ
cf-bgj
minify
font-awesome.css
www.bleepstatic.com/css/redesign/ 		22 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/css/redesign/font-awesome.css
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8733e2183f16906b2fa2e58fdab82cf336f249ab71ac1b184470da2dd3c6e29f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2326
cf-polished
origSize=26776
last-modified
Tue, 03 May 2016 04:39:29 GMT
server
cloudflare
etag
W/"1700274315"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F8LWnC0HDT6DOSWJCXzINFXdsc%2BymFO7q4xChlWQeCEpgkN2Ri%2Bv24Uv%2FX9ZJh1nOsJa4%2Fvc6SaJoPvPtOaLsCeDQfOq0WIMADLOCPGx%2BDmLIpOBLgb2iiSXe5oWn9iBoL2UMBU%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
expires
Mon, 25 Apr 2022 13:46:26 GMT
cache-control
max-age=3024000
cf-ray
73604a865baa3ff8-YYZ
cf-bgj
minify
favicon.ico
ad.doubleclick.net/ 		1 KB
664 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.40.166 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s81-in-f6.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 05:35:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
32718
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
104
x-xss-protection
0
last-modified
Tue, 08 May 2012 13:08:06 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/x-icon
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sat, 06 Aug 2022 05:35:41 GMT
achoice.svg
widgets.outbrain.com/images/widgetIcons/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://widgets.outbrain.com/images/widgetIcons/achoice.svg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.29.129.105 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-29-129-105.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
last-modified
Sun, 03 Jul 2022 06:49:40 GMT
server
AkamaiNetStorage
etag
"9d26fa4e7238ed94f1d0d92afb453b3e:1656855957.074767"
access-control-allow-methods
GET,POST
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
max-age=2592000
access-control-allow-credentials
false
accept-ranges
bytes
timing-allow-origin
*, *
content-length
2735
expires
Sun, 04 Sep 2022 14:40:59 GMT
fontawesome-webfont.woff
www.bleepstatic.com/fonts/ 		64 KB
65 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.bleepstatic.com/fonts/fontawesome-webfont.woff?v=4.2.0
Requested by
Host: www.bleepstatic.com
URL: https://www.bleepstatic.com/css/redesign/font-awesome.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1

Request headers

Referer
https://www.bleepstatic.com/css/redesign/font-awesome.css
Origin
https://www.bleepingcomputer.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
cf-cache-status
HIT
last-modified
Thu, 23 Apr 2015 09:36:00 GMT
server
cloudflare
age
1233
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fk19KhpE52titC%2FalgW6Yv2Pu6f4gfohwMBAUUbeiPDBPMyG2XT6kN1XoFmsrS%2FlABdDT6O9SdFn52CDxNkU1PL%2F5gZFtU7nWdhMtwVqD10KGk6CT5kbemAg72Z5yq9mSv8TGI0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
access-control-allow-origin
*
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
73604a874e84a217-YYZ
content-length
65452
292x176_GitHub.jpg
www.bleepstatic.com/content/hl-images/2022/04/19/thumb/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/content/hl-images/2022/04/19/thumb/292x176_GitHub.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ebadeabe6c6c78e858bc32e90d4b3cd06739e65b12f3aea6ce7aba3cd0fa3385

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
108198
cf-polished
qual=85, origFmt=jpeg, origSize=49556
content-disposition
inline; filename="292x176_GitHub.webp"
content-length
12084
last-modified
Tue, 19 Apr 2022 16:02:25 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J8IOnEQkKNwpKInW8OVM0IXSujo%2BWQbvcvMlHLtCpzbPzODCLfupZXW102i1Fi5Ito8%2FTrPlpJHHCiVFi5iucGD1tiUPmnk8wbmGU2UzeXENMib%2BfUe7EHclTbPPXUMe25EOMZE%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
access-control-allow-origin
*
expires
Sat, 03 Sep 2022 08:37:41 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a86ec3a3ff8-YYZ
cf-bgj
imgq:85,h2pri
292x176_phishing-attack-ukraine.jpg
www.bleepstatic.com/content/hl-images/2022/06/06/thumb/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bleepstatic.com/content/hl-images/2022/06/06/thumb/292x176_phishing-attack-ukraine.jpg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2b9fa207d3cadcfa01ca54f1f40350be3e0d1aaed7381ded622216c7d8972b7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:59 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
38380
cf-polished
degrade=85, origSize=66778, status=webp_bigger
content-length
18207
last-modified
Mon, 06 Jun 2022 14:53:16 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=agvl5zwJWH14OO0zFT27DV5JDILxKpV3fS6%2FsI%2F%2FJ1zPz5GZ%2F%2FF4rEZaEf8sr0POoHSWiyaLPHlHgXcwSX9XucuXMQ3fen1NVzV6BB2rbYPTtvT0Poy7OttBfPG9VFRSd6JPpa0%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
expires
Sun, 04 Sep 2022 04:01:18 GMT
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
73604a86ec3c3ff8-YYZ
cf-bgj
imgq:85,h2pri
js
www.googletagmanager.com/gtag/ 		204 KB
73 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-GD465VRQLD&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2008 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
6dacb50615cee383aa9774f9ebcdaf300566aa2bc06589533992c971ffaf8d09
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
74318
x-xss-protection
0
expires
Fri, 05 Aug 2022 14:41:00 GMT
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-91740-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80b::200e New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
5919
date
Fri, 05 Aug 2022 13:02:21 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Fri, 05 Aug 2022 15:02:21 GMT
moatframe.js
z.moatads.com/addthismoatframe568911941483/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.29.129.187 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-29-129-187.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

unused62
8096267
date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
C303B71F141B61E5
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=23640
accept-ranges
bytes
content-length
948
x-amz-id-2
7pAaKEdoMJa/ikZep7mvjWEMsvbZ4+R8C+sgB4yo2oTBotb6fMHwF6xyll++Pe0mVwcDgfKEU0M=
_ate.track.config_resp
v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/ 		2 KB
855 B 		Script
General
Check archive.org
Download Go to
Full URL
https://v1.addthisedge.com/live/boost/ra-561517d2c7f964d6/_ate.track.config_resp
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6d23d10111755a12c87198df1c71cce449de31eca9643030c6327a2157f9bd86

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
etag
-1659864586--gzip
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=43, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
678
300lo.json
m.addthis.com/live/red_lojson/ 		102 B
950 B 		Script
General
Check archive.org
Download Go to
Full URL
https://m.addthis.com/live/red_lojson/300lo.json?si=62ed2bfc9f2a6725&bkl=0&bl=1&pdt=1070&sid=62ed2bfc9f2a6725&pub=ra-561517d2c7f964d6&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=www.bleepingcomputer.com&fp=news%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&mk=computers%2Cwindows%2Clinux%2Cmac%2Csupport%2Ctech%20support%2Cspyware%2Cmalware%2Cvirus%2Csecurity%2CBrowser%20Extension%2CChrome%20extension%2CCyber-espionage%2CExtensions%2CGoogle%20Chrome%2CKimsuky%2CMicrosoft%20Edge%2CNorth%20Korea&colc=1659710460058&jsl=1&uvs=62ed2bfc5fe0d047000&skipb=1&callback=addthis.cbs.jsonp__420674793755087650
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
354e06318502869bd84903e585a0025c6f19b415bffe50f7add86efb992d015e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:00 GMT
cache-control
max-age=0, no-cache, no-store, no-transform
content-disposition
attachment; filename=1.txt
p3p
policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA"
content-length
102
content-type
application/javascript;charset=utf-8
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 4D99 		0
0
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 9E78 		71 KB
26 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
public, max-age=86313600
content-encoding
gzip
content-length
26421
content-type
text/html
date
Fri, 05 Aug 2022 14:41:00 GMT
etag
W/"5f971164-11adc"
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
p3p
CP="NON ADM OUR DEV IND COM STA"
server
nginx/1.15.8
strict-transport-security
max-age=15724800; includeSubDomains
timing-allow-origin
*
vary
Accept-Encoding
x-check-cacheable
YES
x-host
s7.addthis.com
init
d.pub.network/v2/ 		68 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/v2/init?siteId=535&env=PROD
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
7da91bcbdf161536ca58c1cdac36075d933ac89342fda8004db994842dc50ba3

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via
1.1 google
hls.5b3b785f487abbe00eee.js
cds.connatix.com/p/174545/ Frame A76C 		0
47 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/174545/hls.5b3b785f487abbe00eee.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
br
last-modified
Fri, 05 Aug 2022 11:57:30 GMT
age
7824
etag
"182f65d040bfb9544bd8f71472475672"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
48258
connatix.playspace.css
cds.connatix.com/p/174545/ 		103 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/174545/connatix.playspace.css
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
407905d396003842527dfe340373240e6a3e1ba08d256c2b0f0daef77286a5df

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
br
last-modified
Fri, 05 Aug 2022 11:57:30 GMT
age
1249
etag
"fd025abb194bae8695526ea65c3d950c"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
14202
spc_fi.php
cdn.firstimpression.io/delivery/ 		59 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.firstimpression.io/delivery/spc_fi.php?id=5971&url=%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&charset=UTF-8&ch=14&ref=www.bleepingcomputer.com&viewerId=null&referer=&_firid=25220546
Requested by
Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/fi_client.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-114.ewr53.r.cloudfront.net
Software
nginx/1.20.0 / PHP/8.0.14
Resource Hash
f8068094a8667a6909fb6be78a81faf80389fa3a64c279de04df85ab699f9b30

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
x-amz-cf-pop
EWR53-P1
x-powered-by
PHP/8.0.14
x-cache
Miss from cloudfront
p3p
CP="CUR ADM OUR NOR STA NID"
pragma
no-cache
access-control-allow-origin
https://www.bleepingcomputer.com
server
nginx/1.20.0
vary
Accept-Encoding
content-type
application/json; charset=UTF-8
via
1.1 d7202b57803815a076179b3bb9bbd766.cloudfront.net (CloudFront)
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
x-amz-cf-id
TECGPlpjrnpcBBuGyj0GSReDqEWqQJ8XMj2Oj6yEHyREQApGncag7A==
expires
0
collect
www.google-analytics.com/g/ 		0
17 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-GD465VRQLD&gtm=2oe830&_p=1896539107&_z=ccd.v9B&cid=1170813820.1659710460&ul=en-us&sr=1600x1200&_s=1&sid=1659710460&sct=1&seg=0&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&dt=Cyberspies%20use%20Google%20Chrome%20extension%20to%20steal%20emails%20undetected&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-GD465VRQLD&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::200e New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
beacon.js
sb.scorecardresearch.com/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.106.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-106-4.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ee54b51af15f1f68f707da981f3c135c249a25e9293871e1e0cbd2c24c7b6117

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 10:07:08 GMT
content-encoding
gzip
etag
W/"eaf85c1c6758e84acfe134efd70e9373"
last-modified
Tue, 28 Jun 2022 13:19:23 GMT
server
AmazonS3
age
28058
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 472c04481f2812a974e09db484cbbc3a.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-amz-cf-pop
JFK50-P3
x-amz-cf-id
1Za90gs8d1S_Jpri_3UzRJV65TGGQLkKq5tB80SK5keA3kaebGzihw==
pubfig.engine.4.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
a.pub.network/core/pubfig/ 		363 KB
109 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/pubfig/pubfig.engine.4.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/bleepingcomputer-com/pubfig.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1e78c1b27c45c2639fbe39bc1c1cd3c730e063e84eeff35361267f732ed132a5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-goog-hash
crc32c=g/mY1g==, md5=hzvb6NL55MaUit6BClS2rw==
date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-guploader-uploadid
ADPycduhBl_k2piFrYdCiS4D5P87HZx6cDAazdQfKigUtYp_Yv24BHbem7cPCXFt-PTbYM98yGW6afOSlAeFAKg_U_N8oDvy7AVs
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
cf-ray
73604a887db9713e-YUL
last-modified
Wed, 20 Jul 2022 14:49:43 GMT
server
cloudflare
etag
W/"873bdbe8d2f9e4c6948ade810a54b6af"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WlVVVTyLC3HKavKJ1SmIeaP6gs4XGw16EghlfWsPOw2ue9k96bVi81eCCuM5HwzRaI%2FtCpKADzscSBmZD5F7M%2FfSSO3bxAH67JxzrgQjiJ5HwPsSKEpHJcK0iLxHXTPIW9F801IMwBap%2FnQ%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1658328583678110
access-control-expose-headers
*
cache-control
public, max-age=3600
x-goog-stored-content-length
371261
content-type
application/javascript
expires
Tue, 02 Aug 2022 17:01:13 GMT
collect
www.google-analytics.com/j/ 		1 B
21 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1896539107&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ul=en-us&de=UTF-8&dt=Cyberspies%20use%20Google%20Chrome%20extension%20to%20steal%20emails%20undetected&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAAC~&jid=1284655023&gjid=1848063121&cid=1170813820.1659710460&tid=UA-91740-1&_gid=1788668596.1659710460&_r=1&gtm=2ou830&z=276521665
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80b::200e New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:00 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
show_ads_impl_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208030101/ 		342 KB
121 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208030101/show_ads_impl_fy2019.js?bust=31068775
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
01bc51916b803898564983636aed4d2f8bcfb541fe04e1bdfa475a5c18e93731
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
123548
x-xss-protection
0
server
cafe
etag
10887097281683778618
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Fri, 05 Aug 2022 14:41:00 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20220803/r20190131/ Frame E806 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20220803/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
de317176fa6b64a8e89bbd45d20b6be2560bbfa96e7e53e63eb754e18bfe6c1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
18309
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=1209600
content-encoding
gzip
content-length
4412
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 05 Aug 2022 09:35:51 GMT
etag
8616628553774171045
expires
Fri, 19 Aug 2022 09:35:51 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
story
capi.connatix.com/core/ Frame A76C 		8 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/core/story?v=174545
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a8c21cfb9234d86cb9696ac8d13eb0ea8523e39271d4229349bb1636882c3f47

Request headers

Referer
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-max-age
86400
access-control-allow-credentials
true
accept-ranges
bytes
content-length
4956
layers.fa6cd1947ce26e890d3d.js
s7.addthis.com/static/ 		263 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-41cf5"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=86313600
date
Fri, 05 Aug 2022 14:41:00 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
77651
prebidamp.js
ecdn.firstimpression.io/static/js/ 		312 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ecdn.firstimpression.io/static/js/prebidamp.js
Requested by
Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/fi_client.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-114.ewr53.r.cloudfront.net
Software
nginx/1.20.0 /
Resource Hash
9180f589b3c6ace89b0d577f9bbc4d136d2fab3e2c19831caa0bd815f0702d83

Request headers

Referer
https://www.bleepingcomputer.com/
Origin
https://www.bleepingcomputer.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 13:59:41 GMT
content-encoding
br
last-modified
Tue, 14 Dec 2021 15:30:51 GMT
server
nginx/1.20.0
age
2479
etag
W/"61b8b8ab-4e128"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
x-amz-cf-pop
EWR53-P1
x-amz-cf-id
7qjLKz_bmziGtK31tIB5bILqp_w6irbEcOxDuLmmliVIaQfWigNOig==
via
1.1 3c5c6d0ac004d7cc9b79e2835fc1f6a4.cloudfront.net (CloudFront)
expires
Fri, 05 Aug 2022 14:59:41 GMT
creative.js
cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/ 		26 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js
Requested by
Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/fi_client.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e72a4d605e3d5af4047f1f34af4008981be221e0809e57805c6011c451f81c14
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.bleepingcomputer.com/
Origin
https://www.bleepingcomputer.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
fastly-original-body-size
8874
age
16113
x-jsd-version
1.13.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra19126-FRA, cache-yyz4560-YYZ
timing-allow-origin
*
x-jsd-version-type
version
server
cloudflare
etag
W/"682b-2ihEYwqesMldd0dS8BiHEV2ELiA"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GBhKb6%2F9JtIfVOWO833LigxsFVM5ge2bzZH6FAbvnRU8dXCR5VKID9vvLyhIm1mnY6Jxcb4VWV06qVn9rhZrxUYm2SjrFkxhfyUYtO4AhXtMrvde2TN%2B2u%2Ftth1t%2BPXxFzTwXDMJLWH7k3xAnv8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
cf-ray
73604a89ce64ca57-YUL
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		83 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/fi_client.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.64.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f2.1e100.net
Software
sffe /
Resource Hash
e388b3b31d60f93c207eb0c3adf525a852c14b3da4c5d45a79ce4f2144885fb2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28606
x-xss-protection
0
server
sffe
etag
"1294 / 715 of 1000 / last-modified: 1659697702"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Fri, 05 Aug 2022 14:41:00 GMT
fiamp.js
ecdn.firstimpression.io/static/js/ Frame 213B 		110 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ecdn.firstimpression.io/static/js/fiamp.js
Requested by
Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/fi_client.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-114.ewr53.r.cloudfront.net
Software
nginx/1.20.0 /
Resource Hash
3d34b2f2e02c7937501dd51255ee7900c9ec823f07b3d8d0fc19c5e242058cf9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:40:45 GMT
content-encoding
br
last-modified
Fri, 08 Apr 2022 08:48:22 GMT
server
nginx/1.20.0
age
15
etag
W/"624ff6d6-1b8e9"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
x-amz-cf-pop
EWR53-P1
x-amz-cf-id
q7uuNLh1XI_IPppXAlHEV8nFO62-B4XAuhQogj9PBr4vtqkHU8egmg==
via
1.1 d7202b57803815a076179b3bb9bbd766.cloudfront.net (CloudFront)
expires
Fri, 05 Aug 2022 15:40:45 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=23384447&cs_ucfr=&cs_it=b3&cv=3.8.0.210223&ns__t=1659710460416&ns_c=UTF-8&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-goo...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=23384447&cs_ucfr=&cs_it=b3&cv=3.8.0.210223&ns__t=1659710460416&ns_c=UTF-8&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-go...
0
191 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=23384447&cs_ucfr=&cs_it=b3&cv=3.8.0.210223&ns__t=1659710460416&ns_c=UTF-8&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&c8=Cyberspies%20use%20Google%20Chrome%20extension%20to%20steal%20emails%20undetected&c9=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Server
108.138.106.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-106-4.jfk50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
via
1.1 472c04481f2812a974e09db484cbbc3a.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P3
x-amz-cf-id
iBO5f_tBoYKe-EhEOubQj_QiLkNWLNJ6hgKvpgPxKEoVKGeBqRxmQg==
x-cache
Miss from cloudfront

Redirect headers

location
/b2?c1=2&c2=23384447&cs_ucfr=&cs_it=b3&cv=3.8.0.210223&ns__t=1659710460416&ns_c=UTF-8&c7=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&c8=Cyberspies%20use%20Google%20Chrome%20extension%20to%20steal%20emails%20undetected&c9=
date
Fri, 05 Aug 2022 14:41:00 GMT
via
1.1 472c04481f2812a974e09db484cbbc3a.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P3
content-length
0
x-amz-cf-id
5g69zYef-OCLqILFmp8DCAhsa0mMtYWiasEWqT0E9HDgLt8JMyjG4g==
x-cache
Miss from cloudfront
insights.bin
ins.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/39171d1f-89e7-4c9e-b727-de8298332229/ Frame A76C 		216 B
389 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ins.connatix.com/d59f5d0c-2087-416a-821c-141798bc501e/39171d1f-89e7-4c9e-b727-de8298332229/insights.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
8abfc24ad72c339c94d00068a378e6dd1cf4b255971ca75413c1366669105d1c

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
last-modified
Fri, 05 Aug 2022 09:55:42 GMT
age
16709
etag
"1a0e3dcd5fd8fda3f4156cbe7dc19420"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
153
insights.bin
ins.connatix.com/b227a8007e74a066442d76e3b25c0dcb/ Frame A76C 		324 B
301 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ins.connatix.com/b227a8007e74a066442d76e3b25c0dcb/insights.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6944932614fd1731a3fb07e467418396dcc63bc507372a6568583cbafd1ea67b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
last-modified
Thu, 28 Jul 2022 15:41:31 GMT
age
686968
etag
"e2aa9b30dfd6684136016729b48f0bbf"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
209
pandg-sdk.js
pghub.io/js/ 		14 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pghub.io/js/pandg-sdk.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.45.217 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
217.45.241.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
cb260fbfa3add6553864bf1c8dd753a45d7a1504b159c8aa6cbec89f9223a89d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:04:55 GMT
content-encoding
gzip
age
2165
x-guploader-uploadid
ADPycduoXzs6dzj9FqsuOB1AavHYH-34aLBfUBBIGQK-W6T__lSQ-ig8MUTyM1zKHhyVFMEzmqwh8UNgRkTGaUw-iPW_o0Swm3z0
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
9
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3690
last-modified
Tue, 05 Apr 2022 17:08:24 GMT
server
UploadServer
etag
"1f39af8c4109e6a95d6895228aab0692"
vary
Accept-Encoding
x-goog-hash
crc32c=eS3F7w==, md5=HzmvjEEJ5qldaJUiiqsGkg==
x-goog-generation
1649178504809914
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=3600
x-goog-meta-last-modified
2022-07-11T15:04:42.732Z
x-goog-stored-content-length
3690
accept-ranges
bytes
content-type
application/javascript
x-goog-meta-cache-control
public, max-age=230400
config.js
confiant-integrations.global.ssl.fastly.net/qaKtxuL1KR_2Tfmz0NmPaAudsBc/gpt_and_prebid/ 		47 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://confiant-integrations.global.ssl.fastly.net/qaKtxuL1KR_2Tfmz0NmPaAudsBc/gpt_and_prebid/config.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f568ec43cbc7ea256cc5f1293bfa7c696bcc5483ccb9d6818c8d6021c4095888

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Fri, 05 Aug 2022 14:41:00 GMT
Content-Encoding
gzip
Age
1923
X-Cache
HIT
Connection
keep-alive
Content-Length
11974
x-amz-id-2
beExvXNcZp2zs6j/TvJXB/pPbqA3ONsmWdhwIlPSbYXXwEe+vR3LOypcG4cy3QjOlOrUwPOUVsc=
X-Served-By
cache-yul12823-YUL
Last-Modified
Fri, 05 Aug 2022 14:05:55 GMT
Server
AmazonS3
X-Timer
S1659710461.512598,VS0,VE0
ETag
"89f196ef42e5e131ba64b6b21c776d81"
x-amz-request-id
RQ8794SBYQ362P1M
Via
1.1 varnish
Accept-Ranges
bytes
Content-Type
text/javascript
X-Cache-Hits
973
gpt.js
www.googletagservices.com/tag/js/ 		83 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81f::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
44e833e054136b4163bd18444c416d74b45a16e5f63525695c2f0fdc5b12f4e2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28609
x-xss-protection
0
server
sffe
etag
"1294 / 918 of 1000 / last-modified: 1659697702"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Fri, 05 Aug 2022 14:41:00 GMT
tag
btloader.com/
Redirect Chain
  • https://freestar-io.videoplayerhub.com/gallery.js
  • https://btloader.com/tag?h=freestar-io&upapi=true
227 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://btloader.com/tag?h=freestar-io&upapi=true
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Server
2606:4700:20::681a:68b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4511cadf9003592e382be0d27b9dd174276653624d2a04ddee381cbc13a901c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3176
content-length
42114
last-modified
Fri, 05 Aug 2022 13:47:25 GMT
server
cloudflare
etag
"e5dd9e65617a6640f7107f9804372d59"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EKADdMEEbxojf9xP%2BdSr0nMuBHCCTIErd3uIv55VbY1DN6EBj2QoOTi7gBA63rEEwZx5DDDpMfEQaoNd5HY9UXSsjXy99UUMJmyHoNVF9Epm7xnyuIq%2BvwLo0IEzYcdYlw6whaoDEoLXKg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
via
1.1 google
cache-control
public, max-age=300, must-revalidate, stale-if-error=86400, no-transform
accept-ranges
bytes
cf-ray
73604a8adf70ca57-YUL

Redirect headers

date
Fri, 05 Aug 2022 14:41:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m2ccbJo6xFIQ7wy9WpwXyPgTICN%2Bl9pzerDdS5AtHKBYh%2B%2BLdkP9NOhPYcddEK62UMuSCaGez1lxyPKBIH6vHUMLGqiaSC6JqJU5ZuM2Dla87KONWjE8aJ6flRngzvZum4fDzXgMGpsIKgvAJy4TrMd42x9YZ8HbAWrpuw%3D%3D"}],"group":"cf-nel","max_age":604800}
location
https://btloader.com/tag?h=freestar-io&upapi=true
cache-control
max-age=3600
cf-ray
73604a8a4adf4bc5-YUL
expires
Fri, 05 Aug 2022 15:41:00 GMT
184310-82987131453484.js
js-sec.indexww.com/ht/p/ 		36 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/ht/p/184310-82987131453484.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.29.129.7 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-29-129-7.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
3c8a8f4d7fc689c26598752a7d8413962509ec55d6f906f49380c653c3a90e54

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Fri, 05 Aug 2022 14:41:00 GMT
Content-Encoding
gzip
Last-Modified
Fri, 05 Aug 2022 13:55:22 GMT
Server
Apache
ETag
"903967-8ed4-5e57ed1414e0f"
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=1036
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/javascript
Content-Length
12543
Expires
Fri, 05 Aug 2022 14:58:16 GMT
prebid-analytics-6.19.13.js
a.pub.network/core/ 		533 KB
158 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/prebid-analytics-6.19.13.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
70fbc2bab5280ce8aa1b20c58a0df76cfaff01701e7f99f5216a986714955f5d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-goog-hash
crc32c=xBWN/w==, md5=uLNx2cWaQSkYwWScSrT6jw==
date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-guploader-uploadid
ADPycdtV6vu89kuzzcHELJkZlUkOnAJqpv7dL68b5LWzgSbdANX4sN3uL62Bu8CRWDftD7R767FyRV1tq5dzErb1GRhn-OMvDPM9
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
cf-ray
73604a8a1852713e-YUL
last-modified
Tue, 28 Jun 2022 15:25:08 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6iLG2pgWI3YE95WRvWoBOmd2z%2FDqerkWyrsEutMppTwV9KmmIwNDe3PrChd6Ljb7%2BY0VvTQZbqms%2Fg%2FLY13ek4hGYOPwxz3MRlMcBJ3ntl%2B1CNvNlHTqHVJFREMd6ATgt8QYzpDhpXJB5eA%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1656429908313193
access-control-expose-headers
*
cache-control
private, max-age=86400
x-goog-stored-content-length
545828
content-type
text/html
expires
Fri, 04 Aug 2023 16:00:52 GMT
cookie.js
partner.googleadservices.com/gampad/ 		407 B
473 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=www.bleepingcomputer.com&callback=_gfp_s_&client=ca-pub-0920899300397823&gpid_exp=1
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208030101/show_ads_impl_fy2019.js?bust=31068775
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.64.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f2.1e100.net
Software
cafe /
Resource Hash
b828ff80281ac609c4118c36e6a5d076d64cfbd7833d06da92525d95239e20a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
257
x-xss-protection
0
integrator.js
adservice.google.ca/adsid/ 		107 B
792 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.ca/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208030101/show_ads_impl_fy2019.js?bust=31068775
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:809::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
549 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208030101/show_ads_impl_fy2019.js?bust=31068775
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame CF5C 		0
0
prebidamp.js
ecdn.firstimpression.io/static/js/ Frame 213B 		312 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ecdn.firstimpression.io/static/js/prebidamp.js
Requested by
Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/static/js/fiamp.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-114.ewr53.r.cloudfront.net
Software
nginx/1.20.0 /
Resource Hash
9180f589b3c6ace89b0d577f9bbc4d136d2fab3e2c19831caa0bd815f0702d83

Request headers

Referer
https://www.bleepingcomputer.com/
Origin
https://www.bleepingcomputer.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 13:59:41 GMT
content-encoding
br
last-modified
Tue, 14 Dec 2021 15:30:51 GMT
server
nginx/1.20.0
age
2479
etag
W/"61b8b8ab-4e128"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
x-amz-cf-pop
EWR53-P1
x-amz-cf-id
Co2Vxwx6FhI-OzmZ970XvV2Mt78MNB60_6YSU4Cq6olYss_fRlBvBg==
via
1.1 3c5c6d0ac004d7cc9b79e2835fc1f6a4.cloudfront.net (CloudFront)
expires
Fri, 05 Aug 2022 14:59:41 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/ Frame 213B 		83 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/static/js/fiamp.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.64.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f2.1e100.net
Software
sffe /
Resource Hash
fa07e7c14831ddfda77803fc361e569d7197c8b1e09f66fd01c8c69927b5fd2f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28607
x-xss-protection
0
server
sffe
etag
"1294 / 434 of 1000 / last-modified: 1659697745"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Fri, 05 Aug 2022 14:41:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&tn=HEADER&ign=false&pw=1600&ph=1200&x=0&y=0
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
googleads.g.doubleclick.net/pagead/ Frame E87E 		0
0
48.008759e9efe1c1b693dd.js
s7.addthis.com/static/ 		281 B
486 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s7.addthis.com/static/48.008759e9efe1c1b693dd.js
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
f8a52990bbe6892abb730d241570fbfbd2ff2fc707fdd3004c7dba6e843bbae3
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-119"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=86313600
date
Fri, 05 Aug 2022 14:41:00 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
246
shares-post.json
api-public.addthis.com/url/serviceapi/ 		2 B
323 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api-public.addthis.com/url/serviceapi/shares-post.json?services=sFbt&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.208.216.126 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-208-216-126.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-type
text/plain

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
surrogate-key
sFbt=https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/
last-modified
Fri, 05 Aug 2022 13:00:00 GMT
server
nginx/1.15.8
date
Fri, 05 Aug 2022 14:41:00 GMT
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-transform, max-age=0, s-maxage=14400
access-control-allow-credentials
true
content-length
2
info.json
www.reddit.com/api/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.reddit.com/api/info.json?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F&jsonp=_ate.cbs.rcb_h0qc0
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
f85636282234e35cef17c5248247d5927bc09577261912c426b8a324278f371f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-ratelimit-used
2
content-encoding
gzip
x-content-type-options
nosniff
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.2, "failure_fraction": 0.2}
access-control-allow-origin
*
strict-transport-security
max-age=31536000; includeSubdomains
vary
accept-encoding
content-length
1769
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
x-moose
majestic
server
snooserv
x-frame-options
SAMEORIGIN
date
Fri, 05 Aug 2022 14:41:00 GMT
x-ratelimit-remaining
298
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}
content-type
application/javascript; charset=UTF-8
via
1.1 varnish
access-control-expose-headers
X-Moose
cache-control
private, s-maxage=0, max-age=0, must-revalidate, no-store
x-ratelimit-reset
540
accept-ranges
bytes
expires
-1
info.json
www.reddit.com/api/ 		144 B
991 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.reddit.com/api/info.json?url=http%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F&jsonp=_ate.cbs.rcb_28vy0
Requested by
Host: s9.addthis.com
URL: https://s9.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
bf9a6aaa5de75621eb5615f77d4bb2d3a5412eaa0aa540d14f42adbecac0c888
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-ratelimit-used
1
via
1.1 varnish
x-content-type-options
nosniff
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.2, "failure_fraction": 0.2}
strict-transport-security
max-age=31536000; includeSubdomains
content-length
144
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
x-moose
majestic
server
snooserv
x-frame-options
SAMEORIGIN
date
Fri, 05 Aug 2022 14:41:00 GMT
x-ratelimit-remaining
299
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
X-Moose
cache-control
private, s-maxage=0, max-age=0, must-revalidate, no-store
x-ratelimit-reset
540
accept-ranges
bytes
expires
-1
sr
capi-tier-1-us-east-2.connatix.com/tr/ Frame A76C 		0
325 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-1-us-east-2.connatix.com/tr/sr?v=174545
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.143.83.164 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-143-83-164.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame A76C 		0
0
39171d1f-89e7-4c9e-b727-de8298332229.bin
vid.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/ Frame A76C 		2 KB
915 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/39171d1f-89e7-4c9e-b727-de8298332229.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
68261b285e56b4116386f06f7c0ed12539d900472e7798ff87574ad133c8d0b7

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
last-modified
Fri, 05 Aug 2022 09:51:20 GMT
age
17297
etag
"d5a9c004e4897ec25badf0d8039f3854"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
824
1.png
img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/067e5169-ece3-4ce8-87ad-c7961b8bb396/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/067e5169-ece3-4ce8-87ad-c7961b8bb396/1.png
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
956035a88a8424f2d36b292231cd4cd7ed705d412b47a7aa929f7b537196c1cb

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
br
age
271814
etag
"TNtFKY8ZsTR8SDCbTMYylcDTcAKJ8dHwaj78cBgBC4I"
access-control-max-age
86400
fastly-io-info
ifsz=11996 idim=794x206 ifmt=png ofsz=9784 odim=794x206 ofmt=png
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/png
content-length
9610
cks
cks.connatix.com/
Redirect Chain
  • https://ssum.casalemedia.com/usermatchredir?s=190549&cb=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d17%26ev%3d933fd47c58244ca6a52cbcf58f42109f%26pname%3dIndex%26api-tier%3d1%26uid%3d
  • https://ssum.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D17%26ev%3D933fd47c58244ca6a52cbcf58f42109f%26pname%3DIndex%26api-tier%3D1%26uid%3D&s=190549&C=1
  • https://cks.connatix.com/cks?pid=17&ev=933fd47c58244ca6a52cbcf58f42109f&pname=Index&api-tier=1&uid=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140
138 B
195 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cks.connatix.com/cks?pid=17&ev=933fd47c58244ca6a52cbcf58f42109f&pname=Index&api-tier=1&uid=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
5dfa0078c5b54df5233dd27554bf415c57a641563bf65f581ff8411c57518908

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:01 GMT
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
content-length
138
retry-after
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:00 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HuohblNV%2BataJ6Krt%2FL8oKZITR9ATeHfxWmYItSi7L2dBcdUlZBvguTxJSQ%2BC3SuJSRgTAmkuEUAshmL32xcXTWC9iRbyKK7uKtAtrh8%2BVriFMgvt1VKJliBqu%2FIZ1ukfTLlKBQf"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location
https://cks.connatix.com/cks?pid=17&ev=933fd47c58244ca6a52cbcf58f42109f&pname=Index&api-tier=1&uid=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140
cache-control
no-cache
cf-ray
73604a8c9e8fab3b-YYZ
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
expires
0
cks
cks.connatix.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/connatix?redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d15%26ev%3d933fd47c58244ca6a52cbcf58f42109f%26pname%3dBeeswax%26api-tier%3d1%26uid%3d{userid}
  • https://match.prod.bidr.io/cookie-sync/connatix?redir=https%3A%2F%2Fcks.connatix.com%2Fcks%3Fpid%3D15%26ev%3D933fd47c58244ca6a52cbcf58f42109f%26pname%3DBeeswax%26api-tier%3D1%26uid%3D%7Buserid%7D&_...
  • https://cks.connatix.com/cks?pid=15&ev=933fd47c58244ca6a52cbcf58f42109f&pname=Beeswax&api-tier=1&uid=AABCo07F2lgAABCPtU3Fvw
132 B
166 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cks.connatix.com/cks?pid=15&ev=933fd47c58244ca6a52cbcf58f42109f&pname=Beeswax&api-tier=1&uid=AABCo07F2lgAABCPtU3Fvw
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2e97486781680e1c848b5637488ea6e1b3932856cd77e1724da79206c7238d84

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:01 GMT
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
content-length
132
retry-after
0

Redirect headers

location
https://cks.connatix.com/cks?pid=15&ev=933fd47c58244ca6a52cbcf58f42109f&pname=Beeswax&api-tier=1&uid=AABCo07F2lgAABCPtU3Fvw
Date
Fri, 05 Aug 2022 14:41:01 GMT
Server
nginx
Connection
keep-alive
Content-Length
0
strict-transport-security
max-age=2592000; includeSubDomains
cks
cks.connatix.com/
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gapzaid&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=gapzaid&ttd_tpi=1
  • https://cks.connatix.com/cks?pid=19&uid=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttl=1662302460
146 B
197 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cks.connatix.com/cks?pid=19&uid=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttl=1662302460
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
af1b8f7cfc50efd8c00554c463799bb14c246a4334f5f0f4222fd457ad325c72

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
content-length
146
retry-after
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:00 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cks.connatix.com/cks?pid=19&uid=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttl=1662302460
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
213
cks
cks.connatix.com/
Redirect Chain
  • https://secure.adnxs.com/getuid?https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d6%26ev%3d933fd47c58244ca6a52cbcf58f42109f%26pname%3dAppNexus%26api-tier%3d1%26uid%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fcks.connatix.com%252fcks%253fpid%253d6%2526ev%253d933fd47c58244ca6a52cbcf58f42109f%2526pname%253dAppNexus%2526api-tier%253d1%2526uid%...
  • https://cks.connatix.com/cks?pid=6&ev=933fd47c58244ca6a52cbcf58f42109f&pname=AppNexus&api-tier=1&uid=2739567155738641687
128 B
196 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cks.connatix.com/cks?pid=6&ev=933fd47c58244ca6a52cbcf58f42109f&pname=AppNexus&api-tier=1&uid=2739567155738641687
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
184634ee0cb092f99cb59c4921367ab539bae35944cf9caf4a478d36799399eb

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
content-length
128
retry-after
0

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:00 GMT
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid
059ccd69-4a46-41d7-872f-78366296868e
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://cks.connatix.com/cks?pid=6&ev=933fd47c58244ca6a52cbcf58f42109f&pname=AppNexus&api-tier=1&uid=2739567155738641687
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usync.html
eus.rubiconproject.com/ Frame 3D41
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=19564_2&endpoint=us-east
  • https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
281 B
573 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-1-200-83.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Fri, 05 Aug 2022 14:41:00 GMT
ETag
"402b2-119-5d32342a551c0"
Last-Modified
Tue, 14 Dec 2021 23:07:59 GMT
Server
Apache/2.2.15 (CentOS)
Unused62
8096267
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Fri, 05 Aug 2022 14:41:00 GMT
location
https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
server
AkamaiGHost
cks
cks.connatix.com/
Redirect Chain
  • https://i.ctnsnet.com/int/cm?exc=24&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d28%26ev%3d933fd47c58244ca6a52cbcf58f42109f%26pname%3dCrimtan%26api-tier%3d1%26uid%3d%5Buser_id%5D
  • https://cks.connatix.com/cks?pid=28&ev=933fd47c58244ca6a52cbcf58f42109f&pname=Crimtan&api-tier=1&uid=5cfe8a2639f640e5b1695c208dac0136
142 B
203 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cks.connatix.com/cks?pid=28&ev=933fd47c58244ca6a52cbcf58f42109f&pname=Crimtan&api-tier=1&uid=5cfe8a2639f640e5b1695c208dac0136
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
52b5e20e4eecedfc9de4511e2ec933f8c18a263418beae1b86b07141ddd89cc5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
content-length
142
retry-after
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:00 GMT
via
1.1 google
server
Apache-Coyote/1.1
status
302
p3p
CP="NOI DSP COR NID CUR OUR NOR"
location
https://cks.connatix.com/cks?pid=28&ev=933fd47c58244ca6a52cbcf58f42109f&pname=Crimtan&api-tier=1&uid=5cfe8a2639f640e5b1695c208dac0136
cache-control
no-cache, must-revalidate
content-type
text/html;charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
1000.gif
id.rlcdn.com/
Redirect Chain
  • https://id.rlcdn.com/712202.gif?cparams=933fd47c58244ca6a52cbcf58f42109f
  • https://id.rlcdn.com/1000.gif?memo=CIq8KxoNCPzXtJcGEgUI6AcQAEIASiA5MzNmZDQ3YzU4MjQ0Y2E2YTUyY2JjZjU4ZjQyMTA5Zg
42 B
60 B 		Script
General
Check archive.org
Download Go to
Full URL
https://id.rlcdn.com/1000.gif?memo=CIq8KxoNCPzXtJcGEgUI6AcQAEIASiA5MzNmZDQ3YzU4MjQ0Y2E2YTUyY2JjZjU4ZjQyMTA5Zg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:00 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

date
Fri, 05 Aug 2022 14:41:00 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://id.rlcdn.com/1000.gif?memo=CIq8KxoNCPzXtJcGEgUI6AcQAEIASiA5MzNmZDQ3YzU4MjQ0Y2E2YTUyY2JjZjU4ZjQyMTA5Zg
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
cks
cks.connatix.com/
Redirect Chain
  • https://sync.search.spotxchange.com/partner?adv_id=8600&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d10%26ev%3d933fd47c58244ca6a52cbcf58f42109f%26pname%3dSpotX%26api-tier%3d1%26uid%3d%24SPOTX...
  • https://sync.search.spotxchange.com/partner?adv_id=8600&redir=https%3a%2f%2fcks.connatix.com%2fcks%3fpid%3d10%26ev%3d933fd47c58244ca6a52cbcf58f42109f%26pname%3dSpotX%26api-tier%3d1%26uid%3d%24SPOTX...
  • https://cks.connatix.com/cks?pid=10&ev=933fd47c58244ca6a52cbcf58f42109f&pname=SpotX&api-tier=1&uid=9ff5e893-14cc-11ed-a211-1e3873bf0203
146 B
207 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cks.connatix.com/cks?pid=10&ev=933fd47c58244ca6a52cbcf58f42109f&pname=SpotX&api-tier=1&uid=9ff5e893-14cc-11ed-a211-1e3873bf0203
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e184bca5250d746337a75e77cb6005b56adb74d4168bf016ba7768f19de85341

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
access-control-max-age
86400
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
accept-ranges
bytes
content-length
146
retry-after
0

Redirect headers

Date
Fri, 05 Aug 2022 14:41:00 GMT
Server
nginx
Location
https://cks.connatix.com/cks?pid=10&ev=933fd47c58244ca6a52cbcf58f42109f&pname=SpotX&api-tier=1&uid=9ff5e893-14cc-11ed-a211-1e3873bf0203
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
374
Connection
keep-alive
Content-Length
0
pubads_impl_2022080101.js
securepubads.g.doubleclick.net/gpt/ 		381 KB
130 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080101.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.64.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f2.1e100.net
Software
sffe /
Resource Hash
a5910455615630589802ca15818aa163322871e6468f06a3660c53d6ab2936bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 12:48:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
6754
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
132749
x-xss-protection
0
last-modified
Mon, 01 Aug 2022 16:11:51 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Sat, 05 Aug 2023 12:48:26 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		194 B
143 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.bleepingcomputer.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.64.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f2.1e100.net
Software
cafe /
Resource Hash
4d312294a06982e0377c120ec4264047c63fcb56b327468835938bcc8f144ece
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
118
x-xss-protection
0
expires
Fri, 05 Aug 2022 14:41:00 GMT
wrap.js
confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/ 		203 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://confiant-integrations.global.ssl.fastly.net/gptprebidnative/202207121816/wrap.js
Requested by
Host: confiant-integrations.global.ssl.fastly.net
URL: https://confiant-integrations.global.ssl.fastly.net/qaKtxuL1KR_2Tfmz0NmPaAudsBc/gpt_and_prebid/config.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
17dbb476b9e2ac4cd30bc27ff21cd2d44a4d2d188dcc9dfcc7b151e20d9c89bc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Fri, 05 Aug 2022 14:41:00 GMT
Content-Encoding
gzip
Age
188
X-Cache
HIT
Connection
keep-alive
Content-Length
66321
x-amz-id-2
JgXJ/3yOjgnHG2k6tkvDnpp3chUz7WjRZOl5CYGHwjEF2ocvTT1mcMjGqhKnUat1Tld8OhoACEA=
X-Served-By
cache-yul12823-YUL
Last-Modified
Tue, 12 Jul 2022 22:19:25 GMT
Server
AmazonS3
X-Timer
S1659710461.704690,VS0,VE0
ETag
"9fea69ac9affa12918d8b71094edcf4f"
x-amz-request-id
8SZVTMETNBSY46YK
Via
1.1 varnish
Cache-Control
public, max-age=900, stale-while-revalidate=3600
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
X-Cache-Hits
652
ao
capi-tier-1-us-east-2.connatix.com/tr/ Frame A76C 		0
325 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-1-us-east-2.connatix.com/tr/ao?v=174545
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.143.83.164 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-143-83-164.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
g
capi-tier-1-us-east-2.connatix.com/rtb/ Frame A76C 		0
0
12703
tv.springserve.com/rt/ Frame A76C 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://tv.springserve.com/rt/12703?w=834&h=469&cb=bcf2cb46-edfa-4a2d-a77c-07c3fcbbfea8&url=www.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-email&us_privacy=&schain=1.0,1!connatix.com,102734,1,,,,
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.128.4.146 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-128-4-146.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
b27e00c213fe0cd2eb76782e758d795349ecd28808fe41d5347527a4757b923a

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
access-control-allow-credentials
true
server
nginx
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/xml
ps
capi-tier-1-us-east-2.connatix.com/tr/ Frame A76C 		0
325 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-1-us-east-2.connatix.com/tr/ps?v=174545
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.143.83.164 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-143-83-164.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
bf2af82e-89af-4118-977f-216950409426.jpg
img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/ 		41 KB
40 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/bf2af82e-89af-4118-977f-216950409426.jpg?crop=834:541,smart&width=834&height=541&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
055891de2cb3e91b122490bc2b957d63e5b17c3240cae769b9e8f6f53a327b5c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
br
age
17328
etag
"pWkMCYuN0SNnl0NGIJVvWDC2Sp5dq7bWSobJ0eslucE"
access-control-max-age
86400
fastly-io-info
ifsz=216828 idim=1600x900 ifmt=jpeg ofsz=41953 odim=834x541 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
41271
lg.php
cdn.firstimpression.io/delivery/ Frame 213B 		1 B
457 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://cdn.firstimpression.io/delivery/lg.php?bannerid=55429%7C9517%7C48494%7C59957%7C61183%7C63171%7C73344%7C76608%7C88290%7C100360&campaignid=16%7C11%7C18%7C15%7C9%7C13%7C7%7C6%7C22%7C34&zoneid=101902%7C101902%7C101902%7C101902%7C101902%7C101902%7C101902%7C101902%7C101902%7C101902
Requested by
Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/static/js/fiamp.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-114.ewr53.r.cloudfront.net
Software
nginx/1.20.0 / PHP/8.0.14
Resource Hash
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
server
nginx/1.20.0
x-amz-cf-pop
EWR53-P1
x-powered-by
PHP/8.0.14
vary
Accept-Encoding
x-cache
Miss from cloudfront
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
x-amz-cf-id
9x3uOSg49EdXRauQpI7gVTewXNDp3mgWTHazSbem7e7s-D70ZeSDIQ==
via
1.1 d7202b57803815a076179b3bb9bbd766.cloudfront.net (CloudFront)
expires
0
/
hb.emxdgt.com/ Frame 213B 		0
0
prebid
ib.adnxs.com/ut/v3/ Frame 213B 		14 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/static/js/prebidamp.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.24 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
27f794b49afca139ace5946f462e5beab9c56e63069fdcad147354d77e4b2cd1
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

Date
Fri, 05 Aug 2022 14:41:00 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
12655dfc-c272-4247-9ec8-e45da43a106e
Server
nginx/1.21.3
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
bid
ap.lijit.com/rtb/ Frame 213B 		0
0
arj
firstimpression-d.openx.net/w/1.0/ Frame 213B 		0
0
translator
hbopenbid.pubmatic.com/ Frame 213B 		0
122 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/static/js/prebidamp.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.98 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Fri, 05 Aug 2022 14:41:00 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cdb
bidder.criteo.com/ Frame 213B 		18 B
322 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=6.2.0&cb=91521754882
Requested by
Host: ecdn.firstimpression.io
URL: https://ecdn.firstimpression.io/static/js/prebidamp.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.119.129 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
bidder.va1.vip.prod.criteo.com
Software
Finatra /
Resource Hash
ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
gzip
server
Finatra
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; preload;
timing-allow-origin
*
content-length
44
prebid
ib.adnxs.com/ut/v3/ Frame 213B 		0
0
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 213B 		0
0
cygnus
htlb.casalemedia.com/ Frame 213B 		0
0
px.gif
ad-delivery.net/ 		43 B
342 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad-delivery.net/px.gif?ch=2
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:246 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
date
Fri, 05 Aug 2022 14:41:00 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2044107
x-guploader-uploadid
ADPycdupfa7KCtOe0TVtQ1XEXjEqBcYS55h5xltmciWkwyT05QVbX3hl2G6BY1wwXXVxP-9l4WeFTPgHVnUrgCoq0nDtipi3Jg
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
5
x-goog-stored-content-encoding
identity
content-type
image/gif
content-length
43
last-modified
Wed, 05 May 2021 19:25:32 GMT
server
cloudflare
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mFn6gd4BKd%2FLK0%2B1VQOU6aTELC1yYPwUXTHu0EL8U5XaKQjPKITnI0jyBaUioI3LXCvx50qHVq6DQOiaWDGsWLi0qzK1huBIGIXB1LYb%2BBwkeR%2F2F4QTjvFMfGdQkavcAp3JU2okWowZubeLEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1620242732037093
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=86400
x-goog-stored-content-length
43
accept-ranges
bytes
cf-ray
73604a8ccc717145-YUL
expires
Tue, 12 Jul 2022 23:52:33 GMT
px.gif
ad-delivery.net/ 		43 B
940 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.32956562100563636
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:246 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
date
Fri, 05 Aug 2022 14:41:00 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2044107
x-guploader-uploadid
ADPycdupfa7KCtOe0TVtQ1XEXjEqBcYS55h5xltmciWkwyT05QVbX3hl2G6BY1wwXXVxP-9l4WeFTPgHVnUrgCoq0nDtipi3Jg
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
5
x-goog-stored-content-encoding
identity
content-type
image/gif
content-length
43
last-modified
Wed, 05 May 2021 19:25:32 GMT
server
cloudflare
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9LjqIflmWSVoC676wLbo74%2BhLxWOA60Yw6AWR6vJckePQRzUWAA%2BeNr4DIibpoQil07NqpPfeogvfxz3h7MxhjPhf8bH1lLhkxA4z%2Bz2%2B8TBSXw7qjN5u6O9hWGzj9EEP7Mt94pM%2BV9qs8Nb8w%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1620242732037093
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=86400
x-goog-stored-content-length
43
accept-ranges
bytes
cf-ray
73604a8ccc757145-YUL
expires
Tue, 12 Jul 2022 23:52:33 GMT
headerstats
as-sec.casalemedia.com/ 		0
580 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://as-sec.casalemedia.com/headerstats?s=222024&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&v=3
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/184310-82987131453484.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:00 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=phDj4Ylh1%2BeDC4PLcVwSEv%2F1PRZWBdokGlHabhqrx60e3ubp5WpHz7KBz54EA58SEsyIUMXmy07En1%2FP4xJnak9LsIyvbyUfcQPAHtEdnzGI4NHH5zbGUBR1gbt29EuSWcbD6adbUxk%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache
access-control-allow-credentials
true
cf-ray
73604a8cd8f5a229-YYZ
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
expires
0
bf2af82e-89af-4118-977f-216950409426.jpg
img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/ 		38 KB
38 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/bf2af82e-89af-4118-977f-216950409426.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
23a6e592e1c5016418efbfc51f5a01c3a3fb579c39a6dc516f386339a9b1deea

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
br
age
17328
etag
"wboNDNlZqOwAXzLOTXhOKknHG34a/nY1R/V4Pl2tYTw"
access-control-max-age
86400
fastly-io-info
ifsz=216828 idim=1600x900 ifmt=jpeg ofsz=39002 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
38493
7e367765-0dd0-4db2-8061-2c5d845ddad1.jpg
img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/ 		27 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/7e367765-0dd0-4db2-8061-2c5d845ddad1.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a0581edfe4381f4bbfce9f2fcd46f64962abbaeed3b02ef87a0339297b728f83

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
br
age
17328
etag
"2TDxZxf2ITXK56JXyYBVF2RR2ZtO5nALJpHgmkM/LnQ"
access-control-max-age
86400
fastly-io-info
ifsz=138453 idim=1600x900 ifmt=jpeg ofsz=27181 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
26750
5f00569f-481e-4ae5-ba7d-d26fe45c8452.jpg
img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/ 		26 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/5f00569f-481e-4ae5-ba7d-d26fe45c8452.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fcf98f11f5274728b6f7fbbd189704c82782214f6487e7df907c1d0d7ba360f6

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
br
age
17328
etag
"qpwkdO2/FOkvOPda7Or5lx8Xb7cOIOtJ70Hi6lcznXE"
access-control-max-age
86400
fastly-io-info
ifsz=112225 idim=1600x900 ifmt=jpeg ofsz=26533 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
26125
b337b6ef-5f8d-4f6b-9bc2-e772b07621ab.jpg
img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/ 		46 KB
46 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/b337b6ef-5f8d-4f6b-9bc2-e772b07621ab.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2aa6077f3885e767739ccfd37a74f1ad23ddfdd830580c70cb1706459f5c216a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
br
age
17328
etag
"RqNInYaAhEHEGBMENEo095ztf+4TGAQo6Mrp3jpLuAU"
access-control-max-age
86400
fastly-io-info
ifsz=275424 idim=1600x900 ifmt=jpeg ofsz=47501 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
46631
1bb5cfe1-916e-4165-a8a7-1153f02075ad.jpg
img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/ 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/pid-067e5169-ece3-4ce8-87ad-c7961b8bb396/d59f5d0c-2087-416a-821c-141798bc501e/1bb5cfe1-916e-4165-a8a7-1153f02075ad.jpg?crop=834:469,smart&width=834&height=469&format=jpeg&quality=60&fit=crop
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c5b078f88fcff1352aa7bbcef2c3524c7d23b254eed0492edf5200877d9c5ed4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:00 GMT
content-encoding
br
age
17328
etag
"vgUq9Sv0VUMKcKs9ST2QsQWjuKEZ5vYNaN4v+xDzjpY"
access-control-max-age
86400
fastly-io-info
ifsz=160652 idim=1600x900 ifmt=jpeg ofsz=32055 odim=834x469 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
31694
pubads_impl_2022080101.js
securepubads.g.doubleclick.net/gpt/ Frame 213B 		381 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080101.js?cb=31068763
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.64.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f2.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Wed, 03 Aug 2022 20:54:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
150381
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
132749
x-xss-protection
0
last-modified
Mon, 01 Aug 2022 16:11:51 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Thu, 03 Aug 2023 20:54:39 GMT
usync.js
eus.rubiconproject.com/ Frame 3D41 		31 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-1-200-83.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
37e4253e392190e641fe31178e0da5ff17fa01824f5869a35e173ee52be4a5ec

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=19564_2&endpoint=us-east
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Fri, 05 Aug 2022 14:41:00 GMT
Content-Encoding
gzip
Last-Modified
Tue, 12 Jul 2022 20:44:25 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=14203
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9452
Expires
Fri, 05 Aug 2022 18:37:43 GMT
floors
api.floors.dev/sgw/v1/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://api.floors.dev/sgw/v1/floors
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.238.208 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
208.238.227.35.bc.googleusercontent.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains;preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key
access-control-allow-methods
ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-max-age
3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
date
Fri, 05 Aug 2022 14:41:01 GMT
expires
0
pragma
no-cache
strict-transport-security
max-age=31536000;includeSubDomains;preload;
via
1.1 google
floors
api.floors.dev/sgw/v1/ 		5 KB
5 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.floors.dev/sgw/v1/floors
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.227.238.208 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
208.238.227.35.bc.googleusercontent.com
Software
/
Resource Hash
4d604890c12b74a21be13d586a57279d86ac84d5dd498fad33d440d03713f850
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubDomains;preload;

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
x-api-key
4e799501-b8b6-4ef1-bad5-225b3dd1aa8d
Content-Type
application/json

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:01 GMT
via
1.1 google
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Key, Authorization, x-api-key
access-control-max-age
3600
access-control-allow-methods
ACL, CANCELUPLOAD, CHECKIN, CHECKOUT, COPY, DELETE, GET, HEAD, LOCK, MKCALENDAR, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, REPORT, SEARCH, UNCHECKOUT, UNLOCK, UPDATE, VERSION-CONTROL
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
strict-transport-security
max-age=31536000;includeSubDomains;preload;
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
0
us
capi-tier-1-us-east-2.connatix.com/core/ Frame A76C 		0
0
us
capi-tier-1-us-east-2.connatix.com/core/ Frame A76C 		0
0
us
capi-tier-1-us-east-2.connatix.com/core/ Frame A76C 		0
0
khaos.jpg
token.rubiconproject.com/ Frame 3D41 		0
0
vpaid_6d8da985.js
vpaid.springserve.com/production/ 		506 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vpaid.springserve.com/production/vpaid_6d8da985.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.playspace.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2209:8c00:15:6f6c:b180:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8e8003ad291ba3bd8691f5b0754b18daa4f89147dd3f27f204c651cd8d5fbf8f

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Thu, 28 Jul 2022 16:44:32 GMT
content-encoding
br
last-modified
Thu, 28 Jul 2022 16:39:44 GMT
server
AmazonS3
age
683790
etag
W/"9026fbc1fc8aafffe9b6d2458d235a3a"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 11140291d542e546b40770525cf1e1b4.cloudfront.net (CloudFront)
cache-control
max-age=2678400
x-amz-cf-pop
EWR53-P1
x-amz-cf-id
zk8TpfnCZpz8ene7R0MtR4vbM2WB8ZZFaY_LnnDKbLjU7twrIOe5pg==
apstag.js
c.amazon-adsystem.com/aax2/ 		140 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.109.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-109-24.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
16af933f9846ccea77bac90bbfbc9d807b0bdb047f6d7439ca8d866375581b3f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 05 Aug 2022 14:13:48 GMT
via
1.1 51391527dd8c879c45b44b119905c872.cloudfront.net (CloudFront), 1.1 cf498d1eb1eabcd3ba17659086fa3f86.cloudfront.net (CloudFront)
last-modified
Thu, 30 Jun 2022 20:51:39 GMT
server
AmazonS3
age
1634
etag
W/"075df3dec453a3febd9aaae8d9bd0411"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
public, max-age=3600
x-amz-cf-pop
IAD89-C3, JFK50-P3
content-encoding
gzip
x-amz-cf-id
cklBFblkcm12EsBUJSQxjTwsrFKBOFXks4ul4Ysy_yHwd_TAwdwVLQ==
bidRequest
c2shb.pubgw.yahoo.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://c2shb.pubgw.yahoo.com/bidRequest
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.46 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-openrtb-version
Access-Control-Request-Method
POST
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods
GET,POST,OPTIONS
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-max-age
600
age
0
content-length
0
date
Fri, 05 Aug 2022 14:41:01 GMT
server
ATS/9.1.0.46
bidRequest
c2shb.pubgw.yahoo.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://c2shb.pubgw.yahoo.com/bidRequest
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.230.217.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-230-217-116.compute-1.amazonaws.com
Software
ATS/9.1.0.46 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-openrtb-version
Access-Control-Request-Method
POST
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods
GET,POST,OPTIONS
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-max-age
600
age
0
content-length
0
date
Fri, 05 Aug 2022 14:41:01 GMT
server
ATS/9.1.0.46
quant.js
secure.quantserve.com/ 		24 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800b:21:b08a:1dc5:659b:4055 , United States, ASN27281 (QUANTCAST, US),
Reverse DNS
Software
/
Resource Hash
f383c9d665701194066c208c394a1387bbc99a2350ef8995aa629ce298760e13

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:01 GMT
content-encoding
gzip
etag
"+hbmnfsbfN5xcCAnffjc1w=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
accept-ranges
bytes
expires
Fri, 12 Aug 2022 14:41:01 GMT
load.js
s.ntv.io/serve/ 		472 KB
135 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.ntv.io/serve/load.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.29.129.81 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-29-129-81.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
b1c53b6a0b98361abf63f5687663d98245346d2ce21834665e1cf566cbbc3db2

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Fri, 05 Aug 2022 14:41:01 GMT
Content-Encoding
gzip
x-amz-request-id
HK6S92Q47V3TNVX6
x-amz-server-side-encryption
AES256
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
x-amz-id-2
ZiwX60yp6f3fF5Bwm4sTPoyc2ChpCvjklqDOa9ZcV/UdK3KMITiw177FZQ5ORcY/aQo49j6n1jk=
Last-Modified
Mon, 01 Aug 2022 16:43:05 GMT
Server
AmazonS3
ETag
"a36f1cbeb654157a7850307b425685be"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
hbjson
grid.bidswitch.net/ 		23 B
374 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://grid.bidswitch.net/hbjson
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.211.165.199 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS
199.165.211.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
d9a05a0f0ffaa6ab5ed560f61e1757a9d8e46d2b923f5dd091aed59d1b8f9812

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

Date
Fri, 05 Aug 2022 14:41:01 GMT
Content-Encoding
gzip
Server
nginx
Content-Type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
48
translator
hbopenbid.pubmatic.com/ 		0
66 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.98 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Fri, 05 Aug 2022 14:41:00 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
prebid
ib.adnxs.com/ut/v3/ 		16 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.24 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
f12a472ffaefb1c6f2e58d33843428d73207563063b635923ea53745fd7cd017
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

Date
Fri, 05 Aug 2022 14:41:01 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
d7ffc8a9-2e01-4644-af15-124e0b46af20
Server
nginx/1.21.3
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
auction
tlx.3lift.com/header/ 		19 B
513 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=6.19.0&referrer=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&tmax=1500
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.195.22.64 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-195-22-64.compute-1.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:01 GMT
accept-ch
sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-dpr,sec-ch-device-memory,sec-ch-save-data,sec-ch-ua-mobile,sec-ch-downlink,user-agent,sec-ch-ect,sec-ch-width,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-arch,sec-ch-rtt,sec-ch-viewport-height,sec-ch-ua-platform
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
prebid
ads.yieldmo.com/exchange/ 		0
231 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.yieldmo.com/exchange/prebid?pbav=6.19.0&p=%5B%7B%22placement_id%22%3A%22bleepingcomputer_970x90_728x90_320x50_sticky%22%2C%22callback_id%22%3A%2212155a42bb6704a%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B970%2C90%5D%5D%2C%22ym_placement_id%22%3A%222701628685080797398%22%2C%22gpid%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_970x90_728x90_320x50_sticky%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%7D%5D&page_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&bust=1659710461257&dnt=false&description=&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%7D&us_privacy=&pr=&scrd=1&title=&w=1600&h=1200&pubcid=bff5912f-3c7f-4e16-9d16-a4165c5ab4b0&schain=%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%22412%22%2C%22hp%22%3A1%7D%5D%7D&eids=%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22bff5912f-3c7f-4e16-9d16-a4165c5ab4b0%22%2C%22atype%22%3A1%7D%5D%7D%5D
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.201.176.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-201-176-252.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:01 GMT
access-control-allow-credentials
true
x-robots-tag
none,NOINDEX,NOFOLLOW
access-control-allow-methods
POST, GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma
bidRequest
c2shb.pubgw.yahoo.com/ 		66 B
263 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.pubgw.yahoo.com/bidRequest
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.46 /
Resource Hash
77cfce49fc53e3b0f71b3b187f412685311d1a871a86899bbac5c42c75a95267

Request headers

Referer
https://www.bleepingcomputer.com/
x-openrtb-version
2.5
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 05 Aug 2022 14:41:01 GMT
server
ATS/9.1.0.46
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
66
bidRequest
c2shb.pubgw.yahoo.com/ 		66 B
267 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.pubgw.yahoo.com/bidRequest
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.46 /
Resource Hash
f4dd34536fb83f493b179bdd29aed9a4f6cb4e6150229ca506e576410e8080ad

Request headers

Referer
https://www.bleepingcomputer.com/
x-openrtb-version
2.5
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 05 Aug 2022 14:41:01 GMT
server
ATS/9.1.0.46
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
66
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
465 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a9694120174744413194707c7680952&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.46 /
Resource Hash
e496ae93d61efe7f675549e936856514d63b70a8a1f600f3f9c76f5828a67fba

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 05 Aug 2022 14:41:01 GMT
server
ATS/9.1.0.46
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
259 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a96941201747444131946df53d00575&pos=8a969d1301787836013037fa80ed00db&cmd=bid&req=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&secure=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.83.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-83-94.compute-1.amazonaws.com
Software
ATS/9.1.0.46 /
Resource Hash
5b139ee2287a60520cb2d9c079572424c81275ec251e7fb206b3cb74dedb0a09

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 05 Aug 2022 14:41:01 GMT
server
ATS/9.1.0.46
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
content-length
62
cygnus
htlb.casalemedia.com/ 		37 B
647 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=393562&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%221906b6831d6d399%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw%22%2C%22name%22%3A%22bleepingcomputer-com%22%2C%22domain%22%3A%22bleepingcomputer.com%22%2C%22cat%22%3A%5B%22IAB19-9%22%2C%22IAB19-10%22%5D%2C%22sectioncat%22%3A%5B%22IAB19-9%22%2C%22IAB19-10%22%5D%2C%22pagecat%22%3A%5B%22IAB19-9%22%2C%22IAB19-10%22%5D%2C%22ref%22%3A%22%22%2C%22content%22%3A%7B%22data%22%3A%5B%7B%22name%22%3A%22www.freestar.com%22%2C%22ext%22%3A%7B%22taxonomyname%22%3A%22iab_content_taxonomy%22%7D%2C%22segment%22%3A%5B%7B%22id%22%3A%22601%22%7D%5D%7D%5D%7D%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.19.0%22%2C%22userIds%22%3A%5B%5D%2C%22fpd%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22203c9f5adb2762c%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22393562%22%2C%22sid%22%3A%22970x90%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%2C%22gpid%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_970x90_728x90_320x50_sticky%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22freestar.com%22%2C%22sid%22%3A%22412%22%2C%22hp%22%3A1%2C%22rid%22%3A%22188dca95-693b-41f0-8b32-0aa698110da3%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22bff5912f-3c7f-4e16-9d16-a4165c5ab4b0%22%7D%5D%7D%5D%7D%7D
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc26d6046596f8492a0121c2dc9af463f49c9ce6af0c3b18e659555797215f4c

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 05 Aug 2022 14:41:01 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
37
pragma
no-cache
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eB0fX9%2BHXeG6ohuetdHXrVc64iXGF8nvV%2Bso2nlh6zJ%2F%2F8lBqfz6jlaDW2vWkDvNjgKPPu60GMayE9ShImgITazjkzz4nQxTgn91VS62SLkmRFWS85tBqqhqlh3%2BaMLwI0DnUlsH"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache
access-control-allow-credentials
true
cf-ray
73604a8ef87d541f-YYZ
expires
0
auction
c.deployads.com/openrtb2/ 		494 B
823 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.deployads.com/openrtb2/auction?src=prebid_prebid_6.19.0&host=www.bleepingcomputer.com
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.225.229.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-225-229-70.compute-1.amazonaws.com
Software
SortableCactus/1.0 /
Resource Hash
caaad167bdc9f23c7ca08c7ef87267f4d5856b4348008c55b4c4c6d4f37785a8

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:01 GMT
server
SortableCactus/1.0
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache
access-control-allow-credentials
true
content-length
494
expires
Thu, 01 Jan 1970 00:00:00 GMT
prebid
prebid.media.net/rtb/ 		27 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.media.net/rtb/prebid?cid=8CUJ8GUQF
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
139.148.107.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
82ce13e2c820ee573b220031ab439c307af9c4c2370144a3d4636d32c53c5648

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:01 GMT
content-encoding
gzip
server
nginx
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
alt-svc
clear
via
1.1 google
arj
freestar-d.openx.net/w/1.0/ 		175 B
596 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://freestar-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=938ad4c4-d406-4d84-ba6a-e0239cea9f18&nocache=1659710461269&scsm=www.freestar.com%3A601&pubcid=8858e032-51bc-449f-8837-1ad8afd14ac4&schain=1.0%2C1!freestar.com%2C412%2C1%2C188dca95-693b-41f0-8b32-0aa698110da3%2C%2C&aus=728x90%2C970x90&divids=bleepingcomputer_970x90_728x90_320x50_sticky&aucs=%252F15184186%252C1006593%252Fbleepingcomputer_970x90_728x90_320x50_sticky%252Fbleepingcomputer_970x90_728x90_320x50_sticky&auid=540959250
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
7d9ea571c1c27d271ca98090aa5bea957a6b48e2e1ba33c607c0292c019e1e5f

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:01 GMT
content-encoding
gzip
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
164
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
v1
btlr.sharethrough.com/universal/ 		850 B
1007 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.225.50.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-225-50-230.compute-1.amazonaws.com
Software
/
Resource Hash
58f0acb066d020ca6caff4b7bff42a2def03c2b365c7972937c48feeb10e9de8

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

Date
Fri, 05 Aug 2022 14:41:01 GMT
content-encoding
gzip
x-openrtb-version
2.5
Vary
Origin
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
519
v1
btlr.sharethrough.com/universal/ 		850 B
952 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.225.50.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-225-50-230.compute-1.amazonaws.com
Software
/
Resource Hash
e17869a70ccc5de32555c6bcb36a29bc81694ad22d56fb59a55970f411e0e845

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

Date
Fri, 05 Aug 2022 14:41:01 GMT
content-encoding
gzip
x-openrtb-version
2.5
Vary
Origin
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
464
fastlane.json
fastlane.rubiconproject.com/a/api/ 		852 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=16924&site_id=151312&zone_id=1006006&size_id=2&alt_size_ids=55&rp_schain=1.0,1!freestar.com,412,1,188dca95-693b-41f0-8b32-0aa698110da3,,&eid_pubcid.org=bff5912f-3c7f-4e16-9d16-a4165c5ab4b0%5E1&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&tg_i.name=bleepingcomputer-com&tg_i.domain=bleepingcomputer.com&tg_i.cat=IAB19-9%2CIAB19-10&tg_i.sectioncat=IAB19-9%2CIAB19-10&tg_i.pagecat=IAB19-9%2CIAB19-10&tg_i.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&tg_i.fs_ad_product=stickyFooter&tg_i.pbadslot=%2F15184186%2C1006593%2Fbleepingcomputer_970x90_728x90_320x50_sticky%2Fbleepingcomputer_970x90_728x90_320x50_sticky&tk_flint=pbjs_lite_v6.19.0&x_source.tid=938ad4c4-d406-4d84-ba6a-e0239cea9f18&l_pb_bid_id=33bffb660490536&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&p_gpid=%2F15184186%2C1006593%2Fbleepingcomputer_970x90_728x90_320x50_sticky%2Fbleepingcomputer_970x90_728x90_320x50_sticky&slots=1&rand=0.7961432145198974
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
7b90d309e5a23a082e9f2ad8f2dd3c24bc0f184cb951e33b0701076641e89f4b

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:01 GMT
Server
nginx/1.21.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://www.bleepingcomputer.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
852
Expires
Wed, 17 Sep 1975 21:32:10 GMT
hb
ssc.33across.com/api/v1/ 		16 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ssc.33across.com/api/v1/hb?guid=dPGcAuqZ0r6Ok4aKlId8sQ
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.149.20.76 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
76.20.149.34.bc.googleusercontent.com
Software
/ 33Across
Resource Hash
e34982f0d74202dce676d2e74d3581d8543af1665f94350d85b4f8004f1a7324

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 05 Aug 2022 14:41:01 GMT
content-encoding
gzip
status
200 OK
x-powered-by
33Across
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via
1.1 google
config
c.amazon-adsystem.com/cdn/prod/ 		1 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com&pubid=0ab198dd-b265-462a-ae36-74e163ad6159
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.109.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-109-24.jfk50.r.cloudfront.net
Software
Server /
Resource Hash
649fc78f0d874b4e2e7cde4d0ee7255fe6c6a8ed2e909566752e4ac82d7abd03

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 11:19:29 GMT
via
1.1 cf498d1eb1eabcd3ba17659086fa3f86.cloudfront.net (CloudFront)
server
Server
age
12091
x-cache
Hit from cloudfront
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
max-age=21550, s-maxage=21600
access-control-allow-credentials
true
x-amz-cf-pop
JFK50-P3
content-length
1449
x-amz-cf-id
kxUo7KreiBj2CVvWehGTm_3vCx8MgFfIiKBGWXBOaBg0OiHpiZ90eQ==
bid
c.amazon-adsystem.com/e/dtb/ 		652 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&pid=M7xZ0OxbEFq8K&cb=0&ws=1600x1200&v=8.1.0&t=1000&slots=%5B%7B%22sd%22%3A%22bleepingcomputer_970x90_728x90_320x50_sticky%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F15184186%2C1006593%2Fbleepingcomputer_970x90_728x90_320x50_sticky%22%7D%5D&schain=1.0%2C1!freestar.com%2C412%2C1%2C%2C%2C&pubid=0ab198dd-b265-462a-ae36-74e163ad6159&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.109.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-109-24.jfk50.r.cloudfront.net
Software
Server /
Resource Hash
83d759db31ca45ecf1332034be2645e8b69e976313ea721cfb0d5a20022ec0c6
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:01 GMT
via
1.1 cf498d1eb1eabcd3ba17659086fa3f86.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
JFK50-P3
x-amz-rid
91KYSA4N5HK7B1ERG3VH
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
652
x-amz-cf-id
gR_cJHguqT_3ZfwsRN7NisNJNQHqjdfxxZz-GUVqRZZ-BHmIks0_7Q==
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.109.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-109-24.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-version-id
JXufo2ctue2uysHllG2MRpKE8F0E4.a0
content-encoding
gzip
etag
W/"a4d296427fc806b21335359e398c025c"
age
58662
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-origin
*
last-modified
Wed, 03 Aug 2022 22:19:11 GMT
server
AmazonS3
date
Thu, 04 Aug 2022 22:23:20 GMT
vary
Accept-Encoding,Origin
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 ed8dbde89917eaa6ca93ba7fad809c48.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
JFK50-P3
x-amz-cf-id
ijUn7tWzU63-fpXiIFB-oXJyOtjQPinZoTERZAMmLPTA-uqzsZcYrQ==
ats.js
ats.rlcdn.com/ 		109 KB
110 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ats.rlcdn.com/ats.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.106.62 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-106-62.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4b05d7f4339a505c65d2fcb1b21addd2a13a0c155ddf7ca766d1e7203b2b6cae

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-version-id
qhkEQKrW4Gg_gxbK41emvSsDXWYdvDMl
via
1.1 836a4a85ed2221f76e2beedeab244eba.cloudfront.net (CloudFront)
etag
"148e21f812b555a13b2a9c6b616141f4"
age
61867
x-amz-server-side-encryption
AES256
x-amz-meta-codebuild-buildarn
arn:aws:codebuild:eu-west-1:469675294282:build/ATSLibrary-prod:598424ed-c6de-48e8-8068-45662e39c3ce
x-cache
Hit from cloudfront
x-amz-meta-codebuild-content-md5
58acf9e97c03c481f490be71338f7f57
content-length
112112
last-modified
Tue, 17 May 2022 11:35:33 GMT
server
AmazonS3
date
Thu, 04 Aug 2022 21:29:55 GMT
vary
Accept-Encoding
x-amz-meta-codebuild-content-sha256
57180e34d853b9e6be67670dae22a049fb237e6bca37c60f7ba138272a8487cc
cache-control
must-revalidate,public,max-age=86400
x-amz-cf-pop
JFK50-P3
accept-ranges
bytes
content-type
application/x-javascript
x-amz-cf-id
qgP6QFs1f1zcCLUuQcVm7Z5GJpIwvtXZvjsfox0vDhZcQ2cnG81s1A==
pubcid.min.js
secure.cdn.fastclick.net/js/pubcid/latest/ 		53 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.217.153.125 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-217-153-125.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:01 GMT
content-encoding
gzip
last-modified
Tue, 01 Jun 2021 17:06:57 GMT
server
Apache
etag
"d398-5c3b75e9ebb41-gzip"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=900
accept-ranges
bytes
content-length
17087
expires
Fri, 05 Aug 2022 14:56:01 GMT
id5-api.js
cdn.id5-sync.com/api/1.0/ 		42 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.id5-sync.com/api/1.0/id5-api.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
af44d280920264564147250d0841eebf33288a04c932c182c06ec21600a228c2
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:01 GMT
content-encoding
gzip
vary
Accept-Encoding
cf-cache-status
HIT
age
3276
x-amz-server-side-encryption
AES256
x-amz-request-id
Z1BPD2Y7MMVJTES2
x-amz-id-2
nZ8j2dQ2wx6cr0Xen450o4gDXVw8XO1EX78315xb6osTnsoryoQU6TqWj+T3JOEKt2czqsZqkSFVEYTNLQlIhg==
last-modified
Wed, 27 Jul 2022 15:06:46 GMT
server
cloudflare
etag
W/"a49d5e2684c7e5d488d526ca41c2f3e3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
text/javascript;charset=utf-8
cache-control
public, max-age=3600
cf-ray
73604a8f8bd5715a-YUL
rules-p-UeXruRVtZz7w6.js
rules.quantcount.com/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-UeXruRVtZz7w6.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2209:f800:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a7b5f5f96f81dea4efc53e1d4dae8b37c28bec27a45b42ccf604ee759e20caec

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:07:13 GMT
content-encoding
gzip
age
2029
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
last-modified
Thu, 07 Dec 2017 17:06:25 GMT
server
AmazonS3
etag
W/"cbc97d16c77ea1fcbbf42d246001e982"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 b8d8693cc4ac05b6a9cebe2651a2c8b8.cloudfront.net (CloudFront)
cache-control
max-age=3600
x-amz-cf-pop
EWR53-P1
x-amz-cf-id
gQEXcYTlS9dveoltTSeaRgyw6oVyN98DImjdfusgDwTowz5sM_ZW_A==
t
jadserve.postrelease.com/ 		288 B
759 B 		Script
General
Check archive.org
Download Go to
Full URL
https://jadserve.postrelease.com/t?ntv_url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ntv_mvi
Requested by
Host: s.ntv.io
URL: https://s.ntv.io/serve/load.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.72.103.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-72-103-54.compute-1.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
3c86cbaf4650545c3e3bee0af35466103862b44986a2f8b55ab43a7ff0562ebd

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:01 GMT
content-encoding
gzip
server
nginx/1.12.1
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type
text/javascript;charset=UTF-8
content-length
232
expires
Mon, 1 Jan 1990 12:00:00 GMT
v1
lb.eu-1-id5-sync.com/lb/ 		33 B
338 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://lb.eu-1-id5-sync.com/lb/v1
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.120 , France, ASN16276 (OVH, FR),
Reverse DNS
ns31533571.ip-162-19-138.eu
Software
/
Resource Hash
04028504c7003cf18134266f76d7f0330d55d9c0579aa9455fde0bd623531e5e

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Fri, 05 Aug 2022 14:41:01 GMT
transfer-encoding
chunked
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type
application/json;charset=UTF-8
pixel;r=1277724052;rf=0;a=p-UeXruRVtZz7w6;url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewslett...
pixel.quantserve.com/ 		35 B
371 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=1277724052;rf=0;a=p-UeXruRVtZz7w6;url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw;uht=2;fpan=1;fpa=P0-790958859-1659710461411;pbc=;ns=0;ce=1;qjs=1;qv=490d3045-20220805115353;cm=;gdpr=0;ref=;d=bleepingcomputer.com;dst=0;et=1659710461411;tzo=0;ogl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800b:21:b08a:1dc5:659b:4055 , United States, ASN27281 (QUANTCAST, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:01 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
/
geo.privacymanager.io/ 		30 B
594 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://geo.privacymanager.io/
Requested by
Host: ats.rlcdn.com
URL: https://ats.rlcdn.com/ats.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-52.ewr53.r.cloudfront.net
Software
/
Resource Hash
70fd869f92915eb3c9f85d2d2b5a473ba45239ae463b35267642335337c46f06

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 04 Aug 2022 18:20:43 GMT
via
1.1 d64082f0604a4e84007fec84d28e9f32.cloudfront.net (CloudFront), 1.1 9d35ce6897d7f02042955443076a54de.cloudfront.net (CloudFront)
age
73218
x-amzn-requestid
9984a2c3-8bc1-47a5-a49b-a9f5ba829eb6
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type
application/json
access-control-allow-origin
*
x-amzn-trace-id
Root=1-62ec0dfb-51c6d10504e3e9647eb7dd1c;Sampled=0
x-cache
Hit from cloudfront
x-amz-cf-pop
IAD79-C3, EWR53-P1
x-amz-apigw-id
WWcfSFPsjoEFSdA=
content-length
30
x-amz-cf-id
lHn_EgWpuxruRUfISl7JIYHya5lw39FgywBmNo1k3db-n_60dY-JfA==
access-control-allow-headers
Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
pubfig.messaging.2.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
a.pub.network/core/pubfig/ 		203 KB
66 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.pub.network/core/pubfig/pubfig.messaging.2.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:18b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b3dfc6ccf10c5c7f91ed47799416e50f266fb560ef1f428f075b2efb822aa66

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-goog-hash
crc32c=QLi4JQ==, md5=dat2AvI85VAA0k+T1YTXrw==
date
Fri, 05 Aug 2022 14:41:01 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-guploader-uploadid
ADPycdtd_BX9WUJGwBz8Xt7bIXUfdaXBCTxm5vEupqIU1n10JwZ9SpD-wuFifZul-9_KvQQXAIlhS89iIo2GHR-zfmOt6vqeqbYP
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
cf-ray
73604a9059d1713e-YUL
last-modified
Wed, 20 Jul 2022 14:49:47 GMT
server
cloudflare
etag
W/"75ab7602f23ce55000d24f93d584d7af"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LT2ae%2FwL7EcvHt9hJuMVmL7M38UYvcLlmF%2FZ6KEBlPMciy9kQE9%2FzLTOZ9lh5V8HDDIsvliJ3O3wX9kDgFaKCXJl%2FjHvltnHGJFDSf5kKp6shnGBh8%2BzA7G%2BKdyPTyI5vLCUmahYe2xbDvU%3D"}],"group":"cf-nel","max_age":604800}
content-language
en
access-control-allow-origin
*
x-goog-generation
1658328587613119
access-control-expose-headers
*
cache-control
public, max-age=3600
x-goog-stored-content-length
207461
content-type
application/javascript
expires
Tue, 02 Aug 2022 17:01:14 GMT
c
c.pub.network/ 		36 B
361 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
b959860ce89107664ae76a8e671ddd7bb6144e05cf394fc12015208a00d7921c

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Fri, 05 Aug 2022 14:41:01 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
36
882.json
id5-sync.com/g/v2/ 		454 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/g/v2/882.json
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
141.95.98.71 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3216577.ip-141-95-98.eu
Software
/
Resource Hash
db0a0e03b318eb33f68ca9ca7951341f6b0225c7f3dc6833c91baf14b01cd939
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 05 Aug 2022 14:41:01 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
p3p
CP="CAO PSA OUR"
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
application/json;charset=UTF-8
transfer-encoding
chunked
integrator.js
adservice.google.ca/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.ca/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.bleepingcomputer.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		23 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=369477549655474&correlator=2593420850408998&eid=31068630%2C31068745%2C31064226&output=ldjh&gdfp_req=1&vrg=2022080101&ptt=17&impl=fifs&iu_parts=15184186%3A1006593%2Cbleepingcomputer_970x90_728x90_320x50_sticky&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x90&ifi=3&adks=1087171916&sfv=1-0-38&fsapi=false&prev_scp=fsrefresh%3D0%26fsrebid%3D0%26floors_id%3D88f340%26floors_hour%3D14%26g_demand%3D0%26floors_user%3D1%26fs_placementName%3Dbleepingcomputer_970x90_728x90_320x50_sticky%26fs_ad_product%3DstickyFooter%26amznbid%3D8g2jnk%26amznp%3Dxa27eo%26amzniid%3DIzlNIlgHPvRiPu7WP3jqwnYAAAGCbnPWAQEAAAJYAQBAnq6i%26amznsz%3D728x90%26fspbg%3Dfreestar%26auctionId%3D7d0ae8c1-f422-4c26-af92-61310e0b7947%26u%3D1ad%26freestar_path%3D%252Fnews%252Fsecurity%252Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%252F%26freestar_domain%3Dbleepingcomputer.com%26custom_bidder_size%3Dappnexus_728x90%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.20%26hb_adid%3D402cb6c17f788da%26hb_bidder%3Dappnexus&eri=1&cust_params=user-agent%3DChrome%26utm_source%3Dnewsletter%26utm_medium%3Demail%26utm_campaign%3DFw%2520Italian%2520Internal%2520Revenue%2520Service%2520Breached%2520Audius%2520Hacked%2520PrestaShop%2520Zero-Day%2520Flaw%26utm_term%3D2022-08-05%26section%3Dsecurity&sc=1&cookie=ID%3D835553f923e6e3e0-223edfd6acd4005a%3AT%3D1659710460%3ART%3D1659710460%3AS%3DALNI_MYNr0G4fKGbu1U96qpvTCzZlfquOA&gpic=UID%3D000006ba7b1a7bdf%3AT%3D1659710460%3ART%3D1659710460%3AS%3DALNI_MZ_TG2a_LrNVBJcmyUeRoGOW0_43w&abxe=1&dt=1659710461770&lmt=1659026025&dlt=1659710459616&idt=1295&adxs=0&adys=1218&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&frm=20&vis=1&psz=1600x108&msz=1600x90&fws=0&ohw=0&ga_vid=1170813820.1659710460&ga_sid=1659710461&ga_hid=1896539107&ga_fc=true
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.64.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f2.1e100.net
Software
cafe /
Resource Hash
9b275633d988ced8193909a8ac647af4e26e76c198af398fa90e9ce0128c2590
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10481
x-xss-protection
0
google-lineitem-id
5355615764
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138309466275
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
123a2100834ae971547f5f25bc6644f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 3FE5 		6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://123a2100834ae971547f5f25bc6644f9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, immutable, max-age=31536000
content-encoding
gzip
content-length
3108
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Fri, 05 Aug 2022 14:41:01 GMT
expires
Sat, 05 Aug 2023 14:41:01 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
esp.js
oa.openxcdn.net/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://oa.openxcdn.net/esp.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
192.146.102.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Mon, 11 Jul 2022 20:42:45 GMT
content-encoding
gzip
age
2138297
x-guploader-uploadid
ADPycduey1YScZSPSa_Mf5ftzjtGZEaEwtkY3WYZeoZBKveTNCS4X6nH7GDcsBDms_RAV6tx2BQPWciGeXjCUQiMNzydfQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7927
last-modified
Thu, 27 May 2021 18:30:51 GMT
server
UploadServer
etag
"df5542b88bc0e368c6999754a5b9e2ba"
x-goog-hash
crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
x-goog-generation
1622140251693895
cache-control
no-transform
x-goog-stored-content-length
7927
accept-ranges
bytes
content-type
application/javascript
expires
Tue, 11 Jul 2023 20:42:45 GMT
esp.js
cdn.id5-sync.com/api/1.0/ 		43 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.id5-sync.com/api/1.0/esp.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf019a1e03162a3ab267c3dc07d7eb9b1ddb76ce703755c49a7ca9edbd1d87db
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
content-encoding
gzip
vary
Accept-Encoding
cf-cache-status
HIT
age
3170
x-amz-server-side-encryption
AES256
x-amz-request-id
BCGYZXK2V4V9SX9S
x-amz-id-2
AAukq8JD2hsuCUf2Pc4tmHDfUb4xW6NyLexga65dneihZwQT7uz3zH4Hl1be1WOI2ZqP3sPjr+g=
last-modified
Wed, 27 Jul 2022 15:06:46 GMT
server
cloudflare
etag
W/"ce8697e279fcae53e3ebebe92f9e8909"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-type
text/javascript;charset=utf-8
cache-control
public, max-age=3600
cf-ray
73604a943b9f715a-YUL
publishertag.ids.js
static.criteo.net/js/ld/ 		39 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.ids.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
c9bfbc2b802937d34983a32a97f9703769f7dc7a9ffebbe99e186aeb5141add1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
content-encoding
gzip
last-modified
Tue, 02 Aug 2022 12:51:24 GMT
server
nginx
etag
W/"62e91dcc-9dbd"
strict-transport-security
max-age=31536000; preload;
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Sat, 06 Aug 2022 14:41:02 GMT
sync.min.js
tags.crwdcntrl.net/lt/c/16589/ 		29 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080101.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.128.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-128-34.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
094b946adc39ade08f6d927ea066c8fef3ba6ee5c12919873172315ef7428e92

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Fri, 05 Aug 2022 13:56:55 GMT
via
1.1 bd3fb8ca205d8e5f716067cdf581fa76.cloudfront.net (CloudFront)
last-modified
Tue, 19 Jul 2022 18:12:40 GMT
server
AmazonS3
age
2648
etag
"2fa1275c04d6208db458c1ec8559f92d"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
max-age: 86400
x-amz-cf-pop
JFK50-P4
accept-ranges
bytes
content-length
29590
x-amz-cf-id
PMDjmFGN56lmLKauLW0eR-Sm0F6fDMfz5Zyp2wOmiNg8um2FXyeFFw==
view
securepubads.g.doubleclick.net/pcs/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst95F6pPEmB7xe9yDik8lvV6jukVyrDX0LNIUwNCa7Z-aHZCePttOxz7DQyP7-UCINFao7-P249gSkDjrD8BQaL2Bm81MZBYMcM9yuuBVe_MRoJk-N-BoWHY8NgK-ve1sngx4XaZApiBy2gRQBKXjVXEFgnz7CgvIS534VTmcREiner-d39cKv328cW-jj1NMTatmYQJ0l4KMFUAjXa6Gpg7ZcfGR3Sz8kwtrixJNbOK3AhMoz9zBh-yjg3BYIMrTSqGP_sGuRc52Yi7pM4fx32IPRBb5QHIW-78W1CEKuP91M5j_f7-NynjDXO1KBBFCvGv7VXiXuUBTboIUcv6aBJt9joovDHdFiKTT1hjPybIp0fJv7G-rt89RTq&sai=AMfl-YQFpAziUPZctQjFXJHJNQUPFi7f5OdGX20lL25DAQl5jHwLB9XgPnS7LGr-_lJVVzvB0apYaOmGh9aY-EL9iBfHrMAwou65zD5u8HH4WeMk0rAyVKAXAzfNfapXF_qr&sig=Cg0ArKJSzJYJfG37m-6GEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.64.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:02 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 05 Aug 2022 14:41:02 GMT
infolinks_main.js
resources.infolinks.com/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.infolinks.com/js/infolinks_main.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0c5b5e752cd2a0d348cc1602dc240770d1991a8015394a0044c703d8bc0e3b7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a94b9e3ab3b-YYZ
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
HIT
last-modified
Thu, 28 Jul 2022 21:43:06 GMT
server
cloudflare
age
3407
etag
W/"d62-5e4e46b404e0b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=3600
content-encoding
gzip
expires
Fri, 05 Aug 2022 14:44:15 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ 		139 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080101.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81f::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e30a952eadc89f735e92201acd81796193eebddb8926d345c6ce092126c9257a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43822
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1659527892023609"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Fri, 05 Aug 2022 14:41:02 GMT
increment
id5-sync.com/api/esp/ 		0
333 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/api/esp/increment?counter=no-config
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
141.95.98.71 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3216577.ip-141-95-98.eu
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.bleepingcomputer.com
date
Fri, 05 Aug 2022 14:41:01 GMT
access-control-allow-credentials
true
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
strict-transport-security
max-age=63072000; includeSubDomains; preload
esp
oajs.openx.net/ 		85 B
332 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&rid=esp
Requested by
Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
53.135.120.34.bc.googleusercontent.com
Software
/ Express
Resource Hash
d719b3d0205b7c6224af04234b243a2c7e0a8fb583eacc1b76501712e4b09de8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
etag
W/"55-gFXt+ZnU45HFdKkGrl1ZFxJQ0Jk"
x-powered-by
Express
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
85
syncframe
gum.criteo.com/ Frame 9AF3 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.bleepingcomputer.com
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
/
Resource Hash
179d24471f149868157b3b0ab265d6cc20c30f0e395d84dc1ca558185d6776ad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-length
6145
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Fri, 05 Aug 2022 14:41:01 GMT
server-processing-duration-in-ticks
2432
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
ice.js
resources.infolinks.com/js/1812.010-3.025/ 		178 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.infolinks.com/js/1812.010-3.025/ice.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
00a6c0c3e96c824b25ca0e2d5a7f85e3ca4714536cfc035789c37888bb815f04

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a950a5eab3b-YYZ
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
HIT
last-modified
Mon, 25 Jul 2022 11:36:24 GMT
server
cloudflare
age
10575
etag
W/"2c98f-5e49f98033a47"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
content-encoding
gzip
expires
Sun, 04 Sep 2022 11:44:47 GMT
pd
google-bidout-d.openx.net/w/1.0/ Frame 619C 		623 B
717 B 		Document
General
Check archive.org
Download Go to
Full URL
https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by
Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
87a82f5e6d9b41405d3c37aba538a38f9e87a6fedb79d1c6bd0034e8342e89fc

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
407
content-type
text/html
date
Fri, 05 Aug 2022 14:41:02 GMT
p3p
CP="CUR ADM OUR NOR STA NID"
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
via
1.1 google
iu3
s.amazon-adsystem.com/ Frame 9EAA
Redirect Chain
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&dcc=t
359 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&dcc=t
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
715c6cb849c389191d344d3ba6604c4131cf3ea43102bcaafcfb9213584f2227
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
359
Content-Type
text/html;charset=ISO-8859-1
Date
Fri, 05 Aug 2022 14:41:02 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Permissions-Policy
interest-cohort=()
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid
XEGY5CN1S13YYYPP0G6Y

Redirect headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
0
Date
Fri, 05 Aug 2022 14:41:02 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Location
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&dcc=t
Permissions-Policy
interest-cohort=()
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid
GAPW0Y88X78QQ1YBJSQ8
truncated
/ 		219 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ab10cd1e4265908fcfe59de2620daec0e48fe88cab8ff0409f35b26339b28f28

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type
image/png
manage
router.infolinks.com/usync/ Frame C1AA 		9 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1812.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a2f02cf72af07f9d20ff148aeed0c8e46b1c55d269203e1fdbb73ee2d01267e

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store
cf-cache-status
DYNAMIC
cf-ray
73604a95bb3dab3b-YYZ
content-encoding
gzip
content-type
text/html;charset=UTF-8
date
Fri, 05 Aug 2022 14:41:02 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
server
cloudflare
via
1.1 google
lcmanage
router.infolinks.com/usync/ 		263 B
301 B 		Script
General
Check archive.org
Download Go to
Full URL
https://router.infolinks.com/usync/lcmanage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1812.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c836edd9ebc623383226ac4fadadf0f8f78b80e10dffaa17d4e849b35b40753b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
73604a95bb3fab3b-YYZ
p3p
CP="NON DSP NID OUR COR"
content-encoding
gzip
cache-control
no-store
content-type
application/javascript;charset=ISO-8859-1
gsd
router.infolinks.com/ 		319 B
489 B 		Script
General
Check archive.org
Download Go to
Full URL
https://router.infolinks.com/gsd?evt=afterGSD&pid=3248511&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&jsv=1812.010-3.025&_cb=16597104623380
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1812.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e18eb52350b579d188ce7635a9f6dc75626b5ff9a1b551dafcff90218a849e9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
text/javascript;charset=UTF-8
content-encoding
gzip
cache-control
max-age=0
cf-ray
73604a95bb40ab3b-YYZ
expires
Thu, 01 Jan 1970 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 619C
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
  • https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=Yu0r-gAENBckxgA0
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=Yu0r-gAENBckxgA0&_test=Yu0r-gAENBckxgA0
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537148856&val=Yu0r-gAENBckxgA0&_test=Yu0r-gAENBckxgA0
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://google-bidout-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 varnish
server
Varnish
x-timer
S1659710462.439920,VS0,VE0
x-served-by
cache-yul12834-YUL
x-cache
HIT
location
https://us-u.openx.net/w/1.0/sd?id=537148856&val=Yu0r-gAENBckxgA0&_test=Yu0r-gAENBckxgA0
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
cf33b92f-6897-e921-e336-c4c534a1b470
pr-bh.ybp.yahoo.com/sync/openx/ Frame 619C 		43 B
985 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/openx/cf33b92f-6897-e921-e336-c4c534a1b470?gdpr=0
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f13:d60:4f01:bbc5:ac74:cf42:940a Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://google-bidout-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
sd
us-u.openx.net/w/1.0/ Frame 619C
Redirect Chain
  • https://match.adsrvr.org/track/cmf/openx?oxid=5bf4df6b-f83b-7b68-d2e1-d230cbf67939&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttd_puid=5bf4df6b-f83b-7b68-d2e1-d230cbf67939&gdpr=0&gdpr_consent=
43 B
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072971&val=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttd_puid=5bf4df6b-f83b-7b68-d2e1-d230cbf67939&gdpr=0&gdpr_consent=
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://google-bidout-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072971&val=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttd_puid=5bf4df6b-f83b-7b68-d2e1-d230cbf67939&gdpr=0&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
335
pixel
cm.g.doubleclick.net/ Frame 619C 		170 B
502 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=Nzc5YjBjYTEtMzE0Yy0yNWNjLWM3MDEtODg4OTAxMTRiNzU5
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.40.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s81-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://google-bidout-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 619C
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENLwFsJqwzXQ3RZTmXe8fcE&google_cver=1
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENLwFsJqwzXQ3RZTmXe8fcE&google_cver=1
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://google-bidout-d.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENLwFsJqwzXQ3RZTmXe8fcE&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sid
mug.criteo.com/ Frame 9AF3
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertagids&domain=bleepingcomputer.com&sn=ChromeSyncframe&so=0&topUrl=www.bleepingcomputer.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=mMF0QXxhSHNPOXNMKzBUU1MvczIrd3pWbmNMLzNza0NaMEw4YkxyWjZPM3o1ejRSTjM4MGg5Wm5ESVNMUS9iWHA5Z3pSaUxBRWdydDNvQlNRRzhzR3oxalZJL2ZOZW9XcTA0SVlpT20rVUl0Q2EzUFNhdFJOUm0zVzhTSk...
457 B
651 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=mMF0QXxhSHNPOXNMKzBUU1MvczIrd3pWbmNMLzNza0NaMEw4YkxyWjZPM3o1ejRSTjM4MGg5Wm5ESVNMUS9iWHA5Z3pSaUxBRWdydDNvQlNRRzhzR3oxalZJL2ZOZW9XcTA0SVlpT20rVUl0Q2EzUFNhdFJOUm0zVzhTSk8ySVFaMnR1L25weTF0SWRZKzFGRHgzYVFoK2xDNHVxdHdMbmI2bFF6MzhTWFYwUStscUhKSWNCMCt0YnZSRVJQS0JPRzZCWlZ2aXlidnJmQWFXbEgzRWVQOURwUnk0U0kvYU9kQndvaGQySkFGUzNvRU1maUxLeEVUN3l0OVoxZENqQ0cwcWJhVDdGZkhLeGl1UW9yZW94N05HN0tWUT09fA&cppv=2
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
/
Resource Hash
ab2a8eb1386228b4a597ed6a7435b7038e38ffd2c6573523ddf557aad8243527
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
content-encoding
gzip
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
5494
strict-transport-security
max-age=31536000; preload;
expires
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:01 GMT
strict-transport-security
max-age=31536000; preload;
content-type
text/html; charset=utf-8
location
https://mug.criteo.com/sid?cpp=mMF0QXxhSHNPOXNMKzBUU1MvczIrd3pWbmNMLzNza0NaMEw4YkxyWjZPM3o1ejRSTjM4MGg5Wm5ESVNMUS9iWHA5Z3pSaUxBRWdydDNvQlNRRzhzR3oxalZJL2ZOZW9XcTA0SVlpT20rVUl0Q2EzUFNhdFJOUm0zVzhTSk8ySVFaMnR1L25weTF0SWRZKzFGRHgzYVFoK2xDNHVxdHdMbmI2bFF6MzhTWFYwUStscUhKSWNCMCt0YnZSRVJQS0JPRzZCWlZ2aXlidnJmQWFXbEgzRWVQOURwUnk0U0kvYU9kQndvaGQySkFGUzNvRU1maUxLeEVUN3l0OVoxZENqQ0cwcWJhVDdGZkhLeGl1UW9yZW94N05HN0tWUT09fA&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
1997
content-length
541
expires
0
/
hde.tynt.com/deb/ Frame 27E4
Redirect Chain
  • https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV
  • https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.31 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip31.67-202-105.static.steadfastdns.net
Software
/
Resource Hash
29dddfd258fe3a296e8d4500931e721cee78cae5125898935948c5a44171f5ea

Request headers

Referer
https://router.infolinks.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length
1328
content-type
text/html
date
Fri, 05 Aug 2022 14:41:01 GMT
expires
Sat, 26 Jul 1997 05:00:00 GMT
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy
unsafe-url

Redirect headers

accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length
0
date
Fri, 05 Aug 2022 14:41:01 GMT
expires
Sat, 26 Jul 1997 05:00:00 GMT
location
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy
unsafe-url
usermatch
ssum-sec.casalemedia.com/ Frame F05C 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c2d924d5121ba5bf48cca12c37456c9e5f8e80ac340d8eb7cca76b828b527ff0

Request headers

Referer
https://router.infolinks.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
73604a966caba1ec-YYZ
content-encoding
br
content-type
text/html
date
Fri, 05 Aug 2022 14:41:02 GMT
dropped-udsids
45|241|230|39|5|13|88|46
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
0
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NOTAjVBwOMFjSSBNUkeYrKl5tZWlkPmMHF6S19bwEGKsuO6BJcMMVnfSDmjrfZdEUn7jTgye3qpjPHjJwBXFpWoZSqJJUd3YRc0g7H0NysO3CF5PHAdqYK8vvHdI%2Fc308UXcfyETOKU89w%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Is-Traffic-Usersync, Accept-Encoding
/
onetag-sys.com/usync/ Frame 33D2 		2 KB
815 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.222.39.185 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip185.ip-51-222-39.net
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://router.infolinks.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
content-type
text/html
strict-transport-security
max-age=15552000
receive
pixel.tapad.com/idsync/ex/ Frame C1AA
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
  • https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NTJDMTA4QjAtNjExQS00NTg0LUEyMzItRDMzOUY4NEE3QTI5&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3D52C108B0-611A-4584-A232-D339F84A7A29
  • https://router.infolinks.com/dyn/pbm-usync?uid=52C108B0-611A-4584-A232-D339F84A7A29
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3356&partner_device_id=52C108B0-611A-4584-A232-D339F84A7A29
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3356&partner_device_id=52C108B0-611A-4584-A232-D339F84A7A29
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=922f411c-87a1-4cd3-9a9c-aaee6eaa8133%252C&gdpr=0&gdpr_consent=
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttd_puid=922f411c-87a1-4cd3-9a9c-aaee6eaa8133%2C
95 B
113 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttd_puid=922f411c-87a1-4cd3-9a9c-aaee6eaa8133%2C
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H3
Server
107.178.246.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
49.246.178.107.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:03 GMT
via
1.1 google
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttd_puid=922f411c-87a1-4cd3-9a9c-aaee6eaa8133%2C
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
353
apn-usync
router.infolinks.com/dyn/ Frame C1AA
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fapn-usync%3Fuser_id%3D%24UID
  • https://router.infolinks.com/dyn/apn-usync?user_id=2739567155738641687
35 B
243 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/apn-usync?user_id=2739567155738641687
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
73604a966c10ab3b-YYZ
content-length
35
expires
Thu, 05 Aug 2021 14:41:02 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid
8c1106ed-b681-48fb-9663-29b6dd16f3c4
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://router.infolinks.com/dyn/apn-usync?user_id=2739567155738641687
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ox-usync
router.infolinks.com/dyn/ Frame C1AA
Redirect Chain
  • https://u.openx.net/w/1.0/cm?id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D
  • https://router.infolinks.com/dyn/ox-usync?uid=7063fdfa-ebef-4ce4-932e-e5c23351dcac
35 B
199 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/ox-usync?uid=7063fdfa-ebef-4ce4-932e-e5c23351dcac
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
73604a966c19ab3b-YYZ
content-length
35
expires
Thu, 05 Aug 2021 14:41:02 GMT

Redirect headers

date
Fri, 05 Aug 2022 14:41:02 GMT
content-encoding
gzip
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://router.infolinks.com/dyn/ox-usync?uid=7063fdfa-ebef-4ce4-932e-e5c23351dcac
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
VR-usync
router.infolinks.com/dyn/ Frame C1AA
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58422/occ
  • https://router.infolinks.com/dyn/VR-usync?uid=y-XfMAf1hE2uFXgX1lXrm6Q.5N3nduaJ3oehpLkx0-~A
35 B
209 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/VR-usync?uid=y-XfMAf1hE2uFXgX1lXrm6Q.5N3nduaJ3oehpLkx0-~A
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
73604a96dc9eab3b-YYZ
content-length
35
expires
Thu, 05 Aug 2021 14:41:02 GMT

Redirect headers

location
https://router.infolinks.com/dyn/VR-usync?uid=y-XfMAf1hE2uFXgX1lXrm6Q.5N3nduaJ3oehpLkx0-~A
date
Fri, 05 Aug 2022 14:41:02 GMT
server
ATS/9.1.0.46
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
r1-usync
router.infolinks.com/dyn/ Frame C1AA
Redirect Chain
  • https://sync.1rx.io/usersync2/infolinks
  • https://sync.1rx.io/usersync2/infolinks?zcc=1&cb=1659710462746
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3979130734
  • https://sync.1rx.io/usersync/tradedesk/5e1b1e00-4929-4a58-9799-282bf9b88b13
  • https://sync.targeting.unrulymedia.com/csync/RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fr1-usync%3Fuid%3DRX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005
  • https://router.infolinks.com/dyn/r1-usync?uid=RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005
35 B
235 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/r1-usync?uid=RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
73604a9b5a82ab3b-YYZ
content-length
35
expires
Thu, 05 Aug 2021 14:41:03 GMT

Redirect headers

Location
https://router.infolinks.com/dyn/r1-usync?uid=RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005
Date
Fri, 05 Aug 2022 14:41:03 GMT
Connection
keep-alive
Content-Type
text/html
ETag
RXae383cc14aec472a93ada48dcc3d101e005
Transfer-Encoding
chunked
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
zmn-usync
router.infolinks.com/dyn/ Frame C1AA
Redirect Chain
  • https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__
  • https://stags.bluekai.com/site/23178?id=GZWay77ga066zVKhv2Jj&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TPOV2GK4RONFXGM33MNFXGW4ZOMNXW2L3EPFXC66TN...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TPOV2GK4RONFXGM33MNFXGW4ZOMNXW2L3EPFXC66TNNYWXK43ZNZRT6ZLYMNUGC3THMU6WS3TGN5WGS3TLOMTHK2LEHVDVUV3BPE3TOZ3BGA3DM6SWJNUHMMSKNI
  • https://router.infolinks.com/dyn/zmn-usync?uid=GZWay77ga066zVKhv2Jj
35 B
191 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/zmn-usync?uid=GZWay77ga066zVKhv2Jj
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
73604a985e92ab3b-YYZ
content-length
35
expires
Thu, 05 Aug 2021 14:41:02 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
P3p
CP="We do not support P3P header."
Location
https://router.infolinks.com/dyn/zmn-usync?uid=GZWay77ga066zVKhv2Jj
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
90
Expires
Thu, 01 Dec 1994 16:00:00 GMT
tplift
router.infolinks.com/dyn/ Frame C1AA
Redirect Chain
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Ftplift%3Fuid%3D%24UID
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Ftplift%3Fuid%3D%24UID
  • https://router.infolinks.com/dyn/tplift?uid=4526249851231332969674
35 B
190 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/tplift?uid=4526249851231332969674
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
73604a96dc99ab3b-YYZ
content-length
35
expires
Thu, 05 Aug 2021 14:41:02 GMT

Redirect headers

location
https://router.infolinks.com/dyn/tplift?uid=4526249851231332969674
date
Fri, 05 Aug 2022 14:41:02 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
us
sync.go.sonobi.com/ Frame C1AA 		0
0
ca.png
s.cpx.to/ Frame C1AA
Redirect Chain
  • https://ib.adnxs.com/getuid?https://s.cpx.to/ca.png?ref=https%253A%252F%252Fwww.bleepingcomputer.com%252Fnews%252Fsecurity%252Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%252F...
  • https://s.cpx.to/ca.png?ref=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3D...
95 B
945 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.cpx.to/ca.png?ref=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&pid=12306&adnxs_uid=2739567155738641687
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
HTTP/1.1
Server
34.252.120.220 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-252-120-220.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
bf27786b4381176350787d768bf5f7c5310ba640aa48ee98a3d2c310ddd971ab
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options sameorigin

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache, no-cache
Content-Security-Policy
default-src 'self'
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
none
Date
Fri, 05 Aug 2022 14:41:02 GMT
X-Frame-Options
sameorigin
Connection
keep-alive
P3P
CP="NOI DEV ADM"
Cache-Control
no-store, must-revalidate, private, max-age=0, no-store, must-revalidate, private, max-age=0
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/png
Content-Length
95
Expires
Fri, 05 Aug 2022 14:41:02 UTC

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid
2756a2e2-0c50-41e6-864f-1bae6d4c2252
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://s.cpx.to/ca.png?ref=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&pid=12306&adnxs_uid=2739567155738641687
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
imd-usync
router.infolinks.com/dyn/ Frame C1AA
Redirect Chain
  • https://ad.360yield.com/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531
  • https://ad.360yield.com/ul_cb/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531
  • https://router.infolinks.com/dyn/imd-usync?user_id=3c0f15ce-8eea-410e-b543-893a366e7f9d&partner_id=1531
35 B
303 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/imd-usync?user_id=3c0f15ce-8eea-410e-b543-893a366e7f9d&partner_id=1531
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
73604a971cecab3b-YYZ
content-length
35
expires
Thu, 05 Aug 2021 14:41:02 GMT

Redirect headers

location
https://router.infolinks.com/dyn/imd-usync?user_id=3c0f15ce-8eea-410e-b543-893a366e7f9d&partner_id=1531
date
Fri, 05 Aug 2022 14:41:02 GMT
access-control-allow-origin
*
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
outh-usync
router.infolinks.com/dyn/ Frame C1AA
Redirect Chain
  • https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
  • https://ups.analytics.yahoo.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
  • https://router.infolinks.com/dyn/outh-usync?uid=y-PWSL87RE2uGK26blnBCsq2vu5MyjQIet~A
35 B
205 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/outh-usync?uid=y-PWSL87RE2uGK26blnBCsq2vu5MyjQIet~A
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
73604a980e2cab3b-YYZ
content-length
35
expires
Thu, 05 Aug 2021 14:41:02 GMT

Redirect headers

location
https://router.infolinks.com/dyn/outh-usync?uid=y-PWSL87RE2uGK26blnBCsq2vu5MyjQIet~A
date
Fri, 05 Aug 2022 14:41:02 GMT
server
ATS/9.1.0.46
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
sovrn-usync
router.infolinks.com/dyn/ Frame C1AA
Redirect Chain
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID&sovrn_retry=true
  • https://router.infolinks.com/dyn/sovrn-usync?uid=FGHRhPZHXp7Ir1doSteX52FA
35 B
236 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/sovrn-usync?uid=FGHRhPZHXp7Ir1doSteX52FA
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
73604a97bdcbab3b-YYZ
content-length
35
expires
Thu, 05 Aug 2021 14:41:02 GMT

Redirect headers

Date
Fri, 05 Aug 2022 14:41:02 GMT
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Location
https://router.infolinks.com/dyn/sovrn-usync?uid=FGHRhPZHXp7Ir1doSteX52FA
Access-Control-Allow-Credentials
true
Connection
close
X-Sovrn-Pod
ad_ap1dca1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
receive
pixel.tapad.com/idsync/ex/ Frame C1AA
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolink...
  • https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolink...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NjNGM0UzMjgtNTBDRS00QjUyLUI2M0YtQUM3MEU5RjNCMjdG&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3D52C108B0-611A-4584-A232-D339F84A7A29
  • https://router.infolinks.com/dyn/pbm-usync?uid=52C108B0-611A-4584-A232-D339F84A7A29
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3356&partner_device_id=52C108B0-611A-4584-A232-D339F84A7A29
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3356&partner_device_id=52C108B0-611A-4584-A232-D339F84A7A29
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=922f411c-87a1-4cd3-9a9c-aaee6eaa8133%252C&gdpr=0&gdpr_consent=
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttd_puid=922f411c-87a1-4cd3-9a9c-aaee6eaa8133%2C
95 B
113 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttd_puid=922f411c-87a1-4cd3-9a9c-aaee6eaa8133%2C
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H3
Server
107.178.246.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
49.246.178.107.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:03 GMT
via
1.1 google
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=5e1b1e00-4929-4a58-9799-282bf9b88b13&ttd_puid=922f411c-87a1-4cd3-9a9c-aaee6eaa8133%2C
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
353
zeta-usync
router.infolinks.com/dyn/ Frame C1AA
Redirect Chain
  • https://p.rfihub.com/cm?pub=43153&in=1
  • https://router.infolinks.com/dyn/zeta-usync?uid=1797288115146808422
35 B
187 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/zeta-usync?uid=1797288115146808422
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
73604a987ebbab3b-YYZ
content-length
35
expires
Thu, 05 Aug 2021 14:41:02 GMT

Redirect headers

Location
https://router.infolinks.com/dyn/zeta-usync?uid=1797288115146808422
Date
Fri, 05 Aug 2022 14:41:02 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
33a-usync
router.infolinks.com/dyn/ Frame C1AA
Redirect Chain
  • https://ssc-cms.33across.com/ps/?ri=0010b00002CpYhEAAV&ru=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F33a-usync%3Fuid%3D33XUSERID33X
  • https://router.infolinks.com/dyn/33a-usync?uid=2278742228126
35 B
238 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/33a-usync?uid=2278742228126
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
73604a985e93ab3b-YYZ
content-length
35
expires
Thu, 05 Aug 2021 14:41:02 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
referrer-policy
unsafe-url
server
33XP005
x-33x-status
100000000008200000C
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://router.infolinks.com/dyn/33a-usync?uid=2278742228126
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/ Frame C1AA
Redirect Chain
  • https://router.infolinks.com/dyn/iq-usync
  • https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=fcc31345-e707-4a86-89ae-6ca63cf6247f&3rddpi=2023874098&3rdpcid=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140&3rddpi=...
  • https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=fcc31345-e707-4a86-89ae-6ca63cf6247f&3rddpi=2023874098&3rdpcid=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140&3rddpi...
43 B
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=fcc31345-e707-4a86-89ae-6ca63cf6247f&3rddpi=2023874098&3rdpcid=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140&3rddpi=1639354730&3rdpcid=&3rddpi=445262707&3rdpcid=&3rddpi=1634346717&3rdpcid=&3rddpi=1402230080&3rdpcid=&3rddpi=541745869&3rdpcid=&3rddpi=1177082855&3rdpcid=&3rddpi=1213503647&3rdpcid=y-XfMAf1hE2uFXgX1lXrm6Q.5N3nduaJ3oehpLkx0-%7EA&3rddpi=1541423991&3rdpcid=&3rddpi=1239766150&3rdpcid=7063fdfa-ebef-4ce4-932e-e5c23351dcac&ckls=true&ci=81Dwmi4JAK&nc=false&trid=-1325236451
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Server
52.85.61.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-71.ewr53.r.cloudfront.net
Software
Apache-Coyote/1.1 /
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://router.infolinks.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 52b969a4ab7956a248b07efba57c92a4.cloudfront.net (CloudFront)
server
Apache-Coyote/1.1
x-amz-cf-pop
EWR53-P1
x-cache
Miss from cloudfront
p3p
CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
x-amz-cf-id
QozUdRqsAWFnv1JRv9ok4s5a6_VUCTycGqb7ovFJgFMtRpoX733m_w==
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 52b969a4ab7956a248b07efba57c92a4.cloudfront.net (CloudFront)
server
Apache-Coyote/1.1
x-amz-cf-pop
EWR53-P1
x-cache
Miss from cloudfront
p3p
CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=fcc31345-e707-4a86-89ae-6ca63cf6247f&3rddpi=2023874098&3rdpcid=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140&3rddpi=1639354730&3rdpcid=&3rddpi=445262707&3rdpcid=&3rddpi=1634346717&3rdpcid=&3rddpi=1402230080&3rdpcid=&3rddpi=541745869&3rdpcid=&3rddpi=1177082855&3rdpcid=&3rddpi=1213503647&3rdpcid=y-XfMAf1hE2uFXgX1lXrm6Q.5N3nduaJ3oehpLkx0-%7EA&3rddpi=1541423991&3rdpcid=&3rddpi=1239766150&3rdpcid=7063fdfa-ebef-4ce4-932e-e5c23351dcac&ckls=true&ci=81Dwmi4JAK&nc=false&trid=-1325236451
cache-control
no-cache, no-store, must-revalidate
patent
https://www.almondnet.com/ip
content-type
image/gif
content-length
43
x-amz-cf-id
9NPRQOodmipPAMoeY6KKrCWbEbbF15wtJlHl5cWoDp5Ff3Efh3qXQA==
expires
Thu, 01 Jan 1970 00:00:00 GMT
iqusync-1.17.min.js
resources.infolinks.com/static/usync/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.infolinks.com/static/usync/iqusync-1.17.min.js
Requested by
Host: router.infolinks.com
URL: https://router.infolinks.com/usync/lcmanage?pid=3248511&wsid=0&pdom=www.bleepingcomputer.com&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85b0bab835f1c9d35073860412074c375c341a1fc9f1f51e12b0931cc58438a0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a962bcbab3b-YYZ
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
HIT
last-modified
Wed, 25 May 2022 11:40:03 GMT
server
cloudflare
age
1384
etag
W/"945-5dfd488bd0c04"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
content-encoding
gzip
expires
Sun, 04 Sep 2022 14:17:58 GMT
doq.htm
rt3055.infolinks.com/action/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://rt3055.infolinks.com/action/doq.htm?pcode=utf-8&r=16597104624271
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1812.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
069c73a8f36f81eadecc1bed9ada8543673a36531a9d52097151128b53356eb8

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
p3p
CP="NON DSP NID OUR COR"
content-type
text/html;charset=UTF-8
x-application-context
application:prod
pragma
no-cache
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-language
en-CA
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache,no-store
access-control-allow-credentials
true
cf-ray
73604a969f56a229-YYZ
expires
Thu, 01 Jan 1970 00:00:00 GMT
map
bcp.crwdcntrl.net/6/ 		0
0
pr
s.amazon-adsystem.com/v3/ Frame 54B6 		4 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&dcc=t
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
647b443d5e7289157070e2648fcecdefac8bd6c19acb58d2e21cd526b683dcfc
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&dcc=t
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
3641
Content-Type
text/html;charset=ISO-8859-1
Date
Fri, 05 Aug 2022 14:41:02 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Permissions-Policy
interest-cohort=()
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
x-amz-rid
XS62M8D4F2237MNKPVB4
ProfilesEngineServlet
api.intentiq.com/profiles_engine/ 		266 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=1509139146&pt=17&dpn=1&idtype=0&pcid=fcc31345-e707-4a86-89ae-6ca63cf6247f&iiqidtype=2&iiqpcid=0a4c08ff-0058-42c2-98e3-44c619869957&iiqpciddate=1659710462453&dbsaved=true&fbp=2503514547
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.17.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-15.jfk50.r.cloudfront.net
Software
Apache-Coyote/1.1 /
Resource Hash
2066e0bd2557cb00d97d2711dddc4ffa570565502da087043cfaa0f0a3b2b218

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 e42e8491a089e2183879e26e61dae708.cloudfront.net (CloudFront)
vary
Origin
x-amz-cf-pop
JFK50-P2
x-cache
Miss from cloudfront
p3p
CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
patent
https://www.almondnet.com/ip
pragma
no-cache
server
Apache-Coyote/1.1
access-control-max-age
3600
access-control-allow-methods
POST, GET
content-type
text/html
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Accept, X-Requested-With, remember-me
x-amz-cf-id
1hEDAbpEHyZpDp2Dv4587ODIFic7v7YWparig4MnCx3WXwnOa_nEZg==
expires
Thu, 01 Jan 1970 00:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 54B6
Redirect Chain
  • https://um.simpli.fi/amazon/https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsimpli.fi%26id%3D
  • https://s.amazon-adsystem.com/ecm3?id=ADE529A5AF7E4EC0BD84D098CEDEE4E8&ex=simpli.fi&status=ok
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=ADE529A5AF7E4EC0BD84D098CEDEE4E8&ex=simpli.fi&status=ok
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
HTTP/1.1
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
6V7VEHSJGBZB7ZRZB5AP
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date
Fri, 05 Aug 2022 14:41:02 GMT
x-content-type-options
nosniff
server
nginx
location
https://s.amazon-adsystem.com/ecm3?id=ADE529A5AF7E4EC0BD84D098CEDEE4E8&ex=simpli.fi&status=ok
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
138
expires
Thu, 04 Aug 2022 14:41:02 GMT
ecm3
s.amazon-adsystem.com/ Frame 54B6
Redirect Chain
  • https://jadserve.postrelease.com/suid/101959?ntv_r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dnativo.com%26id%3DNTV_USER_ID
  • https://s.amazon-adsystem.com/ecm3?ex=nativo.com&id=dd31867c-6418-41ee-a987-e71c2b6b8bca
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=nativo.com&id=dd31867c-6418-41ee-a987-e71c2b6b8bca
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
HTTP/1.1
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
41NAXRBGDHH2ZNCX67T8
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
server
nginx/1.12.1
location
https://s.amazon-adsystem.com/ecm3?ex=nativo.com&id=dd31867c-6418-41ee-a987-e71c2b6b8bca
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
0
expires
Mon, 1 Jan 1990 12:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 54B6
Redirect Chain
  • https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__
  • https://stags.bluekai.com/site/23178?id=jTKicE_GJ9EQ0uhYWhcr&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64ZOMFWWC6TPNYWWCZDTPFZXIZLNFZRW63JPMVRW2MZ7MV4D233VORRHEYLJNYXGG33NEZSXQY3IMFXGOZJ5MFWWC6TPNZPXIYLNEZUWIPLKKRFWSY2FL5DUUOKFKEYHK...
  • https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=jTKicE_GJ9EQ0uhYWhcr
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=jTKicE_GJ9EQ0uhYWhcr
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
HTTP/1.1
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
YM64B07JVXK697XJ0X8W
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
P3p
CP="We do not support P3P header."
Location
https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=jTKicE_GJ9EQ0uhYWhcr
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
101
Expires
Thu, 01 Dec 1994 16:00:00 GMT
usermatch
ssum-sec.casalemedia.com/ Frame 66E6 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4b1efabc6698442d98298ab29ed5e00e8deec2dd8e58d6c0cda4b5396c4b514b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
73604a96dd4da1ec-YYZ
content-encoding
br
content-type
text/html
date
Fri, 05 Aug 2022 14:41:02 GMT
dropped-udsids
73|206|3|4|47|195|64|156
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
0
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bj7dDAwFTu606XOnku7890uwdXIA3zPcSUP8JKGxQ4wR7Ei1cP636X4kvWEqyh98GOBZzqyDg43Ce72aDVqy62ctLPqWzd%2FkMdgD1GRJ7pnAHxlwihLSTva7KycriwfKMz7e1P3aihsZnA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Is-Traffic-Usersync, Accept-Encoding
syncb
sync.bfmio.com/ Frame 28F9 		927 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.bfmio.com/syncb?pid=137
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.161.197.14 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-161-197-14.compute-1.amazonaws.com
Software
/
Resource Hash
6b6f602a8c6dd1b64fb70f7b5b98518cf67688b20bdd24e63d60ac1f9eedcb9e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Connection
keep-alive
Content-Length
927
Content-Type
text/html
Date
Fri, 05 Aug 2022 14:41:02 GMT
ecm3
s.amazon-adsystem.com/ Frame 569F
Redirect Chain
  • https://ssbsync-us.smartadserver.com/api/sync?callerId=2
  • https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=1063148059880476994&gdpr=0&gdpr_consent=
43 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=1063148059880476994&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Fri, 05 Aug 2022 14:41:02 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Permissions-Policy
interest-cohort=()
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
x-amz-rid
GKD6A98HFD3SMAQPEWXN

Redirect headers

content-length
0
date
Fri, 05 Aug 2022 14:41:02 GMT
location
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=1063148059880476994&gdpr=0&gdpr_consent=
ecm3
s.amazon-adsystem.com/ Frame C659
Redirect Chain
  • https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D
  • https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=25213108a47a08e6&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D
  • https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAADKEQUwXTcGQMhVuXhAAAAAAA&expiration=1659796862&is_secure=true
43 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAADKEQUwXTcGQMhVuXhAAAAAAA&expiration=1659796862&is_secure=true
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Fri, 05 Aug 2022 14:41:02 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Permissions-Policy
interest-cohort=()
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
x-amz-rid
B4Z56DMM23KJGP0742EZ

Redirect headers

cache-control
no-cache, private, max-age=0, no-store
content-length
0
date
Fri, 05 Aug 2022 14:41:02 GMT
expires
0
location
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAADKEQUwXTcGQMhVuXhAAAAAAA&expiration=1659796862&is_secure=true
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
pragma
no-cache
server
nginx
TAM
sync.inmobi.com/ Frame 1158 		0
0
/
match.sharethrough.com/jwumXNuB/v1/ Frame 0897 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D$UID
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.66.208.67 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-66-208-67.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 68FC 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.29.128.213 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-29-128-213.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=51056
content-encoding
gzip
content-length
5549
content-type
text/html; charset=UTF-8
date
Fri, 05 Aug 2022 14:41:02 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
expires
Sat, 06 Aug 2022 04:51:58 GMT
last-modified
Tue, 01 Feb 2022 06:38:00 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
tamptsync
sync-amz.ads.yieldmo.com/ Frame 7065 		885 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.205.90.144 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-205-90-144.compute-1.amazonaws.com
Software
/
Resource Hash
33b843f4d668565995a11eb3880a71ba19f7df315dda2cd861a41f0d2caa776c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
usync.html
eus.rubiconproject.com/ Frame 1184 		281 B
573 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-1-200-83.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Fri, 05 Aug 2022 14:41:02 GMT
ETag
"402b2-119-5d32342a551c0"
Last-Modified
Tue, 14 Dec 2021 23:07:59 GMT
Server
Apache/2.2.15 (CentOS)
Unused62
8096267
Vary
Accept-Encoding
visitormatch
bh.contextweb.com/ Frame 9100 		828 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
198.148.27.140 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(9.4.14.v20181114) /
Resource Hash
3c20e2a596aedf731d02b9bcd07cfb16b1c7361b61c0835de994fb8a4086454c
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=0, no-cache, no-store
content-language
en-CA
content-length
828
content-type
text/html;charset=iso-8859-1
cw-server
bh-deployment-648874c7-qchw4
expires
-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server
Jetty(9.4.14.v20181114)
strict-transport-security
max-age=15768000
ecm3
s.amazon-adsystem.com/ Frame B422
Redirect Chain
  • https://ib.adnxs.com/getuid?https://s.amazon-adsystem.com/ecm3?id=$UID&ex=appnexus.com
  • https://s.amazon-adsystem.com/ecm3?id=2739567155738641687&ex=appnexus.com
43 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?id=2739567155738641687&ex=appnexus.com
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Fri, 05 Aug 2022 14:41:02 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Permissions-Policy
interest-cohort=()
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
x-amz-rid
SK4W9J7MGKTZFK33D03H

Redirect headers

AN-X-Request-Uuid
6cd24570-79c5-4813-9a10-ef796fe3ef8d
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
Content-Type
text/html; charset=utf-8
Date
Fri, 05 Aug 2022 14:41:02 GMT
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Location
https://s.amazon-adsystem.com/ecm3?id=2739567155738641687&ex=appnexus.com
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma
no-cache
Server
nginx/1.21.3
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
amazon
ap.lijit.com/beacon/ Frame 013C
Redirect Chain
  • https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com
  • https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
63.251.86.49 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software
/
Resource Hash
fd573d81010f2f2538ee691ffb3ec04cb90644b412e464f2dd728295902c6cbc

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length
1343
Content-Type
text/html
Date
Fri, 05 Aug 2022 14:41:02 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Pragma
no-cache
X-Sovrn-Pod
ad_ap1dca1

Redirect headers

Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length
0
Date
Fri, 05 Aug 2022 14:41:02 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
Location
https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
P3P
CP="CUR ADM OUR NOR STA NID"
Pragma
no-cache
X-Sovrn-Pod
ad_ap1dca1
ecm3
s.amazon-adsystem.com/ Frame 903D
Redirect Chain
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
  • https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4526249851231332969674
43 B
556 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4526249851231332969674
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Fri, 05 Aug 2022 14:41:02 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Permissions-Policy
interest-cohort=()
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
x-amz-rid
S15WEN33QMQTY95T11F4

Redirect headers

cache-control
no-cache, no-store, must-revalidate
content-length
0
date
Fri, 05 Aug 2022 14:41:02 GMT
location
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4526249851231332969674
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
crum
dsum-sec.casalemedia.com/ Frame F05C
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=Yu0r-GZu4dfEMT1ZXkpk7AAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEGOuU3crHOa3YpqFdRUe8Sg&google_cver=1
43 B
910 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEGOuU3crHOa3YpqFdRUe8Sg&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a987eaaa1ed-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y3qB6xKWXFlhuLrdo5%2F%2FPB8fbFlaxnuUmUEojW7BMzIiWHAzX5dNHq1wwvg%2BRtW%2FgOYvYoux6rmLPuboVcGoJIUfV1swhEpsxx3HMOsOtYHQmsFm4f7NXgcDMvVStXabRyc1s6YV3W%2BkWQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEGOuU3crHOa3YpqFdRUe8Sg&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame F05C 		43 B
932 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
YRMVV9NC022ESZP9FEZC
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
usermatchredir
ssum-sec.casalemedia.com/ Frame F05C
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB&gdpr_consent=&us_privacy=&gdpr=
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEEsaPvdAb1kqHavq2blKq1o&google_cver=1
43 B
946 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEEsaPvdAb1kqHavq2blKq1o&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a980c4ba1ff-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LIX2C%2F9D%2FdVZXjFvPrLgUwrWQ8UFVEXzlhlXYSkhYIG0pg%2F3JG6VvFvXyIclz3Pfkj6Kq4mZWyKTJA7AgonDqa0ozN7t8vFO2OoBlcpffbnBcD%2FavGnnZII4LXozyqs8tbrCm2YfMO5Mcw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&google_gid=CAESEEsaPvdAb1kqHavq2blKq1o&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
342
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame F05C
Redirect Chain
  • https://match.adsrvr.org/track/cmf/casale
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=5e1b1e00-4929-4a58-9799-282bf9b88b13&expiration=1662302462&gdpr=0&gdpr_consent=
43 B
420 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=5e1b1e00-4929-4a58-9799-282bf9b88b13&expiration=1662302462&gdpr=0&gdpr_consent=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol
H2
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a9799dca1de-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W5pb628t1nSvKTRjxryLgDCGqtZ2%2FTLxdgjDQKzPtVLJE1pXLPGxXSgZ%2ByU2Thd7BMgcgJ3nSbcru8KoN%2BwzuinzAKFU7fF0XUFB4l%2BzWD8aQ4mm%2BqiKfK0gfJVVpshhrmueaJ6eW2cYkA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=5e1b1e00-4929-4a58-9799-282bf9b88b13&expiration=1662302462&gdpr=0&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
323
ix
ad4m.at/ad/sim/ Frame F05C 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad4m.at/ad/sim/ix
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers
crum
dsum-sec.casalemedia.com/ Frame F05C
Redirect Chain
  • https://sync.adotmob.com/cookie/indexexchange?r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D13%26external_user_id%3D%7bamob_user_id%7d%26expiration%3D%5bEXPIRATION%5d
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=07fa220407856ba7fed99db8&expiration=[EXPIRATION]
43 B
904 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=07fa220407856ba7fed99db8&expiration=[EXPIRATION]
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604aa18c1fa1ed-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tsiAeNWk9bjPQ4MhhPppLAb3YK8Nzo0GcRjP9HZaFgHY8r7XuLA4lErp3Fn5peSEDdMrvgGFF1omYraE26vQFIr8OkxCp2%2BWeopKtlle9FSDVLQMyxLr5a0i6HSxS0q3CYLuLAs8i8DzUw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=13&external_user_id=07fa220407856ba7fed99db8&expiration=[EXPIRATION]
Date
Fri, 05 Aug 2022 14:40:43 GMT
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Powered-By
Express
Content-Length
0
Vary
Origin
rum
dsum-sec.casalemedia.com/ Frame F05C
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Yu0r-gAENBckxgA0
43 B
432 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Yu0r-gAENBckxgA0
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol
H2
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a976989a1de-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6W5t22Lb4zJDm%2FCQdignDJzkfZBL1mSsfiE7cVKPVbIRAk0LEEdLq0VamLg3Wq5V%2BiW%2FmK%2BID9xtSGRb4xt%2Br0qZM2Wza0lCyMZ3RTqM89UvXyOGQSSVAtOnsGarCyxsfSd5vUZ0KEmQIQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 varnish
server
Varnish
x-timer
S1659710463.563152,VS0,VE0
x-served-by
cache-yul12834-YUL
x-cache
HIT
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=Yu0r-gAENBckxgA0
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
crum
dsum-sec.casalemedia.com/ Frame F05C
Redirect Chain
  • https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2739567155738641687
43 B
419 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2739567155738641687
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol
H2
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a97698aa1de-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3crZg3mm1En8toiqvNkOcAw15MqTnGjcTPKKCkrYQBxpwj%2BuLdvWfyPBcUYWpCORNs97EKqNDduDi7Lip5Qs2kKsyMSKga0E0U6CHS7VfXVATUZaEcgvmPe8gLyc%2B08cBB1jNDB%2Fp%2BmJXw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid
1c40917e-a19c-4605-9040-d890320666e9
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=2739567155738641687
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ix-usync
router.infolinks.com/dyn/ Frame F05C 		35 B
197 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://router.infolinks.com/dyn/ix-usync?uid=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
image/gif
cache-control
no-store, no-cache, private
cf-ray
73604a971ce9ab3b-YYZ
content-length
35
expires
Thu, 05 Aug 2021 14:41:02 GMT
usync.js
eus.rubiconproject.com/ Frame 1184 		31 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-1-200-83.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
37e4253e392190e641fe31178e0da5ff17fa01824f5869a35e173ee52be4a5ec

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Fri, 05 Aug 2022 14:41:02 GMT
Content-Encoding
gzip
Last-Modified
Tue, 12 Jul 2022 20:44:25 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=14201
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9452
Expires
Fri, 05 Aug 2022 18:37:43 GMT
c
c.pub.network/ 		36 B
53 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.pub.network/c
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.messaging.2.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
b959860ce89107664ae76a8e671ddd7bb6144e05cf394fc12015208a00d7921c

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type
text/plain;charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
36
in_search.js
resources.infolinks.com/js/1812.010-3.025/ 		222 KB
89 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.infolinks.com/js/1812.010-3.025/in_search.js
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1812.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae938820655d8afb2bcaac1a4c8e03cb464fd7cf04c3f4c9f9ce7917eae728c0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a976d4fab3b-YYZ
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
HIT
last-modified
Mon, 25 Jul 2022 11:36:24 GMT
server
cloudflare
age
10618
etag
W/"3762b-5e49f98033a47"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
content-encoding
gzip
expires
Sun, 04 Sep 2022 11:44:04 GMT
ima3.js
imasdk.googleapis.com/js/sdkloader/ 		375 KB
125 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1812.010-3.025/ice.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::200a New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
94c4cb2855f0ef44546259b2c956b69c6f7ede7652d670b39002c6a291a49dfa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
127666
x-xss-protection
0
expires
Fri, 05 Aug 2022 14:41:02 GMT
pbice.js
resources.infolinks.com/js/pbice/3.025/ 		279 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.infolinks.com/js/pbice/3.025/pbice.js
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1812.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
95efc6a1b0e18636b608c1280049e1e31e5dac2f28c111ae489cea912f8b927b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a976d51ab3b-YYZ
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
HIT
last-modified
Wed, 30 Jun 2021 09:40:59 GMT
server
cloudflare
age
852
etag
W/"45adc-5c5f8851c3ea8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
content-encoding
gzip
expires
Sun, 04 Sep 2022 14:26:50 GMT
usync.html
eus.rubiconproject.com/ Frame CB93
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
  • https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
281 B
573 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by
Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-1-200-83.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
about:blank
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Fri, 05 Aug 2022 14:41:02 GMT
ETag
"402b2-119-5d32342a551c0"
Last-Modified
Tue, 14 Dec 2021 23:07:59 GMT
Server
Apache/2.2.15 (CentOS)
Unused62
8096267
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Fri, 05 Aug 2022 14:41:02 GMT
location
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
server
AkamaiGHost
match
events-ssc.33across.com/ Frame 27E4
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
  • https://x.bidswitch.net/ul_cb/sync?ssp=the33across&us_privacy=
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&gdpr=&consent=&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dthe33...
  • https://x.bidswitch.net/sync?dsp_id=354&user_id=70192a28055842dbbc24a64288fe5dd7&ssp=the33across&bsw_param=cf57a75d-4f5e-49b9-b35a-536b2987624c&gdpr=&consent=&gdpr_pd=&expires=7
  • https://ssc-cms.33across.com/ps/?xi=10&us_privacy=&xu=cf57a75d-4f5e-49b9-b35a-536b2987624c
  • https://events-ssc.33across.com/match?bidder_id=10&external_user_id=cf57a75d-4f5e-49b9-b35a-536b2987624c&ts=1659710462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
68 B
82 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://events-ssc.33across.com/match?bidder_id=10&external_user_id=cf57a75d-4f5e-49b9-b35a-536b2987624c&ts=1659710462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol
H3
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
referrer-policy
unsafe-url
server
33XP003
x-33x-status
8000000008200000A
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://events-ssc.33across.com/match?bidder_id=10&external_user_id=cf57a75d-4f5e-49b9-b35a-536b2987624c&ts=1659710462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
match
events-ssc.33across.com/ Frame 27E4
Redirect Chain
  • https://ssc-cms.33across.com/ps/?us_privacy=&ts=1659710462549.3&ri=1&ru=https%3A%2F%2Fsync.mathtag.com%2Fsync%2Fimg%3Fus_privacy%3D%24%7BUS_PRIVACY%7D%26mt_exid%3D73%26redir%3Dhttps%253A%252F%252Fe...
  • https://sync.mathtag.com/sync/img?us_privacy=&mt_exid=73&redir=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D1%26external_user_id%3D%5BMM_UUID%5D
  • https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=3d9b62ed-2bff-4400-97d4-14b35df0617d
68 B
126 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=3d9b62ed-2bff-4400-97d4-14b35df0617d
Requested by
Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
68
content-type
image/png

Redirect headers

Date
Fri, 05 Aug 2022 14:41:02 GMT
Server
MT3 4475 c1dc35a master ord-pixel-x31 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=1&external_user_id=3d9b62ed-2bff-4400-97d4-14b35df0617d
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Fri, 05 Aug 2022 14:41:01 GMT
match
events-ssc.33across.com/ Frame 27E4
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
  • https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-VSL73VZE2uHRLs_SnVEgsfJolKZkVLqu~A
  • https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-VSL73VZE2uHRLs_SnVEgsfJolKZkVLqu%7EA&ts=1659710462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
68 B
225 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-VSL73VZE2uHRLs_SnVEgsfJolKZkVLqu%7EA&ts=1659710462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
referrer-policy
unsafe-url
server
33XP004
x-33x-status
8000000008200000C
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-VSL73VZE2uHRLs_SnVEgsfJolKZkVLqu%7EA&ts=1659710462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
match
events-ssc.33across.com/ Frame 27E4
Redirect Chain
  • https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy=
  • https://33across-match.dotomi.com/match/bounce/current?DotomiTest=5575f6903a850da3&is_secure=true&networkId=78390&version=1&us_privacy=
  • https://ssc-cms.33across.com/ps?xi=64&xu=AAADKEQUwXTcHAMKEXmTAAAAAAA&expiration=1659796862&is_secure=true&us_privacy=
  • https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAADKEQUwXTcHAMKEXmTAAAAAAA&ts=1659710462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
68 B
126 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAADKEQUwXTcHAMKEXmTAAAAAAA&ts=1659710462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
referrer-policy
unsafe-url
server
33XP005
x-33x-status
8000000008200000A
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAADKEQUwXTcHAMKEXmTAAAAAAA&ts=1659710462&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
match
cms-xch-chicago.33across.com/ Frame 27E4
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=f0v35ew&ttd_tpi=1&us_privacy=
  • https://ssc-cms.33across.com/ps/?ri=102&ru=https%3A%2F%2Fcms-xch-chicago.33across.com%2Fmatch%3Fbidder_id%3D102%26ttl%3D1662302462%26external_user_id%3D5e1b1e00-4929-4a58-9799-282bf9b88b13
  • https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1662302462&external_user_id=5e1b1e00-4929-4a58-9799-282bf9b88b13
68 B
225 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1662302462&external_user_id=5e1b1e00-4929-4a58-9799-282bf9b88b13
Requested by
Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol
H2
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
referrer-policy
unsafe-url
server
33XP003
x-33x-status
40000000008200000C
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://cms-xch-chicago.33across.com/match?bidder_id=102&ttl=1662302462&external_user_id=5e1b1e00-4929-4a58-9799-282bf9b88b13
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 66E6 		43 B
984 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB?gdpr_consent=&us_privacy=&gdpr=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f13:d60:4f01:bbc5:ac74:cf42:940a Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 66E6
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB&gdpr_consent=&us_privacy=&gdpr=
  • https://pr-bh.ybp.yahoo.com/sync/casale/Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB
43 B
984 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
H2
Server
2600:1f13:d60:4f01:bbc5:ac74:cf42:940a Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff

Redirect headers

location
https://pr-bh.ybp.yahoo.com/sync/casale/Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB
date
Fri, 05 Aug 2022 14:41:02 GMT
server
ATS/9.1.0.46
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
crum
dsum-sec.casalemedia.com/ Frame 66E6
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=5b3662ed-2bfe-4400-8a13-d2fbbcb60e53
43 B
941 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=5b3662ed-2bfe-4400-8a13-d2fbbcb60e53
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a987eb0a1ed-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1vewI6vO%2FyGN1Wc0xJ8uUDliqfy3PXM1pigGt7Ir%2BS8ULRyvVOYseUm8jMTiCAiCAnk7H5NiYqs1aGqM5gp1GvxiNOA4v5Tk8rVGdobykNnSUXsTVOlOadWXtMTOcYAjXawf6lITlvDPLA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

Date
Fri, 05 Aug 2022 14:41:02 GMT
Server
MT3 4475 c1dc35a master ord-pixel-x34 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=5b3662ed-2bfe-4400-8a13-d2fbbcb60e53
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Fri, 05 Aug 2022 14:41:01 GMT
rum
dsum-sec.casalemedia.com/ Frame 66E6
Redirect Chain
  • https://ad.turn.com/r/cs?pid=21
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=3305665001870070297
43 B
911 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=3305665001870070297
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a997858a1ed-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hwf2%2BxilawFd388C%2FiEgQjgS8Zyr3HHOB%2FhikWahT0l4mWR9mR3yQLDPaUuD8X5uI0UuqyuLj6wjXkHQtFIpP0%2Fhdyg%2Be8w1aZF5g1kqKYinqxbsowqu1%2F58XDn7hWtRZqVlYjynUThVhQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=3305665001870070297
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
crum
dsum-sec.casalemedia.com/ Frame 66E6
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=fYkDlbmh1OjYvA5
43 B
912 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=fYkDlbmh1OjYvA5
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a98befaa1ed-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oPxjGXh2mzwSAqWn9%2FyFDeV%2BAqDRzqHL%2FkZU7i7BgnR2dprM8MSs5FdPY1N9O0T7aKYzbBYlJmu1Nanhz%2FFm%2BA15YdQuzVIde8rWWn8IvqAtpn8ILT%2Bptf3dVHyiZdAogYsIq0%2FYQ9aQrw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
Server
PingMatch/658332f#658332fc5aaa95d8a9be88d89d84d3c319923363 i-0e41e0757a7a8f54f@us-east-1b@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=fYkDlbmh1OjYvA5
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame 66E6
Redirect Chain
  • https://nep.advangelists.com/xp/user-sync?acctid=405&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D195%26external_user_id%3D%7BPARTNER_VISITOR_ID%7D%0A
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-4eabf8d8-ed30-4315-9f9e-4cd80da18c86
43 B
913 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-4eabf8d8-ed30-4315-9f9e-4cd80da18c86
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a987eada1ed-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BmQ0mlZ6uhAlK8qj5ZrdU2hf1cqRLQezzKVRV%2FhCwlfnNXJ5vmL0otzpAC%2Fv%2F0KxULvSMllmoOaSkhzcBWNGQnLKKFNfp0%2F%2FUTzSvVCnQK5lw8g5OSLKXgwHD6yTA7f7UUuQdzZ4SD1MRw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=195&external_user_id=av-4eabf8d8-ed30-4315-9f9e-4cd80da18c86
date
Fri, 05 Aug 2022 14:41:02 GMT
server
Apache-Coyote/1.1
content-length
0
qmap
sync.crwdcntrl.net/ Frame 66E6
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=48
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2...
0
0
crum
dsum.casalemedia.com/ Frame 66E6
Redirect Chain
  • https://bttrack.com/pixel/cookiesync?source=67e94f23-25d6-4008-8236-375d1743c2e0&secure=1
  • https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=060b4244-ee38-489d-b7ed-1a0a44b9f67a
43 B
943 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=060b4244-ee38-489d-b7ed-1a0a44b9f67a
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
H2
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a990e21f975-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GhuqjoEagliSoP0ro9m%2BtR%2F42wovRkAoUHTDMAnfvO0UA1L%2FTlApJyXu4E%2BeTdq55Ru4Bs6JNyy7Fgudk2oR43tFDNCrRqfG%2BPPit0g3kDjn4gJjVOoF6gBi8yXdSpg9xunn6kN0"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

X-ServerName
Track002-iad
Pragma
no-cache
Date
Fri, 05 Aug 2022 14:40:04 GMT
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
P3P
CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Location
https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=060b4244-ee38-489d-b7ed-1a0a44b9f67a
Cache-Control
private,no-cache
Content-Type
text/html; charset=utf-8
Content-Length
222
Expires
-1
ecm3
s.amazon-adsystem.com/ Frame 66E6 		43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=index.com&id=Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
G9F5DD9JY0BS0ASW87J6
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
rtset
bh.contextweb.com/bh/ Frame 9100
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=dXpoeDFZcW1ITjBhaHdFdEpQSG40dw&gdpr=0&gdpr_consent=
  • https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEDnhnNckMBR8zwGZusKjj3o&google_cver=1
49 B
650 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEDnhnNckMBR8zwGZusKjj3o&google_cver=1
Requested by
Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint
Protocol
H2
Server
198.148.27.140 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(9.4.14.v20181114) /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
content-language
en-CA
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
content-type
image/gif;charset=iso-8859-1
cw-server
bh-deployment-648874c7-qchw4
expires
-1

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEDnhnNckMBR8zwGZusKjj3o&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
335
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rtset
bh.contextweb.com/bh/ Frame 9100
Redirect Chain
  • https://pulsepoint-match.dotomi.com/match/bounce/current?networkId=14200&version=1&nuid=
  • https://pulsepoint-match.dotomi.com/match/bounce/current?DotomiTest=6b31a9342ec708e5&is_secure=true&networkId=14200&version=1&nuid=
  • https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAADKPn7AX7OtANm4FZhAAAAAAA&expiration=1659796862&nuid=&is_secure=true
49 B
678 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAADKPn7AX7OtANm4FZhAAAAAAA&expiration=1659796862&nuid=&is_secure=true
Requested by
Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint
Protocol
H2
Server
198.148.27.140 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(9.4.14.v20181114) /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
content-language
en-CA
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
content-type
image/gif;charset=iso-8859-1
cw-server
bh-deployment-648874c7-qchw4
expires
-1

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAADKPn7AX7OtANm4FZhAAAAAAA&expiration=1659796862&nuid=&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
ecm3
s.amazon-adsystem.com/ Frame 9100 		43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=Qjuqd5zMsyOS&ex=Pulsepoint
Requested by
Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
33SNWV012N2DT3G7Q58D
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 013C 		43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=FGHRhPZHXp7Ir1doSteX52FA&ex=sovrn.com&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
J68FGNNA27A5ZS5VQVV9
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
merge
ce.lijit.com/ Frame 013C
Redirect Chain
  • https://p.rfihub.com/cm?in=1&pub=1827&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=10&3pid=1797288115146808421
43 B
1014 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=10&3pid=1797288115146808421
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Server
23.92.190.69 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap3ewr1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Location
https://ce.lijit.com/merge?pid=10&3pid=1797288115146808421
Date
Fri, 05 Aug 2022 14:41:02 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
merge
ce.lijit.com/ Frame 013C
Redirect Chain
  • https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=83&3pid=L6GKR815-T-8KOJ&gdpr=0
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=83&3pid=L6GKR815-T-8KOJ&gdpr=0
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Server
23.92.190.69 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:03 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap3ewr1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://ce.lijit.com/merge?pid=83&3pid=L6GKR815-T-8KOJ&gdpr=0
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
0163a7456b0a5605e8b1fb1d4fba3e4d
Expires
0
pv=y
bcp.crwdcntrl.net/5/ct=y/c=5436/tp=SVRN/tpid=FGHRhPZHXp7Ir1doSteX52FA/ Frame 013C
Redirect Chain
  • https://bcp.crwdcntrl.net/5/c=5436/tp=SVRN/tpid=FGHRhPZHXp7Ir1doSteX52FA/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent=
  • https://bcp.crwdcntrl.net/5/ct=y/c=5436/tp=SVRN/tpid=FGHRhPZHXp7Ir1doSteX52FA/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent=
0
0
qmap
sync.crwdcntrl.net/ Frame 013C
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=${gdpr}&gdpr_consent=${gdpr_consent}&gdpr=0&gdpr_consent=
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=23&gdpr=${gdpr}&gdpr_consent=${gdpr_consent}&gdpr=0&gdpr_consent=
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2...
0
0
merge
ce.lijit.com/ Frame 013C
Redirect Chain
  • https://data.adsrvr.org/track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=27&3pid=5e1b1e00-4929-4a58-9799-282bf9b88b13&gdpr=0&gdpr_consent=
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=27&3pid=5e1b1e00-4929-4a58-9799-282bf9b88b13&gdpr=0&gdpr_consent=
Requested by
Host: ap.lijit.com
URL: https://ap.lijit.com/beacon/amazon?url=https://s.amazon-adsystem.com/ecm3?id=$UID&ex=sovrn.com&dnr=1
Protocol
HTTP/1.1
Server
23.92.190.69 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap3ewr1
Content-Type
image/gif
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ce.lijit.com/merge?pid=27&3pid=5e1b1e00-4929-4a58-9799-282bf9b88b13&gdpr=0&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
223
ecm3
s.amazon-adsystem.com/ Frame 7065 		43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=ym.com&id=g777f76d8ca4bf6562c5
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
WP71G9T2CJ10R1BCT5F9
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sync
ads.yieldmo.com/v000/ Frame 7065
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?&ssp=yieldmo
  • https://rtb.mfadsrvr.com/ul_cb/sync?&ssp=yieldmo
  • https://ads.yieldmo.com/v000/sync?pn_id=mf&userid=6d33763a-bcfb-43c0-8f79-5c0c6a498cb9&gdpr=&gdpr_pd=&gdpr_consent=
43 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?pn_id=mf&userid=6d33763a-bcfb-43c0-8f79-5c0c6a498cb9&gdpr=&gdpr_pd=&gdpr_consent=
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
H2
Server
52.201.176.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-201-176-252.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
content-type
image/gif
content-length
43
access-control-allow-methods
GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma

Redirect headers

location
//ads.yieldmo.com/v000/sync?pn_id=mf&userid=6d33763a-bcfb-43c0-8f79-5c0c6a498cb9&gdpr=&gdpr_pd=&gdpr_consent=
date
Fri, 05 Aug 2022 14:41:02 GMT
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
sync
ib.adnxs.com/&https://ads.yieldmo.com/v000/ Frame 7065
Redirect Chain
  • https://ib.adnxs.com/getuid?&https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an
  • https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=2739567155738641687&pn_id=an
0
597 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=2739567155738641687&pn_id=an
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
HTTP/1.1
Server
68.67.160.24 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid
f20c3501-71dc-4a7c-bc3d-34929b9a31c8
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:02 GMT
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid
34377098-f223-4372-8fdd-3055b8def686
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
&https://ads.yieldmo.com/v000/sync?userid=2739567155738641687&pn_id=an
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sync
x.bidswitch.net/ Frame 7065 		43 B
235 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/sync?&ssp=yieldmo
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.211.178.172 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
172.178.211.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Fri, 05 Aug 2022 14:41:02 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
sync
ads.yieldmo.com/v000/ Frame 7065
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?&ttd_pid=yieldmo&ttd_tpi=1&ttd_puid=g5f6a31a35d593f3acba
  • https://ads.yieldmo.com/v000/sync?tdid=5e1b1e00-4929-4a58-9799-282bf9b88b13
43 B
334 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?tdid=5e1b1e00-4929-4a58-9799-282bf9b88b13
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
H2
Server
52.201.176.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-201-176-252.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
content-type
image/gif
content-length
43
access-control-allow-methods
GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ads.yieldmo.com/v000/sync?tdid=5e1b1e00-4929-4a58-9799-282bf9b88b13
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
181
sync
ads.yieldmo.com/ Frame 7065
Redirect Chain
  • https://yieldmo-match.dotomi.com/match/bounce/current?&networkId=42851&version=1
  • https://yieldmo-match.dotomi.com/match/bounce/current?DotomiTest=3e7cb12905e508e3&is_secure=true&=&networkId=42851&version=1
  • https://ads.yieldmo.com/sync?pn_id=eps&id=AAADKPn7AX7OtwMQet6pAAAAAAA&expiration=1659796862&=&is_secure=true
43 B
446 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/sync?pn_id=eps&id=AAADKPn7AX7OtwMQet6pAAAAAAA&expiration=1659796862&=&is_secure=true
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol
H2
Server
52.201.176.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-201-176-252.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
content-type
image/gif
content-length
43
access-control-allow-methods
GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://ads.yieldmo.com/sync?pn_id=eps&id=AAADKPn7AX7OtwMQet6pAAAAAAA&expiration=1659796862&=&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
sync
sync.bfmio.com/ Frame 28F9
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=rwuq9ny&ttd_tpi=1
  • https://sync.bfmio.com/sync?pid=106&uid=5e1b1e00-4929-4a58-9799-282bf9b88b13
0
589 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.bfmio.com/sync?pid=106&uid=5e1b1e00-4929-4a58-9799-282bf9b88b13
Requested by
Host: sync.bfmio.com
URL: https://sync.bfmio.com/syncb?pid=137
Protocol
HTTP/1.1
Server
54.161.197.14 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-161-197-14.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Connection
keep-alive
Date
Fri, 05 Aug 2022 14:41:02 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://sync.bfmio.com/sync?pid=106&uid=5e1b1e00-4929-4a58-9799-282bf9b88b13
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
183
sync
sync.bfmio.com/ Frame 28F9
Redirect Chain
  • https://ad.mrtnsvr.com/sync/beachfront
  • https://sync.bfmio.com/sync?pid=187&uid=6GCOCGpaM
0
394 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.bfmio.com/sync?pid=187&uid=6GCOCGpaM
Requested by
Host: sync.bfmio.com
URL: https://sync.bfmio.com/syncb?pid=137
Protocol
HTTP/1.1
Server
54.161.197.14 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-161-197-14.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Connection
keep-alive
Date
Fri, 05 Aug 2022 14:41:01 GMT

Redirect headers

location
https://sync.bfmio.com/sync?pid=187&uid=6GCOCGpaM
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
76
vary
Origin
content-type
text/html; charset=utf-8
sync
sync.bfmio.com/ Frame 28F9
Redirect Chain
  • https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fsync.bfmio.com%2Fsync%3Fpid%3D147%26uid%3D%24%7Bssky_uuid%7D
  • https://vop.sundaysky.com/sync/dmp?redirect=https%3A%2F%2Fsync.bfmio.com%2Fsync%3Fpid%3D147%26uid%3D%24%7Bssky_uuid%7D&_cvt=t
  • https://sync.bfmio.com/sync?pid=147&uid=d6.b25b5b9e55d14e60b452d4f769bb00e9
0
420 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.bfmio.com/sync?pid=147&uid=d6.b25b5b9e55d14e60b452d4f769bb00e9
Requested by
Host: sync.bfmio.com
URL: https://sync.bfmio.com/syncb?pid=137
Protocol
HTTP/1.1
Server
54.161.197.14 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-161-197-14.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Connection
keep-alive
Date
Fri, 05 Aug 2022 14:41:02 GMT

Redirect headers

location
https://sync.bfmio.com/sync?pid=147&uid=d6.b25b5b9e55d14e60b452d4f769bb00e9
date
Fri, 05 Aug 2022 14:41:02 GMT
x-content-type-options
nosniff
x-frame-options
DENY
content-length
0
x-xss-protection
1; mode=block
sync
sync.bfmio.com/ Frame 28F9
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/beachfront/2df08b5ac2c78c417229d472540ea751825d7839
  • https://sync.bfmio.com/sync?pid=157&uid=y-ckmjeWBE2pI1NHQJpXW4LYcjh2egbfsA1CcthmIV6A--~A
0
433 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.bfmio.com/sync?pid=157&uid=y-ckmjeWBE2pI1NHQJpXW4LYcjh2egbfsA1CcthmIV6A--~A
Requested by
Host: sync.bfmio.com
URL: https://sync.bfmio.com/syncb?pid=137
Protocol
HTTP/1.1
Server
54.161.197.14 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-161-197-14.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Connection
keep-alive
Date
Fri, 05 Aug 2022 14:41:02 GMT

Redirect headers

date
Fri, 05 Aug 2022 14:41:02 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://sync.bfmio.com/sync?pid=157&uid=y-ckmjeWBE2pI1NHQJpXW4LYcjh2egbfsA1CcthmIV6A--~A
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
sync
sync.bfmio.com/ Frame 28F9
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=157
  • https://sync.bfmio.com/sync?pid=172&uid=6_XrCJGTQqVPxVrU8Wo7oJU4mbM
0
412 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.bfmio.com/sync?pid=172&uid=6_XrCJGTQqVPxVrU8Wo7oJU4mbM
Requested by
Host: sync.bfmio.com
URL: https://sync.bfmio.com/syncb?pid=137
Protocol
HTTP/1.1
Server
54.161.197.14 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-161-197-14.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Connection
keep-alive
Date
Fri, 05 Aug 2022 14:41:02 GMT

Redirect headers

Location
https://sync.bfmio.com/sync?pid=172&uid=6_XrCJGTQqVPxVrU8Wo7oJU4mbM
Date
Fri, 05 Aug 2022 14:41:02 GMT
Connection
keep-alive
Content-Length
94
Content-Type
text/html; charset=utf-8
sync
sync.bfmio.com/ Frame 28F9
Redirect Chain
  • https://ad.turn.com/r/cs?pid=60
  • https://sync.bfmio.com/sync?pid=169&uid=3089492219756286489
0
404 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.bfmio.com/sync?pid=169&uid=3089492219756286489
Requested by
Host: sync.bfmio.com
URL: https://sync.bfmio.com/syncb?pid=137
Protocol
HTTP/1.1
Server
54.161.197.14 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-161-197-14.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Connection
keep-alive
Date
Fri, 05 Aug 2022 14:41:02 GMT

Redirect headers

location
https://sync.bfmio.com/sync?pid=169&uid=3089492219756286489
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
getads.htm
rt3055.infolinks.com/action/ 		10 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rt3055.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A1%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A0%2C%22sdata%22%3A%22chrome%20extension%22%2C%22scs%22%3A%22EArLjVNuS0%22%7D%5D&rid=3a9c63f3-9b2c-46b2-ba54-3fa06174237b&jsv=1812.010-3.025&sr=1600X1200&rts=1659710462705&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=104.0.5112.79&dv=p&ce=t&purl=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&tzo=-0000&c=c&strg=true&rsd=tFJESeLKNQda-DErbFG4iv_3a_zgJJtpokHSILnVg6I6x8lgjRjTx8dvns1RUQ9ROWSREbOOd2FeG8EYSrJccDp1zzwDBpRSEjlTi4X2V_qEv-bqH-F5AdvLhKEHW92URPYppqeH4lQy-CpfmhiZGFJ87WLF3NKa&rsk=54&rcs=Dx6_zX2BeQgpXshEI7zw9w&cuid=fcc31345-e707-4a86-89ae-6ca63cf6247f&hbnr=false
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1812.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
58e9be9056f29021130a164e95e3dffa1a2dba08eaa4f9983ec25a3016d1a947

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
p3p
CP="NON DSP NID OUR COR"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-language
en-CA
content-type
text/html;charset=UTF-8
cache-control
no-cache,no-store
cf-ray
73604a980e2dab3b-YYZ
x-application-context
application:prod
expires
Thu, 01 Jan 1970 00:00:00 GMT
usync.js
eus.rubiconproject.com/ Frame CB93 		31 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-1-200-83.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
37e4253e392190e641fe31178e0da5ff17fa01824f5869a35e173ee52be4a5ec

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Fri, 05 Aug 2022 14:41:02 GMT
Content-Encoding
gzip
Last-Modified
Tue, 12 Jul 2022 20:44:25 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=14201
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9452
Expires
Fri, 05 Aug 2022 18:37:43 GMT
vidice.js
resources.infolinks.com/js/vidice/2.0/ 		333 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.infolinks.com/js/vidice/2.0/vidice.js
Requested by
Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1812.010-3.025/ice.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b2bdac211f43fbee9eeb4d50f8755206599f76296cd15316a97c9d2cb2050d2f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a987eb8ab3b-YYZ
date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
cf-cache-status
HIT
last-modified
Tue, 25 Jan 2022 09:20:02 GMT
server
cloudflare
age
1432
etag
W/"5344d-5d6649709d511"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=2592000
content-encoding
gzip
expires
Sun, 04 Sep 2022 14:17:10 GMT
match
events-ssc.33across.com/ Frame CB93
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&khaos=L6GKR815-T-8KOJ
  • https://ssc-cms.33across.com/ps/?xi=1&xu=L6GKR815-T-8KOJ
  • https://events-ssc.33across.com/match?bidder_id=30&external_user_id=L6GKR815-T-8KOJ&ts=1659710463&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
68 B
82 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://events-ssc.33across.com/match?bidder_id=30&external_user_id=L6GKR815-T-8KOJ&ts=1659710463&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol
H3
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:03 GMT
via
1.1 google
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
referrer-policy
unsafe-url
server
33XP004
x-33x-status
8000000008200000A
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://events-ssc.33across.com/match?bidder_id=30&external_user_id=L6GKR815-T-8KOJ&ts=1659710463&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
UCookieSetPug
image6.pubmatic.com/AdServer/ Frame 68FC 		24 B
232 B 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=2&cb=PubMatic._uidCB
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3DPM_UID%26ex%3Dpubmatic.com&userIdMacro=PM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
1b6dfbc0392b3e04e6f10a39a7c097635148b6bc998c13ffbda40d5b3df488c8

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:02 GMT
cache-control
private
expires
Mon, 15 Aug 2022 07:26:57 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
24
content-type
text/html; charset=UTF-8
tap.php
pixel.rubiconproject.com/ Frame CB93
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/wu8HPCuX9oXu76-G6KxIsg?csrc=
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2934465120902061054
42 B
708 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2934465120902061054
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
c57992b917a1c5de787b922c662fdf18
Content-Type
image/gif

Redirect headers

date
Fri, 05 Aug 2022 14:41:03 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
2
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=2934465120902061054
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
esync
token.rubiconproject.com/ Frame CB93
Redirect Chain
  • https://id.rlcdn.com/709414.gif
  • https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
0
214 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
X-RPHost
2dd9fa24169fa04536d533da131679f8
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date
Fri, 05 Aug 2022 14:41:02 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
token
token.rubiconproject.com/ Frame CB93 		0
0
tap.php
pixel.rubiconproject.com/ Frame CB93
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPSy4vXo05hMd4iyFVNjz0w&google_cver=1
42 B
708 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPSy4vXo05hMd4iyFVNjz0w&google_cver=1
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol
HTTP/1.1
Server
8.43.72.97 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length
42
X-RPHost
c57992b917a1c5de787b922c662fdf18
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:02 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEPSy4vXo05hMd4iyFVNjz0w&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
326
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame CB93
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=-Ic5wTu9QduNWv2Cl6xoVg&rk=usync-na
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=-Ic5wTu9QduNWv2Cl6xoVg
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=-Ic5wTu9QduNWv2Cl6xoVg
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol
HTTP/1.1
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:03 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
2KCBQ0E5SJZAG6WG0CXH
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=-Ic5wTu9QduNWv2Cl6xoVg
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
c57992b917a1c5de787b922c662fdf18
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
v1
ads.yahoo.com/cms/ Frame CB93
Redirect Chain
  • https://token.rubiconproject.com/token?pid=26594
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L6GKR815-T-8KOJ&sigv=1&esig=2~37f3595e8bf98ade4f5a719a80beb48de97d6101
0
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L6GKR815-T-8KOJ&sigv=1&esig=2~37f3595e8bf98ade4f5a719a80beb48de97d6101
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol
H2
Server
2001:4998:14:800::1001 , United States, ASN14777 (YAHOO, US),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:03 GMT
cache-control
no-store
x-content-type-options
nosniff
server
ATS
strict-transport-security
max-age=15552000
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection
1; mode=block

Redirect headers

Location
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L6GKR815-T-8KOJ&sigv=1&esig=2~37f3595e8bf98ade4f5a719a80beb48de97d6101
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
368ba1c92c09ff88b641150fbbf94341
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
dcm
aax-eu.amazon-adsystem.com/s/ Frame CB93 		43 B
932 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.95.126.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:03 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
32MZ5JKNZ40G7YCV3MGR
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
setuid
px.ads.linkedin.com/ Frame CB93
Redirect Chain
  • https://token.rubiconproject.com/token?pid=36584
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L6GKR815-T-8KOJ
0
573 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L6GKR815-T-8KOJ
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol
H2
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:03 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: A9DE915A92724637A224A6D15BC8B083 Ref B: YTO30EDGE0306 Ref C: 2022-08-05T14:41:03Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lor1
x-li-proto
http/2
content-length
0
x-li-uuid
AAXlf3SYZVduL0NK8rR1Tw==

Redirect headers

Location
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L6GKR815-T-8KOJ
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
87d839cc3e00ba41df3f5dd9eab06282
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1f42b6c9dab0b73174621c0daba5d82d4f2d841fed05a3784952e660b13fb78b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type
image/png
adview.htm
rt3055.infolinks.com/action/ 		0
190 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rt3055.infolinks.com/action/adview.htm?rid=3a9c63f3-9b2c-46b2-ba54-3fa06174237b&bdc=1&midx=0&emd=OTl-MTg0OQ&rts=1659710463093&prod_t=d&jsv=1812.010-3.025&skin=sidebar&theme=nologo&sdata=chrome%20extension&scs=EArLjVNuS0&rsd=tFJESeLKNQda-DErbFG4iv_3a_zgJJtpokHSILnVg6I6x8lgjRjTx8dvns1RUQ9ROWSREbOOd2FeG8EYSrJccDp1zzwDBpRSEjlTi4X2V_qEv-bqH-F5AdvLhKEHW92URPYppqeH4lQy-CpfmhiZGFJ87WLF3NKa&rsk=54&rcs=Dx6_zX2BeQgpXshEI7zw9w
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p
CP="NON DSP NID OUR COR"
content-type
text/html;charset=UTF-8
cache-control
no-cache,no-store
cf-ray
73604a9a895bab3b-YYZ
content-length
0
x-application-context
application:prod
expires
Thu, 01 Jan 1970 00:00:00 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ Frame E1B0 		168 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: blank
URL: about:blank
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a25aecab67d35194b393545bb70a9910e9bd2ecac2d491d288f286839e6f4104
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
57250
x-xss-protection
0
server
cafe
etag
6941916086908365359
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 05 Aug 2022 14:41:03 GMT
show_ads_impl_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208030101/ Frame E1B0 		339 KB
119 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208030101/show_ads_impl_fy2021.js?bust=31068808
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4b47d637db7fc8c910e1c276ef28b2905e55de8bfe8ad585a5f16dd2a1ce884b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
122289
x-xss-protection
0
server
cafe
etag
9324796033970817529
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=1209600
timing-allow-origin
*
expires
Fri, 05 Aug 2022 14:41:03 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20220803/r20190131/ Frame 419F 		10 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20220803/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
de317176fa6b64a8e89bbd45d20b6be2560bbfa96e7e53e63eb754e18bfe6c1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
18312
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=1209600
content-encoding
gzip
content-length
4412
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 05 Aug 2022 09:35:51 GMT
etag
8616628553774171045
expires
Fri, 19 Aug 2022 09:35:51 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
integrator.js
adservice.google.ca/adsid/ Frame E1B0 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.ca/adsid/integrator.js?domain=
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208030101/show_ads_impl_fy2021.js?bust=31068808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame E1B0 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208030101/show_ads_impl_fy2021.js?bust=31068808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80c::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 676C 		18 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208030101/show_ads_impl_fy2021.js?bust=31068808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ca9cc2f0dbf61b9ba6038feb1a9ea059366a6ed563cfb056b5e8e691a834322
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding
br
content-length
9960
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 05 Aug 2022 14:41:03 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
sync_store
sync.bfmio.com/ Frame 28F9 		37 B
360 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.bfmio.com/sync_store
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=n-index_bf_smrt_cnv_n-inmobi_n-sharethrough_pm-db5_n-simpli.fi_ym_rbd_ppt_n-nativo_an-db5_sovrn_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.161.197.14 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-161-197-14.compute-1.amazonaws.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Fri, 05 Aug 2022 14:41:03 GMT
Connection
keep-alive
Content-Length
37
Content-Type
image/gif
gen_204
pagead2.googlesyndication.com/pagead/ Frame 676C 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CJlN6qEF1W6Hy0eEChE8yM0iXpDpfY3TY5hSUkokBmU91ryuvLlpYz2FXrNs_NDLsDslq3c2yx__aExRutwOzPM0WwoBGEMc09lQ3Vrx2kF2axvXw
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
window_focus_fy2021.js
s0.2mdn.net/pagead/js/r20220803/r20110914/client/ Frame 676C 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/pagead/js/r20220803/r20110914/client/window_focus_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80e::2006 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:26:21 GMT
x-content-type-options
nosniff
server
sffe
age
882
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=900
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
expires
Fri, 05 Aug 2022 14:41:21 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 676C 		139 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81f::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e30a952eadc89f735e92201acd81796193eebddb8926d345c6ce092126c9257a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43822
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1659527892023609"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Fri, 05 Aug 2022 14:41:03 GMT
qs_click_protection_fy2021.js
s0.2mdn.net/pagead/js/r20220803/r20110914/client/ Frame 676C 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/pagead/js/r20220803/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80e::2006 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:26:12 GMT
x-content-type-options
nosniff
server
sffe
age
891
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=900
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
expires
Fri, 05 Aug 2022 14:41:12 GMT
l
www.google.com/ads/measurement/ Frame 676C 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQC2PAfHUGP3Ylaof-Qyc7XlnAC6BBb08yvmZr4DAPWaRpN98VLDT1Y18pEDSpQKqqg94LitFcnqx82FNCNrn6g_qrOZA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2004 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers
pixel
googleads.g.doubleclick.net/xbbe/ Frame 4ECC 		624 B
297 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDOyFUYqtv-lwEwAQ&v=APEucNWND8EUByXZtiZvN2_kdnYY2z38_2PYL6SMoYurrBVjNW1Bkux4C68C6B08hQ-fqTh9G10ZO6j58eIyjMUrBtyuD0Katw
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
gzip
content-length
276
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 05 Aug 2022 14:41:03 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
ad
googleads.g.doubleclick.net/dbm/ Frame 676C 		82 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AM-Ru32H4f-bpFDu4xv6mKcZgKctaSgdAECJVq35oXr6qJahY6ZHVwxfZTYZ9NnTOcdjVFiMXfwrjh-6P0ucdmVrxqSQ&cry=1&dbm_d=AKAmf-BHgK4duAjtAybyr0I5nnJWwmNB2ZCpuCeG50lxvMwGl4QJyv5t6aD0vTr2ZeLK6xSs4jWKGBTpmZrKQQ6-MT28jVcqw1OqFI6noI_fJztRvCSzFiX-d4pYn7E83eb3ImWxvF0sQ4DBSA4J_VAQn0d05d27WH1cdeTuxbg0ijLz56-ECvrpxEeMeMGkya6MSY_IOA7e7t-hGtwksdsdYZUi53HJusxzg2UDRBIq-ATc3izTWY62jBRUdU6BUAz0KizmAA-tmMVQP-6bfXxTHP6R9JzBXlYTomaAc_QFwGOFmfYCy6eNikVOrT35OFZcEtKU72mOfp8tw_JpCLVqONqOSazXSoU1Z585RSbxztJRDh0uqngujto0Ms9yPY_nIex6aORIIf2-pW5jie8GLKVF4T7ICFtwiXnfFo_-u09iC2I5irgAbMhHpAGIMcLoaMIDZD4M-cmml7v0ivmKwA6DQ1GxqXJgf2y-5K_dgfyoL2OXXERUXu7rM8Ls40fYUbWLQ2hBmzMsQ5Y_ohJsUTKaS7b8Uu67rOL1BqOFRR5FgsZf0PyBCYIGDZMfktNSQoudiY20IYcdwvqz8l0R5RUPznfS0ulqINcDKGgbTiXmBTNxPBFh3ymbR77bPU6bTOgeXt5Zsn53kvM2Cd9iBAAUYxZRcR2aUqdrKei9eCxyFmFFpBSJxP8m1DLHdaQRtD86Qr3K88mgIXpXfPjtoLUj8TFcneK5DOODFGgfUk_5xI940VJZZenDhboCIQdofK6d2lcRM3jNq1TSUJiijrjoS8UtY5tTw7z2pxol6tb5gyjd3yR-BV6V59kRjjulS7uMdQ6zBQiILj81ZKPAlU3cVvzsMQrvzCyrukGfEbOzArr6VedlUa2pSBkUfJVW66BQWUSHo6FKF-HyLm8JuYt98uJPS5mu-WKJjNc_GRmsucOe5HealRtIqK49QG_m-4XwEVcEf0NUk91iLsxlwPT3hIwxAKIjFNMDWtkez3_xQw9spAaip9q733GMQRLWJWUtyVxB1nj8u-IW4JEJz42wWPbVnVzS36wBQWZbQ3Jwb-TOmQFoygUn4m-8C6SUpX8plEfWAzDHvz2GmmIURk4bwPId-Wr60Lhe_p4pUgTfBjDmMpthOc8DmmXDBdhkyZYG223rTOfpN0j3Hqv7X3KSxQ6Y0FFFH4jK4oFYF1bQJ9PRwTKH1QwFSIU7MALvSpuRqTTe4RuMYD1A36j1nHsbwFY_gI78dMR3-JXyZN-eUO0l48ULIDGN1RJgFASICjASN8c3KVBJwrsMyZrQ55a0F_j6XBv3YU8O4IrU2Z3tkKPkDjqhjIXCeby3htkb4bD6VAmdEMPDDt0Bv-rtsbgt9JxRoRQd8yCTBBdMoe8QfWWudROGFcQjYbbmSDGjgWiilbPmXLYbNojZWNCqX_5U5LV86b4lno6HF7iRdePa5n3u2G3ziX_wY8L7S2HPszyQxVXbuqYtqg1RgsQQXTVKsgA0zhWQiuRDRTE9520c0BTqpCiwbFPqa_EHepxExRZnKzS6QnEoNKyyFr0K-ZJFZIc6MffT7iK2838Hn20VFjYTO3HnA6j9tmoJgJm4OT0KQJsz4r3tmYUe-PtO2t-8ciOmysP-83rHPY7M5YlJ1ohpq1jaoZskab1g4DUQx5ax6l2zQENWDqtQJbkfVkLiCUaACPu5SIhYruU42cg1-v4DtrGCzBpupxZKzainRNDvhvezA77Epz9BwJFdra10jojLHX58htNZQ_ZRC8wiH4ELRg-3438RWLdLsimS5aQWsPZold68tvx2AgnS0Evgq3Oc8AMz72TJaKwKsoptzP-ew_yGp7Fv-Z5pOIjwayuluuvWMACSPbRvjrNAcEeRndwJpu5mJ_sgH78tTaSMGux1UXhNOFf8gRnbUXRxwjeQLrFWbo1-5_xqNSYkE0otmGWDS50gj6huPSVnKSfQ8lO1CCOGoZO9gbuPl9MZIlUoDSywIWNO71VTIKI3pwGcfe4ZpyF_-4_ymZKN2msHk66bP9-ixIaJfaYSkjRShRKDl1lAz_enT79z3O9GquCBuXn431oGDKholJ72jBShnrkvPl49zFZ80kebWMeSWKhzBXTGWg5icl2jg2w4eg7tuiggc9Z9KriHn-bJj1jrL_IERvF7-eGRb45-P_ozaWfSk0Er-1jFhECpZ1fs9gL7OzDo-sSgSA5gCtk0JIAZPnW2Ihnrs54VU_GnHK54QwC87lBXyalL3vnaTdNzPiT7d5CySm7VfKiw6EOwwhK7w-uaV8lS1VNwC_x189hmnfbHOb6QuV1_4iwT60fJeU3xurBcDBhHpoK6FipGtxLAtEQJaqknOoYRG2yozxSwUcrkSKLhFOCHjuKoR7Ky9pclWkHsp8Jw0SvyGk1l7YT1PfpeMjLEkoTFj0QtH5zn22C7Kq9Ig3i_MoEDtq44EMEPXqOkpIqOFgcFihMISiKTVza-7Z69efPzjn53Bk1rwD5a2hN-NByq8U_t6GlKGY5jaYWW-vfT9vdMFexiaMPNTQOr0-0qlxgOwVe-hH-u7389oBy_RNyQr9BzcCoIUe7O6jpL6c0VAHyE3b7daNwXMv8zR1u0RPGdeaehdvIgokON0uixYNigLAv7UQyi87vr1a1fR2BsHzAnJHnH5Woy_Lm2QQokVqNEhjIQYgdOM5XSz_hZBbYyV8JqlkZF0F9n8lvZ6DCfIoVhZMWF9l_U1LM1qjQUE3XmmIFqO48Bjv3gVo9znnyAmcX7BStIrAgBLauL-DXzikFOdQbm4J3IM1rFVgVp7YlB8yT5PaWX3gZ7XAw2g1C1wEmYY3mtPH0Gc-QgbbWKzjV1Ci6D8ebyn04tvkBlryD4-TmtUtEmLfWurJHfutxDx_qzDYK37XncTQseCy8iZL8lEzbdQHqrnUD8d1gaNv5I4YCeb-DbXBkXJYJC-7jQU9Xed-sKYj2OrpxeRHrE4V3g-CjhPzwPalEVEmxYUZ74HyJJ037HxzEvl7r0lnqnhu77BCxdG1mLmkjlWwA-HkR_w65L2qOd_5aMbhqKZlJkCcAT8q3QLWLLW6-shfNP7j3IB_yYDFU0IKI6rSC7NqoysrFPpDQjD3PQfyyNjS53HZk4jEzxpVtJNbj__jwirH-mczyMs0Q8lD7HYC8OWKvITeGAF4GPEXhaDN2mMEMsZufTTItY8ezoyt143PbMre9Z9zw-AooYq1XL9W9zOiu3VnILKIiVphz8qexV7V_0nwrSebPXaNKEJrEF3VUkre13my7Se2WblmrmuRJeHdYTViAiTt7lO5n5UgDIHGed-9NBgYbiDpeh4T6XDjIl4ADiwLOoN_LtpoWYfqKAgTn0RsHT-cszhO6o9juuiEWeLKW3lg8Yj1fdwQUdqGsB22Z_j8qtwA3AnpPO7A&cid=CAASEuRolhmcaUZS24jyY4aFJR8hDw&rfl=2%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%242%2C%2Chttps%253A%252F%252Fgoogleads.g.doubleclick.net%252Fpagead%252Fads%253Fclient%253Dca-pub-4299156005397946%2526output%253Dhtml%2526h%253D90%2526slotname%253DADX_T1_P_728x90_ENG%2526adk%253D2655341515%2526adf%253D3279755403%2526pi%253Dt.ma~as.ADX_T1_P_728x90_ENG%2526w%253D728%2526rdp%253Dfalse%2526psa%253D0%2526format%253D728x90%2526url%253Dhttps%25253A%25252F%25252Fwww.bleepingcomputer.com%25252Fnews%25252Fsecurity%25252Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%25252F%25253Futm_source%25253Dnewsletter%252526utm_medium%25253Demail%252526utm_term%25253D2022-08-05%252526utm_campaign%25253DFw%25252BItalian%25252BInternal%25252BRevenue%25252BService%25252BBreached%25252BAudius%25252BHacked%25252BPrestaShop%25252BZero-Day%25252BFlaw%2526ea%253D0%2526alternate_ad_url%253Dhttps%25253A%25252F%25252Frouter.infolinks.com%25252Fdyn%25252Fsrh%25252Fadx%25253FhookId%25253Dd_IL_INSEARCH%2526wgl%253D1%2526uach%253DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%2526dt%253D1659710463218%2526bpp%253D4%2526bdt%253D100%2526idt%253D99%2526shv%253Dr20220803%2526mjsv%253Dm202208030101%2526ptt%253D9%2526saldr%253Daa%2526correlator%253D2768181573619%2526frm%253D23%2526ife%253D1%2526pv%253D2%2526ga_vid%253D983569196.1659710463%2526ga_sid%253D1659710463%2526ga_hid%253D1889346187%2526ga_fc%253D0%2526nhd%253D1%2526u_tz%253D0%2526u_his%253D2%2526u_h%253D1200%2526u_w%253D1600%2526u_ah%253D1200%2526u_aw%253D1600%2526u_cd%253D24%2526u_sd%253D1%2526dmc%253D8%2526adx%253D436%2526ady%253D1110%2526biw%253D1600%2526bih%253D1200%2526isw%253D728%2526ish%253D90%2526ifk%253D2121387315%2526scr_x%253D0%2526scr_y%253D0%2526eid%253D44759876%25252C44759927%25252C44759842%25252C44763506%25252C31068808%25252C42531607%25252C31068520%2526oid%253D2%2526pvsid%253D1646630767893534%2526tmod%253D291321202%2526uas%253D0%2526nvt%253D1%2526loc%253DEMPTY%2526top%253Dhttps%25253A%25252F%25252Fwww.bleepingcomputer.com%25252Fnews%25252Fsecurity%25252Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%25252F%25253Futm_source%25253Dnewsletter%252526utm_medium%25253Demail%252526utm_term%25253D2022-08-05%252526utm_campaign%25253DFw%25252BItalian%25252BInternal%25252BRevenue%25252BService%25252BBreached%25252BAudius%25252BHacked%25252BPrestaShop%25252BZero-Day%25252BFlaw%2526eae%253D2%2526fc%253D896%2526brdim%253D0%25252C0%25252C0%25252C0%25252C1600%25252C0%25252C1600%25252C1200%25252C728%25252C90%2526vis%253D1%2526rsz%253D%25257C%25257CE%25257C%2526abl%253DCS%2526pfx%253D0%2526fu%253D4%2526bc%253D31%2526ifi%253D1%2526uci%253D1.7a0q4c1ajc2e%2526fsb%253D1%2526dtd%253D113%240
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4e51341a20800a9009f155ae20c835a27f844c085b5c03daef420ecd548ad668
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
34799
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 4ECC
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGOuU3crHOa3YpqFdRUe8Sg&google_cver=1
43 B
909 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGOuU3crHOa3YpqFdRUe8Sg&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDOyFUYqtv-lwEwAQ&v=APEucNWND8EUByXZtiZvN2_kdnYY2z38_2PYL6SMoYurrBVjNW1Bkux4C68C6B08hQ-fqTh9G10ZO6j58eIyjMUrBtyuD0Katw
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a9f491da1ed-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xj1bICQ0ev%2FWX17Kvkg6cL8nmJSHDMmyLU67NDN8ZdIEhww29q24OKgTSgJUpy7YJjfDXVXG%2BFGHfiJwSTvRxuLOaXUe7XHn1TeKNUQpBJrd64wMjru7tFIxlPQWfyzmriEWVk9VMI4I8g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGOuU3crHOa3YpqFdRUe8Sg&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 4ECC
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Yu0r-GZu4dfEMT1ZXkpk7AAA
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGOuU3crHOa3YpqFdRUe8Sg&google_cver=1
43 B
908 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGOuU3crHOa3YpqFdRUe8Sg&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDOyFUYqtv-lwEwAQ&v=APEucNWND8EUByXZtiZvN2_kdnYY2z38_2PYL6SMoYurrBVjNW1Bkux4C68C6B08hQ-fqTh9G10ZO6j58eIyjMUrBtyuD0Katw
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604a9fa9bba1ed-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9eOwnuST%2BPlyLaHS5KHWFaHYmOe0WbKsW69K%2Fl3Ox6i%2BVtH4DWQxHDbigVJ0kHzrG2L4Mo2UAEEt1qQQjXGoJn3CAp3mQ2suRgbAwn%2BbYfZ2vFazjCkFPmfpwR1kno7ekTjp8Am0fGA1Gg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGOuU3crHOa3YpqFdRUe8Sg&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
setuid
ib.adnxs.com/ Frame 4ECC
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEA0SQWSRG65ATDRFMjLdsD0&google_cver=1
43 B
1018 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/setuid?entity=101&code=CAESEA0SQWSRG65ATDRFMjLdsD0&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDOyFUYqtv-lwEwAQ&v=APEucNWND8EUByXZtiZvN2_kdnYY2z38_2PYL6SMoYurrBVjNW1Bkux4C68C6B08hQ-fqTh9G10ZO6j58eIyjMUrBtyuD0Katw
Protocol
HTTP/1.1
Server
68.67.160.24 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:04 GMT
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid
fd17a88c-b4c5-4efb-ae70-e25d4a133191
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ib.adnxs.com/setuid?entity=101&code=CAESEA0SQWSRG65ATDRFMjLdsD0&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
290
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 4ECC
Redirect Chain
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjczOTU2NzE1NTczODY0MTY4Nw%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjczOTU2NzE1NTczODY0MTY4Nw%3D%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDOyFUYqtv-lwEwAQ&v=APEucNWND8EUByXZtiZvN2_kdnYY2z38_2PYL6SMoYurrBVjNW1Bkux4C68C6B08hQ-fqTh9G10ZO6j58eIyjMUrBtyuD0Katw
Protocol
H3
Server
142.251.40.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s81-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:03 GMT
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid
a8397a26-5587-4d1b-8106-2ce64ee7c3ef
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjczOTU2NzE1NTczODY0MTY4Nw%3D%3D
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
express_html_inpage_rendering_lib_200_276.js
s0.2mdn.net/879366/ Frame 676C 		106 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2006 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Origin
https://googleads.g.doubleclick.net
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 04 Aug 2022 15:29:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
83485
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37872
x-xss-protection
0
last-modified
Wed, 02 Mar 2022 23:07:26 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 05 Aug 2022 15:29:38 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20220803/r20110914/elements/html/ Frame 676C 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20220803/r20110914/elements/html/omrhp.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AM-Ru32H4f-bpFDu4xv6mKcZgKctaSgdAECJVq35oXr6qJahY6ZHVwxfZTYZ9NnTOcdjVFiMXfwrjh-6P0ucdmVrxqSQ&cry=1&dbm_d=AKAmf-BHgK4duAjtAybyr0I5nnJWwmNB2ZCpuCeG50lxvMwGl4QJyv5t6aD0vTr2ZeLK6xSs4jWKGBTpmZrKQQ6-MT28jVcqw1OqFI6noI_fJztRvCSzFiX-d4pYn7E83eb3ImWxvF0sQ4DBSA4J_VAQn0d05d27WH1cdeTuxbg0ijLz56-ECvrpxEeMeMGkya6MSY_IOA7e7t-hGtwksdsdYZUi53HJusxzg2UDRBIq-ATc3izTWY62jBRUdU6BUAz0KizmAA-tmMVQP-6bfXxTHP6R9JzBXlYTomaAc_QFwGOFmfYCy6eNikVOrT35OFZcEtKU72mOfp8tw_JpCLVqONqOSazXSoU1Z585RSbxztJRDh0uqngujto0Ms9yPY_nIex6aORIIf2-pW5jie8GLKVF4T7ICFtwiXnfFo_-u09iC2I5irgAbMhHpAGIMcLoaMIDZD4M-cmml7v0ivmKwA6DQ1GxqXJgf2y-5K_dgfyoL2OXXERUXu7rM8Ls40fYUbWLQ2hBmzMsQ5Y_ohJsUTKaS7b8Uu67rOL1BqOFRR5FgsZf0PyBCYIGDZMfktNSQoudiY20IYcdwvqz8l0R5RUPznfS0ulqINcDKGgbTiXmBTNxPBFh3ymbR77bPU6bTOgeXt5Zsn53kvM2Cd9iBAAUYxZRcR2aUqdrKei9eCxyFmFFpBSJxP8m1DLHdaQRtD86Qr3K88mgIXpXfPjtoLUj8TFcneK5DOODFGgfUk_5xI940VJZZenDhboCIQdofK6d2lcRM3jNq1TSUJiijrjoS8UtY5tTw7z2pxol6tb5gyjd3yR-BV6V59kRjjulS7uMdQ6zBQiILj81ZKPAlU3cVvzsMQrvzCyrukGfEbOzArr6VedlUa2pSBkUfJVW66BQWUSHo6FKF-HyLm8JuYt98uJPS5mu-WKJjNc_GRmsucOe5HealRtIqK49QG_m-4XwEVcEf0NUk91iLsxlwPT3hIwxAKIjFNMDWtkez3_xQw9spAaip9q733GMQRLWJWUtyVxB1nj8u-IW4JEJz42wWPbVnVzS36wBQWZbQ3Jwb-TOmQFoygUn4m-8C6SUpX8plEfWAzDHvz2GmmIURk4bwPId-Wr60Lhe_p4pUgTfBjDmMpthOc8DmmXDBdhkyZYG223rTOfpN0j3Hqv7X3KSxQ6Y0FFFH4jK4oFYF1bQJ9PRwTKH1QwFSIU7MALvSpuRqTTe4RuMYD1A36j1nHsbwFY_gI78dMR3-JXyZN-eUO0l48ULIDGN1RJgFASICjASN8c3KVBJwrsMyZrQ55a0F_j6XBv3YU8O4IrU2Z3tkKPkDjqhjIXCeby3htkb4bD6VAmdEMPDDt0Bv-rtsbgt9JxRoRQd8yCTBBdMoe8QfWWudROGFcQjYbbmSDGjgWiilbPmXLYbNojZWNCqX_5U5LV86b4lno6HF7iRdePa5n3u2G3ziX_wY8L7S2HPszyQxVXbuqYtqg1RgsQQXTVKsgA0zhWQiuRDRTE9520c0BTqpCiwbFPqa_EHepxExRZnKzS6QnEoNKyyFr0K-ZJFZIc6MffT7iK2838Hn20VFjYTO3HnA6j9tmoJgJm4OT0KQJsz4r3tmYUe-PtO2t-8ciOmysP-83rHPY7M5YlJ1ohpq1jaoZskab1g4DUQx5ax6l2zQENWDqtQJbkfVkLiCUaACPu5SIhYruU42cg1-v4DtrGCzBpupxZKzainRNDvhvezA77Epz9BwJFdra10jojLHX58htNZQ_ZRC8wiH4ELRg-3438RWLdLsimS5aQWsPZold68tvx2AgnS0Evgq3Oc8AMz72TJaKwKsoptzP-ew_yGp7Fv-Z5pOIjwayuluuvWMACSPbRvjrNAcEeRndwJpu5mJ_sgH78tTaSMGux1UXhNOFf8gRnbUXRxwjeQLrFWbo1-5_xqNSYkE0otmGWDS50gj6huPSVnKSfQ8lO1CCOGoZO9gbuPl9MZIlUoDSywIWNO71VTIKI3pwGcfe4ZpyF_-4_ymZKN2msHk66bP9-ixIaJfaYSkjRShRKDl1lAz_enT79z3O9GquCBuXn431oGDKholJ72jBShnrkvPl49zFZ80kebWMeSWKhzBXTGWg5icl2jg2w4eg7tuiggc9Z9KriHn-bJj1jrL_IERvF7-eGRb45-P_ozaWfSk0Er-1jFhECpZ1fs9gL7OzDo-sSgSA5gCtk0JIAZPnW2Ihnrs54VU_GnHK54QwC87lBXyalL3vnaTdNzPiT7d5CySm7VfKiw6EOwwhK7w-uaV8lS1VNwC_x189hmnfbHOb6QuV1_4iwT60fJeU3xurBcDBhHpoK6FipGtxLAtEQJaqknOoYRG2yozxSwUcrkSKLhFOCHjuKoR7Ky9pclWkHsp8Jw0SvyGk1l7YT1PfpeMjLEkoTFj0QtH5zn22C7Kq9Ig3i_MoEDtq44EMEPXqOkpIqOFgcFihMISiKTVza-7Z69efPzjn53Bk1rwD5a2hN-NByq8U_t6GlKGY5jaYWW-vfT9vdMFexiaMPNTQOr0-0qlxgOwVe-hH-u7389oBy_RNyQr9BzcCoIUe7O6jpL6c0VAHyE3b7daNwXMv8zR1u0RPGdeaehdvIgokON0uixYNigLAv7UQyi87vr1a1fR2BsHzAnJHnH5Woy_Lm2QQokVqNEhjIQYgdOM5XSz_hZBbYyV8JqlkZF0F9n8lvZ6DCfIoVhZMWF9l_U1LM1qjQUE3XmmIFqO48Bjv3gVo9znnyAmcX7BStIrAgBLauL-DXzikFOdQbm4J3IM1rFVgVp7YlB8yT5PaWX3gZ7XAw2g1C1wEmYY3mtPH0Gc-QgbbWKzjV1Ci6D8ebyn04tvkBlryD4-TmtUtEmLfWurJHfutxDx_qzDYK37XncTQseCy8iZL8lEzbdQHqrnUD8d1gaNv5I4YCeb-DbXBkXJYJC-7jQU9Xed-sKYj2OrpxeRHrE4V3g-CjhPzwPalEVEmxYUZ74HyJJ037HxzEvl7r0lnqnhu77BCxdG1mLmkjlWwA-HkR_w65L2qOd_5aMbhqKZlJkCcAT8q3QLWLLW6-shfNP7j3IB_yYDFU0IKI6rSC7NqoysrFPpDQjD3PQfyyNjS53HZk4jEzxpVtJNbj__jwirH-mczyMs0Q8lD7HYC8OWKvITeGAF4GPEXhaDN2mMEMsZufTTItY8ezoyt143PbMre9Z9zw-AooYq1XL9W9zOiu3VnILKIiVphz8qexV7V_0nwrSebPXaNKEJrEF3VUkre13my7Se2WblmrmuRJeHdYTViAiTt7lO5n5UgDIHGed-9NBgYbiDpeh4T6XDjIl4ADiwLOoN_LtpoWYfqKAgTn0RsHT-cszhO6o9juuiEWeLKW3lg8Yj1fdwQUdqGsB22Z_j8qtwA3AnpPO7A&cid=CAASEuRolhmcaUZS24jyY4aFJR8hDw&rfl=2%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%242%2C%2Chttps%253A%252F%252Fgoogleads.g.doubleclick.net%252Fpagead%252Fads%253Fclient%253Dca-pub-4299156005397946%2526output%253Dhtml%2526h%253D90%2526slotname%253DADX_T1_P_728x90_ENG%2526adk%253D2655341515%2526adf%253D3279755403%2526pi%253Dt.ma~as.ADX_T1_P_728x90_ENG%2526w%253D728%2526rdp%253Dfalse%2526psa%253D0%2526format%253D728x90%2526url%253Dhttps%25253A%25252F%25252Fwww.bleepingcomputer.com%25252Fnews%25252Fsecurity%25252Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%25252F%25253Futm_source%25253Dnewsletter%252526utm_medium%25253Demail%252526utm_term%25253D2022-08-05%252526utm_campaign%25253DFw%25252BItalian%25252BInternal%25252BRevenue%25252BService%25252BBreached%25252BAudius%25252BHacked%25252BPrestaShop%25252BZero-Day%25252BFlaw%2526ea%253D0%2526alternate_ad_url%253Dhttps%25253A%25252F%25252Frouter.infolinks.com%25252Fdyn%25252Fsrh%25252Fadx%25253FhookId%25253Dd_IL_INSEARCH%2526wgl%253D1%2526uach%253DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%2526dt%253D1659710463218%2526bpp%253D4%2526bdt%253D100%2526idt%253D99%2526shv%253Dr20220803%2526mjsv%253Dm202208030101%2526ptt%253D9%2526saldr%253Daa%2526correlator%253D2768181573619%2526frm%253D23%2526ife%253D1%2526pv%253D2%2526ga_vid%253D983569196.1659710463%2526ga_sid%253D1659710463%2526ga_hid%253D1889346187%2526ga_fc%253D0%2526nhd%253D1%2526u_tz%253D0%2526u_his%253D2%2526u_h%253D1200%2526u_w%253D1600%2526u_ah%253D1200%2526u_aw%253D1600%2526u_cd%253D24%2526u_sd%253D1%2526dmc%253D8%2526adx%253D436%2526ady%253D1110%2526biw%253D1600%2526bih%253D1200%2526isw%253D728%2526ish%253D90%2526ifk%253D2121387315%2526scr_x%253D0%2526scr_y%253D0%2526eid%253D44759876%25252C44759927%25252C44759842%25252C44763506%25252C31068808%25252C42531607%25252C31068520%2526oid%253D2%2526pvsid%253D1646630767893534%2526tmod%253D291321202%2526uas%253D0%2526nvt%253D1%2526loc%253DEMPTY%2526top%253Dhttps%25253A%25252F%25252Fwww.bleepingcomputer.com%25252Fnews%25252Fsecurity%25252Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%25252F%25253Futm_source%25253Dnewsletter%252526utm_medium%25253Demail%252526utm_term%25253D2022-08-05%252526utm_campaign%25253DFw%25252BItalian%25252BInternal%25252BRevenue%25252BService%25252BBreached%25252BAudius%25252BHacked%25252BPrestaShop%25252BZero-Day%25252BFlaw%2526eae%253D2%2526fc%253D896%2526brdim%253D0%25252C0%25252C0%25252C0%25252C1600%25252C0%25252C1600%25252C1200%25252C728%25252C90%2526vis%253D1%2526rsz%253D%25257C%25257CE%25257C%2526abl%253DCS%2526pfx%253D0%2526fu%253D4%2526bc%253D31%2526ifi%253D1%2526uci%253D1.7a0q4c1ajc2e%2526fsb%253D1%2526dtd%253D113%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:28:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
758
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3159
x-xss-protection
0
server
cafe
etag
1394524276809619753
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 19 Aug 2022 14:28:25 GMT
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20220803/r20110914/ Frame 676C 		30 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20220803/r20110914/abg_lite.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AM-Ru32H4f-bpFDu4xv6mKcZgKctaSgdAECJVq35oXr6qJahY6ZHVwxfZTYZ9NnTOcdjVFiMXfwrjh-6P0ucdmVrxqSQ&cry=1&dbm_d=AKAmf-BHgK4duAjtAybyr0I5nnJWwmNB2ZCpuCeG50lxvMwGl4QJyv5t6aD0vTr2ZeLK6xSs4jWKGBTpmZrKQQ6-MT28jVcqw1OqFI6noI_fJztRvCSzFiX-d4pYn7E83eb3ImWxvF0sQ4DBSA4J_VAQn0d05d27WH1cdeTuxbg0ijLz56-ECvrpxEeMeMGkya6MSY_IOA7e7t-hGtwksdsdYZUi53HJusxzg2UDRBIq-ATc3izTWY62jBRUdU6BUAz0KizmAA-tmMVQP-6bfXxTHP6R9JzBXlYTomaAc_QFwGOFmfYCy6eNikVOrT35OFZcEtKU72mOfp8tw_JpCLVqONqOSazXSoU1Z585RSbxztJRDh0uqngujto0Ms9yPY_nIex6aORIIf2-pW5jie8GLKVF4T7ICFtwiXnfFo_-u09iC2I5irgAbMhHpAGIMcLoaMIDZD4M-cmml7v0ivmKwA6DQ1GxqXJgf2y-5K_dgfyoL2OXXERUXu7rM8Ls40fYUbWLQ2hBmzMsQ5Y_ohJsUTKaS7b8Uu67rOL1BqOFRR5FgsZf0PyBCYIGDZMfktNSQoudiY20IYcdwvqz8l0R5RUPznfS0ulqINcDKGgbTiXmBTNxPBFh3ymbR77bPU6bTOgeXt5Zsn53kvM2Cd9iBAAUYxZRcR2aUqdrKei9eCxyFmFFpBSJxP8m1DLHdaQRtD86Qr3K88mgIXpXfPjtoLUj8TFcneK5DOODFGgfUk_5xI940VJZZenDhboCIQdofK6d2lcRM3jNq1TSUJiijrjoS8UtY5tTw7z2pxol6tb5gyjd3yR-BV6V59kRjjulS7uMdQ6zBQiILj81ZKPAlU3cVvzsMQrvzCyrukGfEbOzArr6VedlUa2pSBkUfJVW66BQWUSHo6FKF-HyLm8JuYt98uJPS5mu-WKJjNc_GRmsucOe5HealRtIqK49QG_m-4XwEVcEf0NUk91iLsxlwPT3hIwxAKIjFNMDWtkez3_xQw9spAaip9q733GMQRLWJWUtyVxB1nj8u-IW4JEJz42wWPbVnVzS36wBQWZbQ3Jwb-TOmQFoygUn4m-8C6SUpX8plEfWAzDHvz2GmmIURk4bwPId-Wr60Lhe_p4pUgTfBjDmMpthOc8DmmXDBdhkyZYG223rTOfpN0j3Hqv7X3KSxQ6Y0FFFH4jK4oFYF1bQJ9PRwTKH1QwFSIU7MALvSpuRqTTe4RuMYD1A36j1nHsbwFY_gI78dMR3-JXyZN-eUO0l48ULIDGN1RJgFASICjASN8c3KVBJwrsMyZrQ55a0F_j6XBv3YU8O4IrU2Z3tkKPkDjqhjIXCeby3htkb4bD6VAmdEMPDDt0Bv-rtsbgt9JxRoRQd8yCTBBdMoe8QfWWudROGFcQjYbbmSDGjgWiilbPmXLYbNojZWNCqX_5U5LV86b4lno6HF7iRdePa5n3u2G3ziX_wY8L7S2HPszyQxVXbuqYtqg1RgsQQXTVKsgA0zhWQiuRDRTE9520c0BTqpCiwbFPqa_EHepxExRZnKzS6QnEoNKyyFr0K-ZJFZIc6MffT7iK2838Hn20VFjYTO3HnA6j9tmoJgJm4OT0KQJsz4r3tmYUe-PtO2t-8ciOmysP-83rHPY7M5YlJ1ohpq1jaoZskab1g4DUQx5ax6l2zQENWDqtQJbkfVkLiCUaACPu5SIhYruU42cg1-v4DtrGCzBpupxZKzainRNDvhvezA77Epz9BwJFdra10jojLHX58htNZQ_ZRC8wiH4ELRg-3438RWLdLsimS5aQWsPZold68tvx2AgnS0Evgq3Oc8AMz72TJaKwKsoptzP-ew_yGp7Fv-Z5pOIjwayuluuvWMACSPbRvjrNAcEeRndwJpu5mJ_sgH78tTaSMGux1UXhNOFf8gRnbUXRxwjeQLrFWbo1-5_xqNSYkE0otmGWDS50gj6huPSVnKSfQ8lO1CCOGoZO9gbuPl9MZIlUoDSywIWNO71VTIKI3pwGcfe4ZpyF_-4_ymZKN2msHk66bP9-ixIaJfaYSkjRShRKDl1lAz_enT79z3O9GquCBuXn431oGDKholJ72jBShnrkvPl49zFZ80kebWMeSWKhzBXTGWg5icl2jg2w4eg7tuiggc9Z9KriHn-bJj1jrL_IERvF7-eGRb45-P_ozaWfSk0Er-1jFhECpZ1fs9gL7OzDo-sSgSA5gCtk0JIAZPnW2Ihnrs54VU_GnHK54QwC87lBXyalL3vnaTdNzPiT7d5CySm7VfKiw6EOwwhK7w-uaV8lS1VNwC_x189hmnfbHOb6QuV1_4iwT60fJeU3xurBcDBhHpoK6FipGtxLAtEQJaqknOoYRG2yozxSwUcrkSKLhFOCHjuKoR7Ky9pclWkHsp8Jw0SvyGk1l7YT1PfpeMjLEkoTFj0QtH5zn22C7Kq9Ig3i_MoEDtq44EMEPXqOkpIqOFgcFihMISiKTVza-7Z69efPzjn53Bk1rwD5a2hN-NByq8U_t6GlKGY5jaYWW-vfT9vdMFexiaMPNTQOr0-0qlxgOwVe-hH-u7389oBy_RNyQr9BzcCoIUe7O6jpL6c0VAHyE3b7daNwXMv8zR1u0RPGdeaehdvIgokON0uixYNigLAv7UQyi87vr1a1fR2BsHzAnJHnH5Woy_Lm2QQokVqNEhjIQYgdOM5XSz_hZBbYyV8JqlkZF0F9n8lvZ6DCfIoVhZMWF9l_U1LM1qjQUE3XmmIFqO48Bjv3gVo9znnyAmcX7BStIrAgBLauL-DXzikFOdQbm4J3IM1rFVgVp7YlB8yT5PaWX3gZ7XAw2g1C1wEmYY3mtPH0Gc-QgbbWKzjV1Ci6D8ebyn04tvkBlryD4-TmtUtEmLfWurJHfutxDx_qzDYK37XncTQseCy8iZL8lEzbdQHqrnUD8d1gaNv5I4YCeb-DbXBkXJYJC-7jQU9Xed-sKYj2OrpxeRHrE4V3g-CjhPzwPalEVEmxYUZ74HyJJ037HxzEvl7r0lnqnhu77BCxdG1mLmkjlWwA-HkR_w65L2qOd_5aMbhqKZlJkCcAT8q3QLWLLW6-shfNP7j3IB_yYDFU0IKI6rSC7NqoysrFPpDQjD3PQfyyNjS53HZk4jEzxpVtJNbj__jwirH-mczyMs0Q8lD7HYC8OWKvITeGAF4GPEXhaDN2mMEMsZufTTItY8ezoyt143PbMre9Z9zw-AooYq1XL9W9zOiu3VnILKIiVphz8qexV7V_0nwrSebPXaNKEJrEF3VUkre13my7Se2WblmrmuRJeHdYTViAiTt7lO5n5UgDIHGed-9NBgYbiDpeh4T6XDjIl4ADiwLOoN_LtpoWYfqKAgTn0RsHT-cszhO6o9juuiEWeLKW3lg8Yj1fdwQUdqGsB22Z_j8qtwA3AnpPO7A&cid=CAASEuRolhmcaUZS24jyY4aFJR8hDw&rfl=2%2Chttps%253A%252F%252Fwww.bleepingcomputer.com%242%2C%2Chttps%253A%252F%252Fgoogleads.g.doubleclick.net%252Fpagead%252Fads%253Fclient%253Dca-pub-4299156005397946%2526output%253Dhtml%2526h%253D90%2526slotname%253DADX_T1_P_728x90_ENG%2526adk%253D2655341515%2526adf%253D3279755403%2526pi%253Dt.ma~as.ADX_T1_P_728x90_ENG%2526w%253D728%2526rdp%253Dfalse%2526psa%253D0%2526format%253D728x90%2526url%253Dhttps%25253A%25252F%25252Fwww.bleepingcomputer.com%25252Fnews%25252Fsecurity%25252Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%25252F%25253Futm_source%25253Dnewsletter%252526utm_medium%25253Demail%252526utm_term%25253D2022-08-05%252526utm_campaign%25253DFw%25252BItalian%25252BInternal%25252BRevenue%25252BService%25252BBreached%25252BAudius%25252BHacked%25252BPrestaShop%25252BZero-Day%25252BFlaw%2526ea%253D0%2526alternate_ad_url%253Dhttps%25253A%25252F%25252Frouter.infolinks.com%25252Fdyn%25252Fsrh%25252Fadx%25253FhookId%25253Dd_IL_INSEARCH%2526wgl%253D1%2526uach%253DWyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.%2526dt%253D1659710463218%2526bpp%253D4%2526bdt%253D100%2526idt%253D99%2526shv%253Dr20220803%2526mjsv%253Dm202208030101%2526ptt%253D9%2526saldr%253Daa%2526correlator%253D2768181573619%2526frm%253D23%2526ife%253D1%2526pv%253D2%2526ga_vid%253D983569196.1659710463%2526ga_sid%253D1659710463%2526ga_hid%253D1889346187%2526ga_fc%253D0%2526nhd%253D1%2526u_tz%253D0%2526u_his%253D2%2526u_h%253D1200%2526u_w%253D1600%2526u_ah%253D1200%2526u_aw%253D1600%2526u_cd%253D24%2526u_sd%253D1%2526dmc%253D8%2526adx%253D436%2526ady%253D1110%2526biw%253D1600%2526bih%253D1200%2526isw%253D728%2526ish%253D90%2526ifk%253D2121387315%2526scr_x%253D0%2526scr_y%253D0%2526eid%253D44759876%25252C44759927%25252C44759842%25252C44763506%25252C31068808%25252C42531607%25252C31068520%2526oid%253D2%2526pvsid%253D1646630767893534%2526tmod%253D291321202%2526uas%253D0%2526nvt%253D1%2526loc%253DEMPTY%2526top%253Dhttps%25253A%25252F%25252Fwww.bleepingcomputer.com%25252Fnews%25252Fsecurity%25252Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%25252F%25253Futm_source%25253Dnewsletter%252526utm_medium%25253Demail%252526utm_term%25253D2022-08-05%252526utm_campaign%25253DFw%25252BItalian%25252BInternal%25252BRevenue%25252BService%25252BBreached%25252BAudius%25252BHacked%25252BPrestaShop%25252BZero-Day%25252BFlaw%2526eae%253D2%2526fc%253D896%2526brdim%253D0%25252C0%25252C0%25252C0%25252C1600%25252C0%25252C1600%25252C1200%25252C728%25252C90%2526vis%253D1%2526rsz%253D%25257C%25257CE%25257C%2526abl%253DCS%2526pfx%253D0%2526fu%253D4%2526bc%253D31%2526ifi%253D1%2526uci%253D1.7a0q4c1ajc2e%2526fsb%253D1%2526dtd%253D113%240
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8a719dfbca2b4fc363e174b3f4e0f6ed16229e8bdcd22d6001d7d4411a8d86cd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:36:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
249
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11662
x-xss-protection
0
server
cafe
etag
6430633989078232507
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 19 Aug 2022 14:36:54 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 676C 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Wed, 03 Aug 2022 06:51:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
200969
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 03 Aug 2023 06:51:34 GMT
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 9A09 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
28019
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=86400
content-encoding
gzip
content-length
724
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Fri, 05 Aug 2022 06:54:04 GMT
etag
48472445140208031
expires
Sat, 06 Aug 2022 06:54:04 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 676C 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0097b607cce4ec29775d373d089aa50748d1fbfea8c986021a6c53c9457e0b4b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type
image/png
pixel
cm.g.doubleclick.net/ Frame 9A09
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEFSVClrlHMWQCPncsLiIn5A&google_cver=1&google_push=AehlK4CmhXNS7NDQAkeMQFxpS6qSMiR2E1AyNOlfAInGnX9lX2hqjjdpKMKkXjs1QpJoM2wvZxEbWaW04UONbZ9I...
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=PZti7Sv_RACX1BSzXfBhfQ&google_push=AehlK4CmhXNS7NDQAkeMQFxpS6qSMiR2E1AyNOlfAInGnX9lX2hqjjdpKMKkXjs1QpJoM2wvZxEbWaW04UONbZ9I4mgoWzM9...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=PZti7Sv_RACX1BSzXfBhfQ&google_push=AehlK4CmhXNS7NDQAkeMQFxpS6qSMiR2E1AyNOlfAInGnX9lX2hqjjdpKMKkXjs1QpJoM2wvZxEbWaW04UONbZ9I4mgoWzM9fyKUMgKHqxsdI8ZJ50HN_zbYfQrNzaGOdRVnWqCJTB1JmIlXT5kGkT9fpFg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H3
Server
142.251.40.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s81-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Fri, 05 Aug 2022 14:41:03 GMT
Server
MT3 4475 c1dc35a master ord-pixel-x10 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=PZti7Sv_RACX1BSzXfBhfQ&google_push=AehlK4CmhXNS7NDQAkeMQFxpS6qSMiR2E1AyNOlfAInGnX9lX2hqjjdpKMKkXjs1QpJoM2wvZxEbWaW04UONbZ9I4mgoWzM9fyKUMgKHqxsdI8ZJ50HN_zbYfQrNzaGOdRVnWqCJTB1JmIlXT5kGkT9fpFg
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Fri, 05 Aug 2022 14:41:02 GMT
pixel
cm.g.doubleclick.net/ Frame 9A09
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WXUwci1nQUVOQmNreGdBMA==&google_gid=CAESECobgsKr9wzzmr4WCu3dJBU&google_cver=1&google_push=AehlK4BkJ2pKgBUH1cqE1dI1On0n27sQYk...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WXUwci1nQUVOQmNreGdBMA==&google_gid=CAESECobgsKr9wzzmr4WCu3dJBU&google_cver=1&google_push=AehlK4BkJ2pKgBUH1cqE1dI1On0n27sQYkp7BKUXNFaZgdv_P3OSwQGcG3t_9dlwUdPlTbSwGjoquhqcMfTf9VjwQJlYjQyv0lQVs9arDJrgYa7wkOTrGV-qLa73PweByPYU7PZeGLpeqZP8UPVUE-tvnxQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H3
Server
142.251.40.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s81-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
via
1.1 varnish
server
Varnish
x-timer
S1659710464.960870,VS0,VE0
x-served-by
cache-yul12834-YUL
x-cache
HIT
location
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WXUwci1nQUVOQmNreGdBMA==&google_gid=CAESECobgsKr9wzzmr4WCu3dJBU&google_cver=1&google_push=AehlK4BkJ2pKgBUH1cqE1dI1On0n27sQYkp7BKUXNFaZgdv_P3OSwQGcG3t_9dlwUdPlTbSwGjoquhqcMfTf9VjwQJlYjQyv0lQVs9arDJrgYa7wkOTrGV-qLa73PweByPYU7PZeGLpeqZP8UPVUE-tvnxQ
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
dot.gif
s0.2mdn.net/ Frame 9A09 		43 B
65 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/dot.gif?google_gid=CAESECnq6Doc84DIc2ZLyW3PZFk&google_cver=1&google_push=AehlK4Amy1PCHON0ebbNwa1k5S2LZk8DClfVTqBlEkrhbgKDnl4tYfsofhgWrdXpXmjxd4IZJb6cIFWfg-k6TZpH0u1hAfQMjh013YG6gmBKX5DCGfZuR5nIFaTRgVYEAN0ykBc_hS9dsW3nA8Ol0CbUgvU
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2006 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
x-content-type-options
nosniff
last-modified
Sun, 01 Feb 2009 08:00:00 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sat, 06 Aug 2022 14:41:04 GMT
pixel
cm.g.doubleclick.net/ Frame 9A09
Redirect Chain
  • https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESEMSRXfIwJ-BWb4D5n1km8es&google_cver=1&google_push=AehlK4CuXnkAOOO7FYATt5IbhSmr77IK9uG0nIV1zo5saMLKgQzb1EX75b9VyQkZ_JA_SwiC7riEtDKTFakSFF...
  • https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNDdiMjlkMTA1M2ViNDdkZjQ1OTgxYTA0ZTQ2OGM1YmM=&google_push=AehlK4CuXnkAOOO7FYATt5IbhSmr77IK9uG0nIV1zo5saMLKgQzb1EX75b9VyQ...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNDdiMjlkMTA1M2ViNDdkZjQ1OTgxYTA0ZTQ2OGM1YmM=&google_push=AehlK4CuXnkAOOO7FYATt5IbhSmr77IK9uG0nIV1zo5saMLKgQzb1EX75b9VyQkZ_JA_SwiC7riEtDKTFakSFFAgwFcuD8djs1F988frZLQ3-TlZbMRla9j5EtKQ6AHtP1uVATUIdRAKPsD0VcMYdv0SO58
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H3
Server
142.251.40.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s81-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=chocolateplatform&google_hm=Y3AtNDdiMjlkMTA1M2ViNDdkZjQ1OTgxYTA0ZTQ2OGM1YmM=&google_push=AehlK4CuXnkAOOO7FYATt5IbhSmr77IK9uG0nIV1zo5saMLKgQzb1EX75b9VyQkZ_JA_SwiC7riEtDKTFakSFFAgwFcuD8djs1F988frZLQ3-TlZbMRla9j5EtKQ6AHtP1uVATUIdRAKPsD0VcMYdv0SO58
date
Fri, 05 Aug 2022 14:41:03 GMT
server
Chocolate Cookie Sync Powered by Vdopia
content-length
0
pixel
cm.g.doubleclick.net/ Frame 9A09
Redirect Chain
  • https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEFDBM13GnD9KbGPCkrzxVeI&google_cver=1&google_push=AehlK4DXfc0s-tWx0SjNrDwbutotGveusytzbOpzvepYfJDR1YnmqC_G-KsYzY5FrjQK0HKt2ZJj_4...
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AehlK4DXfc0s-tWx0SjNrDwbutotGveusytzbOpzvepYfJDR1YnmqC_G-KsYzY5FrjQK0HKt2ZJj_4X2ks3Na6El6cYUjOYPc3bcQPls_BNCKXFp22IGB1W7q...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AehlK4DXfc0s-tWx0SjNrDwbutotGveusytzbOpzvepYfJDR1YnmqC_G-KsYzY5FrjQK0HKt2ZJj_4X2ks3Na6El6cYUjOYPc3bcQPls_BNCKXFp22IGB1W7qhezO-h5L-qPVo1vPL6Dif7WNS_JUyQA_uY&google_hm=MTA2MzE0ODA1OTg4MDQ3Njk5NA%3D%3D
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H3
Server
142.251.40.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s81-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AehlK4DXfc0s-tWx0SjNrDwbutotGveusytzbOpzvepYfJDR1YnmqC_G-KsYzY5FrjQK0HKt2ZJj_4X2ks3Na6El6cYUjOYPc3bcQPls_BNCKXFp22IGB1W7qhezO-h5L-qPVo1vPL6Dif7WNS_JUyQA_uY&google_hm=MTA2MzE0ODA1OTg4MDQ3Njk5NA%3D%3D
date
Fri, 05 Aug 2022 14:41:03 GMT
content-length
0
pixel
cm.g.doubleclick.net/ Frame 9A09
Redirect Chain
  • https://beacon.lynx.cognitivlabs.com/adx.gif?google_gid=CAESEDaespbaxs288joV50ELP-4&google_cver=1&google_push=AehlK4DWoOkpAklJlC16ArHhDzf6ayc09p051iSSCeiy87vGIO_g_qrwaGKzfWSxZ52Nk-RVeaIARrIvLwN4n8j...
  • https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=XIcEtx8rZ0WutDY8-ZJloA&google_push=AehlK4DWoOkpAklJlC16ArHhDzf6ayc09p051iSSCeiy87vGIO_g_qrwaGKzfWSxZ52Nk-RVeaIARrIvLwN4n8jkKdYMa12UR...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=XIcEtx8rZ0WutDY8-ZJloA&google_push=AehlK4DWoOkpAklJlC16ArHhDzf6ayc09p051iSSCeiy87vGIO_g_qrwaGKzfWSxZ52Nk-RVeaIARrIvLwN4n8jkKdYMa12URTnPbd8Ds1MBF8cLu__lOCLKOwnKD9zievPq9G5PHzeGkyRuZkZhBrxtfYBL
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H3
Server
142.251.40.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s81-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=XIcEtx8rZ0WutDY8-ZJloA&google_push=AehlK4DWoOkpAklJlC16ArHhDzf6ayc09p051iSSCeiy87vGIO_g_qrwaGKzfWSxZ52Nk-RVeaIARrIvLwN4n8jkKdYMa12URTnPbd8Ds1MBF8cLu__lOCLKOwnKD9zievPq9G5PHzeGkyRuZkZhBrxtfYBL
date
Fri, 05 Aug 2022 14:41:04 GMT
server
Kestrel
content-length
0
/
onetag-sys.com/match/ Frame 9A09
Redirect Chain
  • https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEBtgb0Vr1CODq_iWAlubP1U&google_cver=1&google_push=AehlK4B0iigA9LIea05s2pQ_97Y6Nb_MGbAvMECIsoTok98HpJKcAbaoY5A0Y7Hs8LIrjF9vAHP1OQsrBgl...
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AehlK4B0iigA9LIea05s2pQ_97Y6Nb_MGbAvMECIsoTok98HpJKcAbaoY5A0Y7Hs8LIrjF9vAHP1OQsrBglLjTbkNAVZ2po5FfHwb-kljQnh0z-8KY-n3jNH...
  • https://onetag-sys.com/match/?int_id=19&google_error=5
0
151 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=19&google_error=5
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H2
Server
51.222.39.185 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip185.ip-51-222-39.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
255
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
attr
cm.g.doubleclick.net/pixel/ Frame 9A09 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Lp80jrM7r1d2Dw7Jm-HkFVsEr1u1SKd6uzhuNV_LNYWVj2KHMDgwAKjWd-3VUU9U1e1oV6QfY
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4299156005397946&output=html&h=90&slotname=ADX_T1_P_728x90_ENG&adk=2655341515&adf=3279755403&pi=t.ma~as.ADX_T1_P_728x90_ENG&w=728&rdp=false&psa=0&format=728x90&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&alternate_ad_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsrh%2Fadx%3FhookId%3Dd_IL_INSEARCH&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710463218&bpp=4&bdt=100&idt=99&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&correlator=2768181573619&frm=23&ife=1&pv=2&ga_vid=983569196.1659710463&ga_sid=1659710463&ga_hid=1889346187&ga_fc=0&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1110&biw=1600&bih=1200&isw=728&ish=90&ifk=2121387315&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763506%2C31068808%2C42531607%2C31068520&oid=2&pvsid=1646630767893534&tmod=291321202&uas=0&nvt=1&loc=EMPTY&top=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.7a0q4c1ajc2e&fsb=1&dtd=113
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s81-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:03 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame C47A 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
200970
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 03 Aug 2022 06:51:34 GMT
expires
Thu, 03 Aug 2023 06:51:34 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
index.html
s0.2mdn.net/sadbundle/14586128274924466605/ Frame CFDB 		32 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/14586128274924466605/index.html
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2006 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b51534cb26157816c7e911f832c303cdcd6188f22e0a82267ffd2c2e242f84b0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
279501
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5315
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Tue, 02 Aug 2022 09:02:43 GMT
expires
Wed, 02 Aug 2023 09:02:43 GMT
last-modified
Tue, 19 Jul 2022 10:03:11 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
view
googleads4.g.doubleclick.net/pcs/ Frame 676C 		0
306 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvrrCS-BogN3yW5VOgBHXlHId8OcTpbIQ_dRZiikSCzx4gBcsLvbePlrBLV5q9P7l0zXMLBTVE679RL09vJFJxByThAK6cdE0nOMJhFmKhml1isq9-B5jE4YIwPEjQqPwCBseKQqjZGcR5TWCPRRetP7RqscJbpuiL8VwEjTjjsocTWBNZ90oElzO3OJHxlQMfxrU8iqZJbRSEQNocnyDZKFOgTTJJ_T6Hma1m4POxUX9Mj4Asjnwjal0CHRtdX5LHLHrKDNiZnMYchcFi9JkE1XADT_RDASmO6QWI1YIc0gNkCOXAdGSl9EUN8F3dMWmkTnRRKe8QPS9hkjSKN9-K1hKZEWTOG0AE2bH331xlPDCU0wKxuXZygtdCvToPxmFCveCJkDU0aObgGRRcQklfsS93nHQ39xqXPN7_sUPISTrpuekAaat7NaVjuYzCktQlMee61ynCTWh6fCUqnrV-6sizVlYacsaM2jXoNf-5hmuBe2A0GnfduTwmfysZm_It0EPglwg3i_GamQtFAcn1131F2a8V4i7vVGy1-n2jN5akro7Wqeiy2pucUjthxKSYnhhMusntUZ3akuVOLI3xj6xHvhEO-ryf06uFQ8DI4ltQKdcGJnAc-UoUybTGOCkAnRd0-2Z2O1-5W8Ea5W6_Hzwg54Qtx0DFFKGqinJx7b-bq3m4CSLl0Ozwicds6nkb3OIFeVtRt9KUFnsR-k7L71XnLzGKGvu8Aq_I0yLhKPoUeot2Ht9bxQvwiNqkMMaPGEfFbZ2rwclIW3BYXl2IDY4pyWJ7YbLVEZwdQKR0beUIyjn6dOs5Sr27bnmfY1R8z9wqHol5Lqr3l_-_YtZiPXb_FCVneGNyoAS2gxnetw3MEGdCiQuh2AgYmM6qbPsw99sDtSnq3y-DW2LSQYjPnDyu9HMKtbxw2fz2Gg4FBNLs3rhU1AzXnoT5MPMMEIzCWJ0FETy1ck0J84GgEhpzBlhuzazo29dROYdq4lFSOIiIMA96qSpLHShVK3mBA0_cK07SX1Lw84LZuWt4_hfhzkNVZmTPcVZZlG8nzjRhj2PLz2kDfzdhjvqRTHOLx6F4LRxWhpzVzx79AGNHwMV3UE4UwZZ7eFkQiD49iJc0kDxTU9vX6KLlbnIbUscNAJLm49AizQZCbsxtlFV8V-pmEGZ4PjPxe-j67AgHjcEN6X1OFSWEnHX0vEb0hMAb_HWqsyq1V6Oo_KEoi8UA9jSbJ8O2uFsUOEuvfNyDFv-Fht1M9-johU6gV4OvgI9Nc_Tq-zN7_mKNS03Qcnw&sai=AMfl-YQlyH_YNzOFkeeK_p_yvGhHzVluWaQtvWgL2_X7Hs0D9TjtE97vPac15JkA5CE_3xiqXAqfdrCY7R0yFLkeFZPmH_IF_KOK7G0zZwE8stTqfAWrinMkxw-Xao95B32ei8PYqzYDogEqaSWTRXY6AUiAVDC5qaLCoE16oso4w75YEGyrqBiD&sig=Cg0ArKJSzD_jWUN0CU2PEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=84&cbvp=1&cstd=81&cisv=r20220803.11628&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.40.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s81-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date
Fri, 05 Aug 2022 14:41:04 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
9b11a0f53646187328d49792af6ad5fc.js
s0.2mdn.net/sadbundle/14586128274924466605/ Frame CFDB 		82 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/14586128274924466605/9b11a0f53646187328d49792af6ad5fc.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14586128274924466605/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2006 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c01223e6eeba43391e1a50e0826166abf19fb19db960fc06264a8f45f119a08d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/14586128274924466605/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 09:02:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
279501
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21009
x-xss-protection
0
last-modified
Tue, 19 Jul 2022 10:03:11 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 02 Aug 2023 09:02:43 GMT
jjp8A9boDrBmSAr_yfbeEM1ThbAhpFVxRN30ZpHEy3Q.js
pagead2.googlesyndication.com/bg/ Frame C47A 		36 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/jjp8A9boDrBmSAr_yfbeEM1ThbAhpFVxRN30ZpHEy3Q.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8e3a7c03d6e80eb066480affc9f6de10cd5385b021a4557144ddf46691c4cb74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 04 Aug 2022 14:02:15 GMT
content-encoding
br
x-content-type-options
nosniff
age
88729
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14162
x-xss-protection
0
last-modified
Fri, 29 Jul 2022 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 04 Aug 2023 14:02:15 GMT
css
fonts.googleapis.com/ Frame CFDB 		4 KB
593 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:900|Roboto:500
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14586128274924466605/9b11a0f53646187328d49792af6ad5fc.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::200a New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1d352797c9473d7a0f0d88d182633330a8a7058a68cd6c052a8a2e2e6ffba4e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 05 Aug 2022 13:47:50 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Fri, 05 Aug 2022 14:41:04 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 05 Aug 2022 14:41:04 GMT
1cd7d98cb61a0018ad4ac009a547ec3e.jpg
s0.2mdn.net/sadbundle/14586128274924466605/media/ Frame CFDB 		158 KB
158 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/14586128274924466605/media/1cd7d98cb61a0018ad4ac009a547ec3e.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14586128274924466605/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2006 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dc0aae23650aa076289af5ffb6d6710cb055add251e06549908396b44fb4f621
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/14586128274924466605/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 09:02:44 GMT
x-content-type-options
nosniff
age
279500
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
162143
x-xss-protection
0
last-modified
Tue, 19 Jul 2022 10:03:11 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 02 Aug 2023 09:02:44 GMT
06f91b438b5c0d7fe6dff4bf6c24cf00.svg
s0.2mdn.net/sadbundle/14586128274924466605/media/ Frame CFDB 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/14586128274924466605/media/06f91b438b5c0d7fe6dff4bf6c24cf00.svg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14586128274924466605/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2006 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eb4a29554c161fc6298d26273c106770fbe6c66bff37bb0db2e7826a9f84cb4d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/14586128274924466605/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 09:02:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
279500
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1998
x-xss-protection
0
last-modified
Tue, 19 Jul 2022 10:03:11 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 02 Aug 2023 09:02:44 GMT
0e5e9213b55b1e8072a42d5c84e6ead4.png
s0.2mdn.net/sadbundle/14586128274924466605/media/ Frame CFDB 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/14586128274924466605/media/0e5e9213b55b1e8072a42d5c84e6ead4.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14586128274924466605/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2006 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a8a100b8fe7f638e675253612230bd56a79c2fb3d5112360c505e72adb6a41c6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/14586128274924466605/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 09:02:44 GMT
x-content-type-options
nosniff
age
279500
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3379
x-xss-protection
0
last-modified
Tue, 19 Jul 2022 10:03:11 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 02 Aug 2023 09:02:44 GMT
dd55cb2ea4fa655b1070abfc343afae5.png
s0.2mdn.net/sadbundle/14586128274924466605/media/ Frame CFDB 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/14586128274924466605/media/dd55cb2ea4fa655b1070abfc343afae5.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14586128274924466605/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2006 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
65e8cd6177664d41cf8ce26c9bc6c1cf1313f1e5c81a969446c5fc05b6540e06
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/14586128274924466605/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 09:02:44 GMT
x-content-type-options
nosniff
age
279500
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5655
x-xss-protection
0
last-modified
Tue, 19 Jul 2022 10:03:11 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 02 Aug 2023 09:02:44 GMT
2fdcaa0b642521bce975eb88c04cd87c.png
s0.2mdn.net/sadbundle/14586128274924466605/media/ Frame CFDB 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/14586128274924466605/media/2fdcaa0b642521bce975eb88c04cd87c.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14586128274924466605/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::2006 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
86cce5a3c4670c786318309ad0e741b426b903f4e7d3d100e3b261472f72b7ac
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/14586128274924466605/index.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 09:02:44 GMT
x-content-type-options
nosniff
age
279500
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8090
x-xss-protection
0
last-modified
Tue, 19 Jul 2022 10:03:11 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 02 Aug 2023 09:02:44 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 676C 		0
26 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvrrCS-BogN3yW5VOgBHXlHId8OcTpbIQ_dRZiikSCzx4gBcsLvbePlrBLV5q9P7l0zXMLBTVE679RL09vJFJxByThAK6cdE0nOMJhFmKhml1isq9-B5jE4YIwPEjQqPwCBseKQqjZGcR5TWCPRRetP7RqscJbpuiL8VwEjTjjsocTWBNZ90oElzO3OJHxlQMfxrU8iqZJbRSEQNocnyDZKFOgTTJJ_T6Hma1m4POxUX9Mj4Asjnwjal0CHRtdX5LHLHrKDNiZnMYchcFi9JkE1XADT_RDASmO6QWI1YIc0gNkCOXAdGSl9EUN8F3dMWmkTnRRKe8QPS9hkjSKN9-K1hKZEWTOG0AE2bH331xlPDCU0wKxuXZygtdCvToPxmFCveCJkDU0aObgGRRcQklfsS93nHQ39xqXPN7_sUPISTrpuekAaat7NaVjuYzCktQlMee61ynCTWh6fCUqnrV-6sizVlYacsaM2jXoNf-5hmuBe2A0GnfduTwmfysZm_It0EPglwg3i_GamQtFAcn1131F2a8V4i7vVGy1-n2jN5akro7Wqeiy2pucUjthxKSYnhhMusntUZ3akuVOLI3xj6xHvhEO-ryf06uFQ8DI4ltQKdcGJnAc-UoUybTGOCkAnRd0-2Z2O1-5W8Ea5W6_Hzwg54Qtx0DFFKGqinJx7b-bq3m4CSLl0Ozwicds6nkb3OIFeVtRt9KUFnsR-k7L71XnLzGKGvu8Aq_I0yLhKPoUeot2Ht9bxQvwiNqkMMaPGEfFbZ2rwclIW3BYXl2IDY4pyWJ7YbLVEZwdQKR0beUIyjn6dOs5Sr27bnmfY1R8z9wqHol5Lqr3l_-_YtZiPXb_FCVneGNyoAS2gxnetw3MEGdCiQuh2AgYmM6qbPsw99sDtSnq3y-DW2LSQYjPnDyu9HMKtbxw2fz2Gg4FBNLs3rhU1AzXnoT5MPMMEIzCWJ0FETy1ck0J84GgEhpzBlhuzazo29dROYdq4lFSOIiIMA96qSpLHShVK3mBA0_cK07SX1Lw84LZuWt4_hfhzkNVZmTPcVZZlG8nzjRhj2PLz2kDfzdhjvqRTHOLx6F4LRxWhpzVzx79AGNHwMV3UE4UwZZ7eFkQiD49iJc0kDxTU9vX6KLlbnIbUscNAJLm49AizQZCbsxtlFV8V-pmEGZ4PjPxe-j67AgHjcEN6X1OFSWEnHX0vEb0hMAb_HWqsyq1V6Oo_KEoi8UA9jSbJ8O2uFsUOEuvfNyDFv-Fht1M9-johU6gV4OvgI9Nc_Tq-zN7_mKNS03Qcnw&sai=AMfl-YQlyH_YNzOFkeeK_p_yvGhHzVluWaQtvWgL2_X7Hs0D9TjtE97vPac15JkA5CE_3xiqXAqfdrCY7R0yFLkeFZPmH_IF_KOK7G0zZwE8stTqfAWrinMkxw-Xao95B32ei8PYqzYDogEqaSWTRXY6AUiAVDC5qaLCoE16oso4w75YEGyrqBiD&sig=Cg0ArKJSzD_jWUN0CU2PEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=291&vt=11&dtpt=207&dett=3&cstd=81&cisv=r20220803.11628&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s81-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:04 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame CFDB 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmYUtfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:500
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2003 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://s0.2mdn.net
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Wed, 03 Aug 2022 19:32:22 GMT
x-content-type-options
nosniff
age
155322
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15752
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 03 Aug 2023 19:32:22 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame CFDB 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:900|Roboto:500
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2003 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://s0.2mdn.net
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Wed, 03 Aug 2022 19:32:09 GMT
x-content-type-options
nosniff
age
155335
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15920
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 03 Aug 2023 19:32:09 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame E1B0 		14 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220803&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208030101/show_ads_impl_fy2021.js?bust=31068808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c697819e479ff298cad5834f13e71d3d543f6826537287c54958a7a8c37c5886
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10727
x-xss-protection
0
gen_204
pagead2.googlesyndication.com/pagead/ Frame C47A 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B5D8e_yvtYtKFM4_Xogb947OQCwAAAAA4AeAEAg&bg=!hIelh8PNAAZGjrx1Zo47ACkAdvg8WhX93bAJ2JprA3VJr8vseAD4tE75V2Zr-cW05ikaDiuxN7WRzAIAAACXUgAAAAJoAQeZAyDHXeotJOn5R2ziNOJTFR0UFVfnzL-PFLmcOQ5ex83hfFltrG3nMD4Gx2F-ESmHfve7vhPWLzLDAro0hpRGGB6xfZX5jZLxSsXqJg0XC4ENZ5CJsUndndgQ533jBD7GOlWm1VIOB8R3raQrvzDfrw5opqFoel4ETNsYolOVcqXq67WOE9KeV9WJ3F_uFGuJroFjsVmf7nsOccyKbkeNaIKxxnt434B08kL2n1rkeT9Qnz6Swg-g6KBG-BFAlCCqqFm7ipFQLbg5RU7me6e0Tnh8pipTxteOthxA-lfYKyrqWZVgjyeBp53_n9H0BwSyJyIVS1UxnxFBD34Hcx4PVe60z_VA9nSfTNiYVcvPKs3Mcc_MgLfcAUwwmELzk_Pn8IiwaJqlKJvTHpUVUpkONb_XHM8sei5zmZLUPbrr37tBRAgCG7rEX4sWJ9tJ7ptiQCzWDAStq6x1mA4p7eSoqild0TqIelICscbidFaQkz6xP-64DOfEBHus47-8jsGSaShb2_L1GomnqvJtxiC39H4FlOPx0ll9yE4VOFUx0MFKMLCPFxyhHsgepah8VuQEFGPrZDQ0DCoHDFa5sPxu0LDoSbJjAuNJNpHvn8d-g4Ok6J695NPNGPcUT-cP36Z8xvhLfO2_PHwDjXLDbFe6qi66XUBiHAtdFdeaXkV8QJqhXq7N0ECm2SdEFVfKt0ew7dJSt_VwNJV-6_U7aVGEyesn0EOfabycMn0kV0Gbz_7TykFwWm5jwt1zAcNgD4tZJkm_w5kXGUFh3rKB8ApEbx_TWCUs7x96DXssqUjCpaHJKQ9NBa7RWjQ1o6Q61ictp0UtAZ1Kf8_tkAmbbmZl8VhXZY4K0I1jbaDXrBWGzhWLf46kxmx6_5ThPBYTf_GOlwiix0HXkQWzHKGXzIDDZsG88_yti22oh0XRtZt0nlyU0zQUzX981Q1ERs3TVCLdk1aPngLgeHfYkgZCL03fxhsOArX2S5hjrvQashjNgZRU5QHbGV4nskPr5px3hvW6RjtAFuDYGTYDTBo9E6u53hmgX9iR2BFtFeDzOyXTYTwEsg
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame E1B0 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202208030101/show_ads_impl_fy2021.js?bust=31068808
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Fri, 05 Aug 2022 14:41:04 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 2B12 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
24685
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Fri, 05 Aug 2022 07:49:39 GMT
expires
Sat, 05 Aug 2023 07:49:39 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 3922 		783 B
539 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2004 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
bd8c49a688ffb9c7a2bee814769e58a5e2c0e3e1710c58571f51b092d5eacc35
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-WHPRQI4XVGs99Ujkw2FB4Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=300
content-encoding
gzip
content-length
517
content-security-policy
script-src 'report-sample' 'nonce-WHPRQI4XVGs99Ujkw2FB4Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Fri, 05 Aug 2022 14:41:04 GMT
expires
Fri, 05 Aug 2022 14:41:04 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
jjp8A9boDrBmSAr_yfbeEM1ThbAhpFVxRN30ZpHEy3Q.js
pagead2.googlesyndication.com/bg/ Frame 2B12 		36 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/jjp8A9boDrBmSAr_yfbeEM1ThbAhpFVxRN30ZpHEy3Q.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8e3a7c03d6e80eb066480affc9f6de10cd5385b021a4557144ddf46691c4cb74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Thu, 04 Aug 2022 14:02:15 GMT
content-encoding
br
x-content-type-options
nosniff
age
88729
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14162
x-xss-protection
0
last-modified
Fri, 29 Jul 2022 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 04 Aug 2023 14:02:15 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame 3922 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220803&jk=1646630767893534&rc=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers
generate_204
tpc.googlesyndication.com/ Frame 2B12 		0
9 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?3HaH7Q
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:817::2001 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
json
gum.criteo.com/sid/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2F&domain=www.bleepingcomputer.com&cw=1&pbt=1&lsw=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Fri, 05 Aug 2022 14:41:03 GMT
expires
0
pragma
no-cache
server-processing-duration-in-ticks
1778
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
sid
mug.criteo.com/
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fwww.bleepingcomputer.com%2F&domain=www.bleepingcomputer.com&cw=1&pbt=1&lsw=1
  • https://mug.criteo.com/sid?cpp=jcH9Z3xFaXcycHYrOUhwNGk5M3oremRmdEtackdXMVFkSFN6V2FVY3BnaXhqckMwQ2xRN1lJMkMxbWJiSFJ0dVo2b0V3RVJiakZ2cTJBcDAwVXhBV2lKTHhld2k2QmIva2ZYMEZRRHhldHlmMGZOemVZK1pPcEF5Ymswd0...
460 B
697 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=jcH9Z3xFaXcycHYrOUhwNGk5M3oremRmdEtackdXMVFkSFN6V2FVY3BnaXhqckMwQ2xRN1lJMkMxbWJiSFJ0dVo2b0V3RVJiakZ2cTJBcDAwVXhBV2lKTHhld2k2QmIva2ZYMEZRRHhldHlmMGZOemVZK1pPcEF5Ymswd0pBQklHUDJ0cFdmMlZ5ZUU4RytYdWtEQ3h4OUkxTWtJVHZWT1JNNlI2djJGZEZIVEJaTzNrY3ZJalc3YzB5NkR1cDdkNkx1SDRLTU5FUzNsZkRvMWYwY25qa0d4QjBacDkxbTBkdDQrT2J6YkJSWkxoNjUwR3B1SThGZWlmRnJIcTlSZXhnWEwvNjBZRXJxbUs3VjQ4OUdzMFJIZkc2blI4TUdxc1FHSW1LdGtwQTB0UUpRMD18&cppv=2
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
/
Resource Hash
eafabf8ad63add70d4a78cc87f44f00d7fc515d5f66a7ea8fa6040416092b7b7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
content-encoding
gzip
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
3977
strict-transport-security
max-age=31536000; preload;
expires
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
location
https://mug.criteo.com/sid?cpp=jcH9Z3xFaXcycHYrOUhwNGk5M3oremRmdEtackdXMVFkSFN6V2FVY3BnaXhqckMwQ2xRN1lJMkMxbWJiSFJ0dVo2b0V3RVJiakZ2cTJBcDAwVXhBV2lKTHhld2k2QmIva2ZYMEZRRHhldHlmMGZOemVZK1pPcEF5Ymswd0pBQklHUDJ0cFdmMlZ5ZUU4RytYdWtEQ3h4OUkxTWtJVHZWT1JNNlI2djJGZEZIVEJaTzNrY3ZJalc3YzB5NkR1cDdkNkx1SDRLTU5FUzNsZkRvMWYwY25qa0d4QjBacDkxbTBkdDQrT2J6YkJSWkxoNjUwR3B1SThGZWlmRnJIcTlSZXhnWEwvNjBZRXJxbUs3VjQ4OUdzMFJIZkc2blI4TUdxc1FHSW1LdGtwQTB0UUpRMD18&cppv=2
strict-transport-security
max-age=31536000; preload;
access-control-allow-methods
GET
content-type
text/html; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1600
content-length
567
expires
0
id
id.crwdcntrl.net/ 		0
0
rid
match.adsrvr.org/track/ 		108 B
689 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
c5ed3845c583e493c2325f69b4f77fdfbfcef499e85bf3e2568152f94a85c3b9

Request headers

Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
x-aspnet-version
4.0.30319
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.bleepingcomputer.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
108
expires
Sun, 04 Sep 2022 14:41:04 GMT
envelope
api.rlcdn.com/api/identity/ 		0
0
/
de.tynt.com/deb/ Frame 18C9
Redirect Chain
  • https://ssc-cms.33across.com/ps/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
  • https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.31 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip31.67-202-105.static.steadfastdns.net
Software
/
Resource Hash
db89d7ba6f8614450b7f3e031e5993d7a1b67eb4fe69d828169af47d1d8f3f38

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length
1931
content-type
text/html
date
Fri, 05 Aug 2022 14:41:04 GMT
expires
Sat, 26 Jul 1997 05:00:00 GMT
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy
unsafe-url

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-length
0
date
Fri, 05 Aug 2022 14:41:03 GMT
expires
Thu, 01-Jan-70 00:00:01 GMT
location
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
pragma
no-cache
referrer-policy
unsafe-url
server
33XP001
x-33x-status
8340000A
pd
us-u.openx.net/w/1.0/ Frame 1DAB 		1 KB
623 B 		Document
General
Check archive.org
Download Go to
Full URL
https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
d7487dfbd9e3fb543f7cc23691fb51abf7a650da4c8e35e58794f259c7c2c968

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
604
content-type
text/html
date
Fri, 05 Aug 2022 14:41:04 GMT
p3p
CP="CUR ADM OUR NOR STA NID"
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
via
1.1 google
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 7596 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.29.128.213 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-29-128-213.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=51054
content-encoding
gzip
content-length
5549
content-type
text/html; charset=UTF-8
date
Fri, 05 Aug 2022 14:41:04 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
expires
Sat, 06 Aug 2022 04:51:58 GMT
last-modified
Tue, 01 Feb 2022 06:38:00 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
sync
eb2.3lift.com/ Frame 4891 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://eb2.3lift.com/sync?
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
a8ce99d3ee0eaaa09a25f8a1a605e5f8b261b8d3fb0ce253471cea9078db1572

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-length
456
content-type
text/html; charset=utf-8
date
Fri, 05 Aug 2022 14:41:04 GMT
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 3B52 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156696
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.29.128.213 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-29-128-213.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=51054
content-encoding
gzip
content-length
5549
content-type
text/html; charset=UTF-8
date
Fri, 05 Aug 2022 14:41:04 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
expires
Sat, 06 Aug 2022 04:51:58 GMT
last-modified
Tue, 01 Feb 2022 06:38:00 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
checksync.php
contextual.media.net/ Frame B25D 		36 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.41.168.23 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-41-168-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c005a7590a3e928eecba2e971960bce8ad11d75cac66b90a93820b5f2c6809b8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
max-age=112477
content-encoding
gzip
content-length
12140
content-type
text/html; charset=UTF-8
date
Fri, 05 Aug 2022 14:41:04 GMT
expires
Sat, 06 Aug 2022 21:55:41 GMT
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
server
Apache
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-mnet-hl2
E
ixmatch.html
js-sec.indexww.com/um/ Frame A59C 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.29.129.7 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-29-129-7.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
1387
Content-Type
text/html; charset=UTF-8
Date
Fri, 05 Aug 2022 14:41:04 GMT
ETag
"e20015-b68-5e4a60c97afb7"
Last-Modified
Mon, 25 Jul 2022 19:18:30 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Server
Apache
Vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 3940 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
35990
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Fri, 05 Aug 2022 14:41:04 GMT
ETag
W/"623de86a-cf34"
Expires
Wed, 03 Aug 2022 04:41:10 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
2, 99619
X-Served-By
cache-lga21969-LGA, cache-yul12822-YUL
X-Timer
S1659710465.828144,VS0,VE0
usync.html
eus.rubiconproject.com/ Frame A078 		281 B
573 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/prebid-analytics-6.19.13.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-1-200-83.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://www.bleepingcomputer.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Fri, 05 Aug 2022 14:41:04 GMT
ETag
"402b2-119-5d32342a551c0"
Last-Modified
Tue, 14 Dec 2021 23:07:59 GMT
Server
Apache/2.2.15 (CentOS)
Unused62
8096267
Vary
Accept-Encoding
sync
x.bidswitch.net/
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=themediagrid
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=themediagrid
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=1797288115146808421&expires=30&ssp=themediagrid
43 B
235 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/sync?dsp_id=119&user_id=1797288115146808421&expires=30&ssp=themediagrid
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
HTTP/1.1
Server
35.211.178.172 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS
172.178.211.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Fri, 05 Aug 2022 14:41:05 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://x.bidswitch.net/sync?dsp_id=119&user_id=1797288115146808421&expires=30&ssp=themediagrid
Date
Fri, 05 Aug 2022 14:41:05 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
52C108B0-611A-4584-A232-D339F84A7A29
pr-bh.ybp.yahoo.com/sync/pubmatic/
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=156557&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156557%26pr%3Dhttps%253A%252F%252Fmatch.sharethrough.com%252F...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJFHW0DnIkRIkugAM465Eh4&google_cver=1
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://pr-bh.ybp.yahoo.com/sync/pubmatic/52C108B0-611A-4584-A232-D339F84A7A29?gdpr=0&gdpr_consent=
43 B
984 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/pubmatic/52C108B0-611A-4584-A232-D339F84A7A29?gdpr=0&gdpr_consent=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Server
2600:1f13:d60:4f01:bbc5:ac74:cf42:940a Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
2
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff

Redirect headers

location
https://pr-bh.ybp.yahoo.com/sync/pubmatic/52C108B0-611A-4584-A232-D339F84A7A29?gdpr=0&gdpr_consent=
date
Fri, 05 Aug 2022 14:41:03 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
126
content-type
text/html; charset=utf-8
ecm3
s.amazon-adsystem.com/ 		43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=1cc8f12c-ff67-49af-b90c-db7e6770443c
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:04 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
JSDBR1Q32EFB2XW8NTXG
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
v1
match.sharethrough.com/sync/
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=sharethrough&user_id=1cc8f12c-ff67-49af-b90c-db7e6770443c&gdpr=0&gdpr_consent=&gdpr_pd=1&usprivacy=
  • https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=cf57a75d-4f5e-49b9-b35a-536b2987624c&ssp=sharethrough&gdpr=0&gdpr_consent=
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2910&partner_device_id=10596055133603141835&gdpr=0&gdpr_consent=&partner_url=https%3A%2F%2Fodr.mookie1.com%2Ft%2Fv2%3Ftagid%3DV2_948118%26src.vi...
  • https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=922f411c-87a1-4cd3-9a9c-aaee6eaa8133&ssp=sharethrough&gdpr_consent=&gdpr=0
  • https://aa.agkn.com/adscores/g.pixel?sid=9212302828&puid=10596055133603141835&ssp=sharethrough&gdpr=0&gdpr_consent=
  • https://odr.mookie1.com/t/v2?tagid=V2_785409&src.visitorId=213110604234007076984&ssp=sharethrough&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/sync?dsp_id=419&user_id=10596055133603141835&ssp=sharethrough&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=bf2b131f1f7eff9d8892972c&source_user_id=cf57a75d-4f5e-49b9-b35a-536b2987624c&seat_user_id=&seat_key=&gdpr=0&gdpr_consent=&gdpr_pd=&usprivacy=
0
34 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=bf2b131f1f7eff9d8892972c&source_user_id=cf57a75d-4f5e-49b9-b35a-536b2987624c&seat_user_id=&seat_key=&gdpr=0&gdpr_consent=&gdpr_pd=&usprivacy=
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H2
Server
3.66.208.67 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-66-208-67.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.bleepingcomputer.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

Location
//match.sharethrough.com/sync/v1?source_id=bf2b131f1f7eff9d8892972c&source_user_id=cf57a75d-4f5e-49b9-b35a-536b2987624c&seat_user_id=&seat_key=&gdpr=0&gdpr_consent=&gdpr_pd=&usprivacy=
Date
Fri, 05 Aug 2022 14:41:05 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
PugMaster
image6.pubmatic.com/AdServer/ Frame 7596 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=5877863&p=156961&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
2bc3adfe623c9caac41c12e0f43d04be7388404647669c823041250b6ab5f81c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:03 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
1623
content-type
text/html; charset=UTF-8
xuid
eb2.3lift.com/ Frame 4891
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=3658&xuid=5e1b1e00-4929-4a58-9799-282bf9b88b13&dongle=0cfd
37 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=3658&xuid=5e1b1e00-4929-4a58-9799-282bf9b88b13&dongle=0cfd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://eb2.3lift.com/xuid?mid=3658&xuid=5e1b1e00-4929-4a58-9799-282bf9b88b13&dongle=0cfd
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
209
ebda
eb2.3lift.com/ Frame 4891
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDUyNjI0OTg1MTIzMTMzMjk2OTY3NA%3D%3D
  • https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
37 B
139 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
248
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
xuid
eb2.3lift.com/ Frame 4891
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELokJl2lTRApBMfDiwk995E&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
37 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELokJl2lTRApBMfDiwk995E&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESELokJl2lTRApBMfDiwk995E&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
332
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 4891
Redirect Chain
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDUyNjI0OTg1MTIzMTMzMjk2OTY3NA%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDUyNjI0OTg1MTIzMTMzMjk2OTY3NA%3D%3D
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H3
Server
142.251.40.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s81-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDUyNjI0OTg1MTIzMTMzMjk2OTY3NA%3D%3D
date
Fri, 05 Aug 2022 14:41:04 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
/
p.adsymptotic.com/d/px/ Frame 4891
Redirect Chain
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=4526249851231332969674&dbredirect=true&gdpr=0&consent=
  • https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=4526249851231332969674&dbredirect=true&gdpr=0&consent=&cookiesTest=true
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=acd100cd-9f14-4234-ad6e-0c82957994d0&_noobservation=1
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=acd100cd-9f14-4234-ad6e-0c82957994d0&_noobservation=1&_expected_cookie=f4afa80...
43 B
142 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=acd100cd-9f14-4234-ad6e-0c82957994d0&_noobservation=1&_expected_cookie=f4afa80c45c1ed9c138786b2ab937a45
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
104.18.101.194 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
73604aa78edc5407-YYZ
p3p
CP='NON DSP COR CONi OUR BUS CNT'
content-type
image/gif
content-length
43

Redirect headers

location
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=acd100cd-9f14-4234-ad6e-0c82957994d0&_noobservation=1&_expected_cookie=f4afa80c45c1ed9c138786b2ab937a45
date
Fri, 05 Aug 2022 14:41:05 GMT
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
73604aa72e575407-YYZ
content-length
0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
xuid
eb2.3lift.com/ Frame 4891
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=triplelift&user_id=4526249851231332969674&gdpr=0&gdpr_consent=
  • https://m.fg8dgt.com/sync?ssp=bidswitch&bidswitch_ssp_id=triplelift&ssp_uuid=cf57a75d-4f5e-49b9-b35a-536b2987624c
  • https://m.fg8dgt.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=triplelift&ssp_uuid=cf57a75d-4f5e-49b9-b35a-536b2987624c
  • https://x.bidswitch.net/sync?dsp_id=108&expires=14&ssp=triplelift&user_id=746fa3a7-1e1f-4377-a42d-1e8b819f2547
  • https://eb2.3lift.com/xuid?mid=2409&xuid=cf57a75d-4f5e-49b9-b35a-536b2987624c&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
37 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2409&xuid=cf57a75d-4f5e-49b9-b35a-536b2987624c&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Location
//eb2.3lift.com/xuid?mid=2409&xuid=cf57a75d-4f5e-49b9-b35a-536b2987624c&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Date
Fri, 05 Aug 2022 14:41:05 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
c.gif
c.bing.com/ Frame 4891 		42 B
669 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.bing.com/c.gif?xid=4526249851231332969674&Red3=TLMS_pd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
etag
"b69c7980c2a2d81:0"
last-modified
Thu, 28 Jul 2022 20:42:07 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 7CF3E5350DA44D53809A573D678B41CC Ref B: YTO30EDGE0308 Ref C: 2022-08-05T14:41:04Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42
xuid
eb2.3lift.com/ Frame 4891
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/4526249851231332969674?gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-OKIEeTRE2oTybGZDEg5GxI06owRkWL9enHmArKmn3w--~A&dongle=0883
37 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2662&xuid=y-OKIEeTRE2oTybGZDEg5GxI06owRkWL9enHmArKmn3w--~A&dongle=0883
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date
Fri, 05 Aug 2022 14:41:04 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://eb2.3lift.com/xuid?mid=2662&xuid=y-OKIEeTRE2oTybGZDEg5GxI06owRkWL9enHmArKmn3w--~A&dongle=0883
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
757c0557066e95cfd4c7
s.amazon-adsystem.com/x/ Frame 4891 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=0&gdpr_consent=&uid=4526249851231332969674
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers
xuid
eb2.3lift.com/ Frame 4891
Redirect Chain
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent=
  • https://stags.bluekai.com/site/23178?id=jTKicE_GJ9EQ0uhYWhcr&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLE...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZLCGIXDG3DJMZ2C4Y3PNUXXQ5LJMQ7WI33OM5WGKPLEMJQTQJTFPBRWQYLOM5ST25DSNFYGYZLMNFTHIJTHMRYHEPJQEZWWSZB5GI2DMMBGPB2WSZB5NJKEW2LDIVPUO...
  • https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=jTKicE_GJ9EQ0uhYWhcr
37 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=jTKicE_GJ9EQ0uhYWhcr
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:05 GMT
P3p
CP="We do not support P3P header."
Location
https://eb2.3lift.com/xuid?dongle=dba8&gdpr=0&mid=2460&xuid=jTKicE_GJ9EQ0uhYWhcr
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
115
Expires
Thu, 01 Dec 1994 16:00:00 GMT
usermatch
ssum-sec.casalemedia.com/ Frame E619 		1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bleepingcomputer.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6ff0c935db4bafb846e7301df9b53f97f1d434a67a84dd9587633e9359d01b3a

Request headers

Referer
https://js-sec.indexww.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
73604aa5ca9ea1ff-YYZ
content-encoding
br
content-type
text/html
date
Fri, 05 Aug 2022 14:41:04 GMT
dropped-udsids
130|65|111|81|123|206|64|131
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
0
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vMyTwYSAg4sfngFyDKorqhfhG7JzEZAYPpr8m7AeGN00U1XRDVkN8dp%2BmPGZbcd8oTgJB8%2FpkzGdGJOdkG0qE6Usb5zyaNnU2iy38YtRqDe8Lp6jykomDTVUX%2FrRlau8gORV8FRbmJIhHA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Is-Traffic-Usersync, Accept-Encoding
dds
rtb.openx.net/sync/ Frame 1DAB
Redirect Chain
  • https://rtb.openx.net/sync/dds
  • https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=hKJVV1G9wkY0lZ6HGO9Dgw==&ox_sc=1&ox_init=1
  • https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
43 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
211.253.186.35.bc.googleusercontent.com
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-request-id
sq0elc31vp3q4gt1da25a46hp7mrd9tf

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
249
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 1DAB
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://us-u.openx.net/w/1.0/sd?id=536872786&val=3d9b62ed-2bff-4400-97d4-14b35df0617d
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=536872786&val=3d9b62ed-2bff-4400-97d4-14b35df0617d
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Fri, 05 Aug 2022 14:41:04 GMT
Server
MT3 4475 c1dc35a master ord-pixel-x50 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://us-u.openx.net/w/1.0/sd?id=536872786&val=3d9b62ed-2bff-4400-97d4-14b35df0617d
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Fri, 05 Aug 2022 14:41:03 GMT
sd
us-u.openx.net/w/1.0/ Frame 1DAB
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
  • https://us-u.openx.net/w/1.0/sd?id=537073028&val=52c14264-5a43-426b-bee4-a3fcf6f47bcd
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073028&val=52c14264-5a43-426b-bee4-a3fcf6f47bcd
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
https://us-u.openx.net/w/1.0/sd?id=537073028&val=52c14264-5a43-426b-bee4-a3fcf6f47bcd
Date
Fri, 05 Aug 2022 14:41:04 GMT
X-CI-RTID
b569c18c-1987-45b9-9b7d-85e2955e1f19
Connection
keep-alive
Content-Length
112
Content-Type
text/html; charset=utf-8
sd
us-u.openx.net/w/1.0/ Frame 1DAB
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072977&val=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&gdpr=0&gdpr_consent=
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072977&val=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&gdpr=0&gdpr_consent=
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://us-u.openx.net/w/1.0/sd?id=537072977&val=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
receive
pixel.tapad.com/idsync/ex/ Frame 1DAB 		95 B
113 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=5d8aac97-a33c-46ef-9800-4ae6f87ab835
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
107.178.246.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
49.246.178.107.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
via
1.1 google
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95
strict-transport-security
max-age=31536000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
sync
ups.analytics.yahoo.com/ups/58294/ Frame 1DAB 		0
328 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=75305ce2-2051-4121-81c6-133a5c558d50
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
52.45.33.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-33-138.compute-1.amazonaws.com
Software
ATS/9.1.0.46 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
server
ATS/9.1.0.46
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
458249.gif
idsync.rlcdn.com/ Frame 1DAB
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D
  • https://id.rlcdn.com/464246.gif?partner_uid=0e32a00d-357c-4d08-8d98-52c3f26d18e1
  • https://pippio.com/api/sync?pid=5324&it=1&iv=efd7dac1fb47182e4e5df67f4ab694c6ec5c4bb52befa568d585b2a064f21d53791426b5417dce21&_=2
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBlZmQ3ZGFjMWZiNDcxODJlNGU1ZGY2N2Y0YWI2OTRjNmVjNWM0YmI1MmJlZmE1NjhkNTg1YjJhMDY0ZjIxZDUzNzkxNDI2YjU...
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBlZmQ3ZGFjMWZiNDcxODJlNGU1ZGY2N2Y0YWI2OTRjNmVjNWM0YmI1MmJlZmE1NjhkNTg1YjJhMDY0ZjIxZDUzNzkxNDI2YjU0MTdkY2UyMRAAGgwIgdi0lwYSBAgCEABCAEoA&goog...
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
  • https://idsync.rlcdn.com/458249.gif?partner_uid=04452166-234d-4562-b3c0-e0a51d5b50f5
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/458249.gif?partner_uid=04452166-234d-4562-b3c0-e0a51d5b50f5
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

location
https://idsync.rlcdn.com/458249.gif?partner_uid=04452166-234d-4562-b3c0-e0a51d5b50f5
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
x-samesite
secure
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
111
content-type
text/html; charset=utf-8
sd
us-u.openx.net/w/1.0/ Frame 1DAB
Redirect Chain
  • https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
  • https://us-u.openx.net/w/1.0/sd?id=537072399&val=2739567155738641687
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072399&val=2739567155738641687
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:05 GMT
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid
6caeb311-b144-4fd9-b84b-d9c9d2a5510d
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://us-u.openx.net/w/1.0/sd?id=537072399&val=2739567155738641687
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame 1DAB 		43 B
932 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=0322a316-e491-c092-12ef-50a7a3c5b2d9
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:04 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
3AB9SG0D5174CRZDK7Y4
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 1DAB
Redirect Chain
  • https://ad.turn.com/r/cs?pid=9&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=3305665001870070297&gdpr=0&gdpr_consent=&us_privacy=
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3305665001870070297&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/pd?plm=10&ph=89b2e804-9392-4144-aae0-0555f3960da4&gdpr=0
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3305665001870070297&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:03 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
usync.js
eus.rubiconproject.com/ Frame A078 		31 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-1-200-83.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
37e4253e392190e641fe31178e0da5ff17fa01824f5869a35e173ee52be4a5ec

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Fri, 05 Aug 2022 14:41:04 GMT
Content-Encoding
gzip
Last-Modified
Tue, 12 Jul 2022 20:44:25 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=14199
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9452
Expires
Fri, 05 Aug 2022 18:37:43 GMT
sid
mug.criteo.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=jcH9Z3xFaXcycHYrOUhwNGk5M3oremRmdEtackdXMVFkSFN6V2FVY3BnaXhqckMwQ2xRN1lJMkMxbWJiSFJ0dVo2b0V3RVJiakZ2cTJBcDAwVXhBV2lKTHhld2k2QmIva2ZYMEZRRHhldHlmMGZOemVZK1pPcEF5Ymswd0pBQklHUDJ0cFdmMlZ5ZUU4RytYdWtEQ3h4OUkxTWtJVHZWT1JNNlI2djJGZEZIVEJaTzNrY3ZJalc3YzB5NkR1cDdkNkx1SDRLTU5FUzNsZkRvMWYwY25qa0d4QjBacDkxbTBkdDQrT2J6YkJSWkxoNjUwR3B1SThGZWlmRnJIcTlSZXhnWEwvNjBZRXJxbUs3VjQ4OUdzMFJIZkc2blI4TUdxc1FHSW1LdGtwQTB0UUpRMD18&cppv=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
null
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Fri, 05 Aug 2022 14:41:04 GMT
expires
0
pragma
no-cache
server-processing-duration-in-ticks
1622
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
cm
us-u.openx.net/w/1.0/ Frame C9EE
Redirect Chain
  • https://ssc-cms.33across.com/ps/?us_privacy=&ts=1659710464819.3&ri=70&ru=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fcm%3Fid%3Dc6a5ba0d-ce02-41bd-a1ea-842c68bd5108%26ph%3D8f5ed5d4-642c-4222-968a-d709c...
  • https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D...
1 KB
614 B 		Document
General
Check archive.org
Download Go to
Full URL
https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
56fdff270381c058502252316f4b8b4a5f0bfa2acedf8f60523a11b4bb836da7

Request headers

Referer
about:blank
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
595
content-type
text/html
date
Fri, 05 Aug 2022 14:41:04 GMT
p3p
CP="CUR ADM OUR NOR STA NID"
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
via
1.1 google

Redirect headers

cache-control
no-store, no-cache, must-revalidate
content-length
0
date
Fri, 05 Aug 2022 14:41:03 GMT
expires
Thu, 01-Jan-70 00:00:01 GMT
location
https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
pragma
no-cache
referrer-policy
unsafe-url
server
33XP001
x-33x-status
40000000008200000A
match
events-ssc.33across.com/ Frame 18C9
Redirect Chain
  • https://ssc-cms.33across.com/ps/?us_privacy=&ts=1659710464819.1&ri=2&ru=https%3A%2F%2Fssum-sec.casalemedia.com%2Fusermatchredir%3Fs%3D191740%26us_privacy%3D%24%7BUS_PRIVACY%7D%26cb%3Dhttps%253A%252...
  • https://ssum-sec.casalemedia.com/usermatchredir?s=191740&us_privacy=&cb=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D2%26external_user_id%3D
  • https://events-ssc.33across.com/match?liv=g&us_privacy=&bidder_id=2&external_user_id=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140
68 B
82 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://events-ssc.33across.com/match?liv=g&us_privacy=&bidder_id=2&external_user_id=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Protocol
H3
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hY4%2BGN0nOJOfAZQdVkstnwZN%2BG4NnSPLUmHHcvRwW273TIXATACt%2F5OzUtJqf5UbxT08SVLQwB%2Bhovcajz3TGdO0Ww5FiK3D6tcGP2yXen3cGi3x0%2FmznwN5MgxQYRt%2FmxXp7vJKPnjGGg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location
https://events-ssc.33across.com/match?liv=g&us_privacy=&bidder_id=2&external_user_id=Yu0r-GZu4dfEMT1ZXkpk7AAA%26140
cache-control
no-cache
cf-ray
73604aa5fac2a1ff-YYZ
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
expires
0
match
events-ssc.33across.com/ Frame 18C9
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=104&us_privacy=&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D%26xi%3D45%26xu%3D%7BuserId%7D
  • https://tags.bluekai.com/site/17724?id=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D%26xi%3D45%26xu%3D677e4d26-958e-4cc1-b03f-f...
  • https://ssc-cms.33across.com/ps/?us_privacy=&xi=45&xu=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341
  • https://events-ssc.33across.com/match?bidder_id=45&external_user_id=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&ts=1659710465&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
68 B
82 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://events-ssc.33across.com/match?bidder_id=45&external_user_id=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&ts=1659710465&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Protocol
H3
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
referrer-policy
unsafe-url
server
33XP001
x-33x-status
8000000008200000A
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://events-ssc.33across.com/match?bidder_id=45&external_user_id=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&ts=1659710465&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
match
events-ssc.33across.com/ Frame 18C9
Redirect Chain
  • https://ssc-cms.33across.com/ps/?us_privacy=&ts=1659710464819.4&ri=90&ru=https%3A%2F%2Fib.adnxs.com%2Fgetuid%3Fhttps%253A%252F%252Fevents-ssc.33across.com%252Fmatch%253Fliv%253Dg%2526us_privacy%253...
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D90%26external_user_id%3D%24UID
  • https://events-ssc.33across.com/match?liv=g&us_privacy=&bidder_id=90&external_user_id=2739567155738641687
68 B
82 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://events-ssc.33across.com/match?liv=g&us_privacy=&bidder_id=90&external_user_id=2739567155738641687
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Protocol
H3
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
via
1.1 google
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
68
content-type
image/png

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:04 GMT
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid
4ab39e55-a810-4b07-8b8f-256c457cc681
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://events-ssc.33across.com/match?liv=g&us_privacy=&bidder_id=90&external_user_id=2739567155738641687
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
149
match.deepintent.com/usersync/ Frame 18C9 		0
222 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.deepintent.com/usersync/149?us_privacy=
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
g.deepintent.com
Software
b /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
server
b
content-type
image/gif
content-length
0
p3p
policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
match
events-ssc.33across.com/ Frame 18C9
Redirect Chain
  • https://bttrack.com/pixel/cookiesync?source=2c3b95b9-6513-42b2-beb7-260851c73b75&secure=1&us_privacy=&cb=1659710464819.6
  • https://ssc-cms.33across.com/ps/?xi=66&us_privacy=&xu=060b4244-ee38-489d-b7ed-1a0a44b9f67a
  • https://events-ssc.33across.com/match?bidder_id=66&external_user_id=060b4244-ee38-489d-b7ed-1a0a44b9f67a&ts=1659710464&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
68 B
82 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://events-ssc.33across.com/match?bidder_id=66&external_user_id=060b4244-ee38-489d-b7ed-1a0a44b9f67a&ts=1659710464&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: de.tynt.com
URL: https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
Protocol
H3
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://de.tynt.com/deb/?m=xch&rt=html&ru=deb&id=dPGcAuqZ0r6Ok4aKlId8sQ&gdpr_consent=undefined&us_privacy=undefined
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
via
1.1 google
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
referrer-policy
unsafe-url
server
33XP003
x-33x-status
8000000008200000A
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://events-ssc.33across.com/match?bidder_id=66&external_user_id=060b4244-ee38-489d-b7ed-1a0a44b9f67a&ts=1659710464&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
async_usersync
ib.adnxs.com/ Frame 3940 		0
745 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.24 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:04 GMT
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid
3aec3aee-2b98-4fdf-bfdc-79f065477740
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
match
c1.adform.net/serving/cookie/ Frame 4D17
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&cid=52C108B0-611A-4584-A232-D339F84A7A29
  • https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=52C108B0-611A-4584-A232-D339F84A7A29
35 B
467 B 		Document
General
Check archive.org
Download Go to
Full URL
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=52C108B0-611A-4584-A232-D339F84A7A29
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.167.164.42 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, no-transform
content-type
image/gif
date
Fri, 05 Aug 2022 14:41:04 GMT
expires
-1
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains

Redirect headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, no-transform
content-length
0
date
Fri, 05 Aug 2022 14:41:04 GMT
expires
-1
location
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=52C108B0-611A-4584-A232-D339F84A7A29
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
v1
match.sharethrough.com/sync/ Frame D07B
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=Yu0r-gAENBckxgA0&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D52C108B0-611A-4584-A232-D339F84A7A29
  • https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=52C108B0-611A-4584-A232-D339F84A7A29
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=52C108B0-611A-4584-A232-D339F84A7A29
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.66.208.67 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-66-208-67.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

cache-control
no-store, no-cache, private
date
Fri, 05 Aug 2022 14:41:03 GMT
location
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=52C108B0-611A-4584-A232-D339F84A7A29
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
v1
match.sharethrough.com/sync/ Frame 0B63
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:3d9b62ed-2bff-4400-97d4-14b35df0617d&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D52C108B0-611A-4584-A232-D339F84A7A29
  • https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=52C108B0-611A-4584-A232-D339F84A7A29
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=52C108B0-611A-4584-A232-D339F84A7A29
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.66.208.67 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-66-208-67.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

cache-control
no-store, no-cache, private
date
Fri, 05 Aug 2022 14:41:04 GMT
location
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=52C108B0-611A-4584-A232-D339F84A7A29
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 00A0
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/pm&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFCQ28wN0YybGdBQUJDUHRVM0Z2dw&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&...
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
  • https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AABCo07F2lgAABCPtU3Fvw&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsas%252Cpp%252Cpm%26bee_sync_current_partn...
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas,pp,pm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=2
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AABCo07F2lgAABCPtU3Fvw
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.215.195.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-215-195-104.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

content-length
95
content-type
text/html; charset=utf-8
date
Fri, 05 Aug 2022 14:41:04 GMT
location
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
pubm
c.deployads.com/cs/ Frame 52F4 		43 B
297 B 		Document
General
Check archive.org
Download Go to
Full URL
https://c.deployads.com/cs/pubm?b=52C108B0-611A-4584-A232-D339F84A7A29
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.225.229.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-225-229-70.compute-1.amazonaws.com
Software
SortableCactus/1.0 /
Resource Hash
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-cache
content-type
image/gif
date
Fri, 05 Aug 2022 14:41:04 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
pragma
no-cache
server
SortableCactus/1.0
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 7596
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=UsEIsGEaRYSiMtM5-Ep6KQ%3D%3D
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Protocol
H2
Server
184.29.128.213 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-29-128-213.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
content-encoding
gzip
last-modified
Tue, 01 Feb 2022 06:38:00 GMT
server
Apache/2.2.15 (CentOS)
etag
"1300708-3de4-5d6ef246ef4cf"
vary
Accept-Encoding
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=51054
accept-ranges
bytes
content-type
text/html; charset=UTF-8
content-length
5549
expires
Sat, 06 Aug 2022 04:51:58 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
272
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
458249.gif
idsync.rlcdn.com/ Frame 7596
Redirect Chain
  • https://idsync.rlcdn.com/420486.gif?partner_uid=52C108B0-611A-4584-A232-D339F84A7A29
  • https://pippio.com/api/sync?pid=5324&it=1&iv=efd7dac1fb47182e4e5df67f4ab694c6ec5c4bb52befa568d585b2a064f21d53791426b5417dce21&_=2
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBlZmQ3ZGFjMWZiNDcxODJlNGU1ZGY2N2Y0YWI2OTRjNmVjNWM0YmI1MmJlZmE1NjhkNTg1YjJhMDY0ZjIxZDUzNzkxNDI2YjU...
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBlZmQ3ZGFjMWZiNDcxODJlNGU1ZGY2N2Y0YWI2OTRjNmVjNWM0YmI1MmJlZmE1NjhkNTg1YjJhMDY0ZjIxZDUzNzkxNDI2YjU0MTdkY2UyMRAAGgwIgdi0lwYSBAgCEABCAEoA&goog...
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
  • https://idsync.rlcdn.com/458249.gif?partner_uid=ebe91ff2-a33a-4611-a642-90ff34fac4c9
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/458249.gif?partner_uid=ebe91ff2-a33a-4611-a642-90ff34fac4c9
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

location
https://idsync.rlcdn.com/458249.gif?partner_uid=ebe91ff2-a33a-4611-a642-90ff34fac4c9
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
x-samesite
secure
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
111
content-type
text/html; charset=utf-8
SPug
image4.pubmatic.com/AdServer/ Frame 7596
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&redir=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3FpartnerID%3D27%26partnerUID%3D%5BMM_UUID%5D
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=3d9b62ed-2bff-4400-97d4-14b35df0617d
0
128 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=3d9b62ed-2bff-4400-97d4-14b35df0617d
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Protocol
H2
Server
104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Fri, 05 Aug 2022 14:41:04 GMT
Server
MT3 4475 c1dc35a master ord-pixel-x57 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://image4.pubmatic.com/AdServer/SPug?partnerID=27&partnerUID=3d9b62ed-2bff-4400-97d4-14b35df0617d
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Fri, 05 Aug 2022 14:41:03 GMT
SPug
image4.pubmatic.com/AdServer/ Frame 7596
Redirect Chain
  • https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:ADE529A5AF7E4EC0BD84D098CEDEE4E8
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=52C108B0-611A-4584-A232-D339F84A7A29&redir=true&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-4CvjToBE2uUBlwqXOzxMEp7UMYq80nw-~A&gdpr=0&gdpr_consent=
0
48 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-4CvjToBE2uUBlwqXOzxMEp7UMYq80nw-~A&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Protocol
H2
Server
104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-4CvjToBE2uUBlwqXOzxMEp7UMYq80nw-~A&gdpr=0&gdpr_consent=
date
Fri, 05 Aug 2022 14:41:05 GMT
server
ATS/9.1.0.46
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
SPug
image4.pubmatic.com/AdServer/ Frame 7596
Redirect Chain
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3305665001870070297&gdpr=0&gdpr_consent=&us_privacy=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=52C108B0-611A-4584-A232-D339F84A7A29&redir=true&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-4CvjToBE2uUBlwqXOzxMEp7UMYq80nw-~A&gdpr=0&gdpr_consent=
0
128 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-4CvjToBE2uUBlwqXOzxMEp7UMYq80nw-~A&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Protocol
H2
Server
104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-4CvjToBE2uUBlwqXOzxMEp7UMYq80nw-~A&gdpr=0&gdpr_consent=
date
Fri, 05 Aug 2022 14:41:05 GMT
server
ATS/9.1.0.46
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
SPug
image4.pubmatic.com/AdServer/ Frame 7596
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=5e1b1e00-4929-4a58-9799-282bf9b88b13
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=52C108B0-611A-4584-A232-D339F84A7A29&redir=true&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-4CvjToBE2uUBlwqXOzxMEp7UMYq80nw-~A&gdpr=0&gdpr_consent=
0
48 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-4CvjToBE2uUBlwqXOzxMEp7UMYq80nw-~A&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Protocol
H2
Server
104.36.115.114 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:03 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-4CvjToBE2uUBlwqXOzxMEp7UMYq80nw-~A&gdpr=0&gdpr_consent=
date
Fri, 05 Aug 2022 14:41:05 GMT
server
ATS/9.1.0.46
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
pubcid.php
hbx.media.net/ Frame B25D 		57 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hbx.media.net/pubcid.php?itype=HB&cb=window.advBidxc.mnetCoRtusId
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.205.72.10 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-205-72-10.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7b48a74fa0f94d83ae6d60c772f5e7aa66e7be1b63ccf223ca14e34d3d7b0d22
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security
max-age=604800
content-encoding
gzip
server
Apache
date
Fri, 05 Aug 2022 14:41:04 GMT
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
max-age=1800
content-length
18543
x-mnet-hl2
E
expires
Fri, 05 Aug 2022 15:11:04 GMT
sync
gum.criteo.com/ Frame B25D 		88 B
411 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sync?r=2&c=321&gdpr=0&gdpr_pd=0&gdpr_consent=&us_privacy=&j=window.advBidxc.mnetRtusId
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
/
Resource Hash
e2011bd80729e0cce877fec1ccbb08da0567f6da1aa08dc3ffcd17febabf3e1c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=3600
server-processing-duration-in-ticks
4006
strict-transport-security
max-age=31536000; preload;
content-length
204
expires
60
usync.html
eus.rubiconproject.com/ Frame 6436
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=medianet
  • https://eus.rubiconproject.com/usync.html?p=medianet
281 B
573 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=medianet
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-1-200-83.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://contextual.media.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Fri, 05 Aug 2022 14:41:04 GMT
ETag
"402b2-119-5d32342a551c0"
Last-Modified
Tue, 14 Dec 2021 23:07:59 GMT
Server
Apache/2.2.15 (CentOS)
Unused62
8096267
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Fri, 05 Aug 2022 14:41:04 GMT
location
https://eus.rubiconproject.com/usync.html?p=medianet
server
AkamaiGHost
cksync.html
contextual.media.net/ Frame 2F07
Redirect Chain
  • https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Drkt%26refUrl%3D%26vid%3D971046491830271206414547280...
  • https://contextual.media.net/cksync.html?cs=8&vsid=3027120641454728000V10&type=rkt&refUrl=&vid=97104649183027120641454728000V10&ovsid=1797288115146808421
219 B
651 B 		Document
General
Check archive.org
Download Go to
Full URL
https://contextual.media.net/cksync.html?cs=8&vsid=3027120641454728000V10&type=rkt&refUrl=&vid=97104649183027120641454728000V10&ovsid=1797288115146808421
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.41.168.23 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-41-168-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
85af3052d288ffd9157258dfe4daf5309f0b64d0067ab8221cd0c62909c18419
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://contextual.media.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
max-age=0, no-cache, no-store
content-length
219
content-type
text/html;charset=UTF-8
date
Fri, 05 Aug 2022 14:41:05 GMT
expires
Fri, 05 Aug 2022 14:41:05 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA" CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
pragma
no-cache
server
Apache
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-mnet-hl2
E

Redirect headers

Content-Length
0
Date
Fri, 05 Aug 2022 14:41:04 GMT
Location
https://contextual.media.net/cksync.html?cs=8&vsid=3027120641454728000V10&type=rkt&refUrl=&vid=97104649183027120641454728000V10&ovsid=1797288115146808421
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server
Jetty(9.3.29.v20201019)
cksync.php
contextual.media.net/ Frame B25D
Redirect Chain
  • https://medianet-match.dotomi.com/match/bounce/current?version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Dcon%26refUrl...
  • https://medianet-match.dotomi.com/match/bounce/current?DotomiTest=26846092957208e6&is_secure=true&version=1&networkId=57734&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3...
  • https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=con&refUrl=&vid=97104649183027120641454728000V10&ovsid=AAADKVTuFEs4ugNmwCf-AAAAAAA&expiration=1659796865&is_secure=true
45 B
461 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=con&refUrl=&vid=97104649183027120641454728000V10&ovsid=AAADKVTuFEs4ugNmwCf-AAAAAAA&expiration=1659796865&is_secure=true
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Server
23.41.168.23 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-41-168-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
server
Apache
date
Fri, 05 Aug 2022 14:41:05 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=con&refUrl=&vid=97104649183027120641454728000V10&ovsid=AAADKVTuFEs4ugNmwCf-AAAAAAA&expiration=1659796865&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
cksync.html
contextual.media.net/ Frame B25D
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=78e2dffc-bb89-4bb2-ae92-f592d006518b&ph=6a16560a-f6c6-4851-b7b5-0b2c0190166a&r=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3027120641454728...
  • https://contextual.media.net/cksync.html?cs=8&vsid=3027120641454728000V10&type=opx&refUrl=&vid=97104649183027120641454728000V10&ovsid=93d8b6f4-533b-4188-b1ae-ac5e7919ebe5
219 B
219 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.html?cs=8&vsid=3027120641454728000V10&type=opx&refUrl=&vid=97104649183027120641454728000V10&ovsid=93d8b6f4-533b-4188-b1ae-ac5e7919ebe5
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Server
23.41.168.23 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-41-168-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
server
Apache
date
Fri, 05 Aug 2022 14:41:05 GMT
vary
Accept-Encoding
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
text/html;charset=UTF-8
content-length
219
x-mnet-hl2
E
expires
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

date
Fri, 05 Aug 2022 14:41:04 GMT
content-encoding
gzip
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://contextual.media.net/cksync.html?cs=8&vsid=3027120641454728000V10&type=opx&refUrl=&vid=97104649183027120641454728000V10&ovsid=93d8b6f4-533b-4188-b1ae-ac5e7919ebe5
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
cksync.php
contextual.media.net/ Frame B25D
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=64&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Dmma%26refUrl%3D%26vid%3D971046491830271206414547...
  • https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=mma&refUrl=&vid=97104649183027120641454728000V10&ovsid=3d9b62ed-2bff-4400-97d4-14b35df0617d
45 B
466 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=mma&refUrl=&vid=97104649183027120641454728000V10&ovsid=3d9b62ed-2bff-4400-97d4-14b35df0617d
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Server
23.41.168.23 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-41-168-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
server
Apache
date
Fri, 05 Aug 2022 14:41:05 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

Date
Fri, 05 Aug 2022 14:41:04 GMT
Server
MT3 4475 c1dc35a master ord-pixel-x54 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=mma&refUrl=&vid=97104649183027120641454728000V10&ovsid=3d9b62ed-2bff-4400-97d4-14b35df0617d
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Fri, 05 Aug 2022 14:41:03 GMT
cksync.php
contextual.media.net/ Frame B25D
Redirect Chain
  • https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Dr1%26refUrl%3D%26vid%3D97104649183027120641...
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005&rndcb=4897966379
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=cf57a75d-4f5e-49b9-b35a-536b2987624c&google_hm=Y2Y1N2E3NWQtNGY1ZS00OWI5LWIzNWEtNTM2YjI5ODc2...
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEPKjyge_kAq5cXxKreIHl68&google_cver=1&ssp=adconductor&bsw_param=cf57a75d-4f5e-49b9-b35a-536b2987624c
  • https://sync.1rx.io/usersync/bidswitch/cf57a75d-4f5e-49b9-b35a-536b2987624c?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005?redir=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Dr1%2...
  • https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=r1&refUrl=&vid=97104649183027120641454728000V10&ovsid=RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005
45 B
470 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=r1&refUrl=&vid=97104649183027120641454728000V10&ovsid=RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Server
23.41.168.23 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-41-168-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
server
Apache
date
Fri, 05 Aug 2022 14:41:05 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

Location
https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=r1&refUrl=&vid=97104649183027120641454728000V10&ovsid=RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005
Date
Fri, 05 Aug 2022 14:41:05 GMT
Connection
keep-alive
Content-Type
text/html
ETag
RXae383cc14aec472a93ada48dcc3d101e005
Transfer-Encoding
chunked
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
cksync
cs.media.net/ Frame B25D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=MzAyNzEyMDY0MTQ1NDcyODAwMFYxMA%3D%3D&google_sc=1
  • https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEFgMg3usawxqdfA6VaByDpo&google_cver=1
45 B
445 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEFgMg3usawxqdfA6VaByDpo&google_cver=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Server
23.205.72.10 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-205-72-10.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://cs.media.net/cksync?type=g&cs=8&google_gid=CAESEFgMg3usawxqdfA6VaByDpo&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cksync.php
contextual.media.net/ Frame B25D
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=MEDIANET&rurl=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Ddxu%26refUrl%3D%26vid%3D97104649183027120641454...
  • https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=dxu&refUrl=&vid=97104649183027120641454728000V10&ovsid=fYkDlbmh1OjYvA5
45 B
452 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=dxu&refUrl=&vid=97104649183027120641454728000V10&ovsid=fYkDlbmh1OjYvA5
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Server
23.41.168.23 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-41-168-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
server
Apache
date
Fri, 05 Aug 2022 14:41:05 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:04 GMT
Server
PingMatch/658332f#658332fc5aaa95d8a9be88d89d84d3c319923363 i-0e41e0757a7a8f54f@us-east-1b@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
Location
https://contextual.media.net/cksync.php?cs=8&vsid=3027120641454728000V10&type=dxu&refUrl=&vid=97104649183027120641454728000V10&ovsid=fYkDlbmh1OjYvA5
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
cksync.php
contextual.media.net/ Frame B25D
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=115&p=259&cp=medianet&cu=1&url=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D1%26type%3Dcrt%26ovsid%3D%40%40CRITEO_USERID%40%40
  • https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=bf233d43-c5a0-435a-a69f-8266f03c4e1a
45 B
616 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=bf233d43-c5a0-435a-a69f-8266f03c4e1a
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Server
23.41.168.23 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-41-168-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
server
Apache
date
Fri, 05 Aug 2022 14:41:05 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
server
Kestrel
x-errorlevel
0
strict-transport-security
max-age=31536000; preload;
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://contextual.media.net/cksync.php?cs=1&type=crt&ovsid=bf233d43-c5a0-435a-a69f-8266f03c4e1a
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
1180347
content-length
0
expires
Fri, 05 Aug 2022 00:00:00 GMT
cksync.php
contextual.media.net/ Frame B25D
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1
  • https://t.pswec.com/bsw_sync?ssp=medianet&bsw_user_id=cf57a75d-4f5e-49b9-b35a-536b2987624c
  • https://t.pswec.com/ul_cb/bsw_sync?ssp=medianet&bsw_user_id=cf57a75d-4f5e-49b9-b35a-536b2987624c
  • https://x.bidswitch.net/sync?dsp_id=2&user_id=73f090ab-bdec-4945-8da9-a0da1a2d146b&expires=3&user_group=1&ssp=medianet
  • https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=cf57a75d-4f5e-49b9-b35a-536b2987624c&gdpr=&gdpr_consent=&gdpr_pd=
45 B
465 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=1&type=bs&ovsid=cf57a75d-4f5e-49b9-b35a-536b2987624c&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Server
23.41.168.23 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-41-168-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
server
Apache
date
Fri, 05 Aug 2022 14:41:05 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

Location
//contextual.media.net/cksync.php?cs=1&type=bs&ovsid=cf57a75d-4f5e-49b9-b35a-536b2987624c&gdpr=&gdpr_consent=&gdpr_pd=
Date
Fri, 05 Aug 2022 14:41:05 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
cksync.php
contextual.media.net/ Frame B25D
Redirect Chain
  • https://b1sync.zemanta.com/usersync/medianet/?cb=https%3A%2F%2Fcontextual.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3027120641454728000V10%26type%3Dzem%26refUrl%3D%26vid%3D97104649183027120641454728...
  • https://stags.bluekai.com/site/23178?id=jTKicE_GJ9EQ0uhYWhcr&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TD...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6Y3PNZ2GK6DUOVQWYLTNMVSGSYJONZSXIL3DNNZXS3TDFZYGQ4B7MNZT2OBGMV4GG2DBNZTWKPLNMVSGSYLOMV2CM33WONUWIPLKKRFWSY2FL5DUUOKFKEYHK2CZK5UGG...
  • https://contextual.media.net/cksync.php?cs=8&ovsid=jTKicE_GJ9EQ0uhYWhcr&refUrl=&type=zem&vid=97104649183027120641454728000V10&vsid=3027120641454728000V10
45 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=8&ovsid=jTKicE_GJ9EQ0uhYWhcr&refUrl=&type=zem&vid=97104649183027120641454728000V10&vsid=3027120641454728000V10
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Server
23.41.168.23 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-41-168-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
server
Apache
date
Fri, 05 Aug 2022 14:41:05 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:05 GMT
P3p
CP="We do not support P3P header."
Location
https://contextual.media.net/cksync.php?cs=8&ovsid=jTKicE_GJ9EQ0uhYWhcr&refUrl=&type=zem&vid=97104649183027120641454728000V10&vsid=3027120641454728000V10
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
196
Expires
Thu, 01 Dec 1994 16:00:00 GMT
cksync.php
contextual.media.net/ Frame B25D
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=medianet&ssp_user_id=3027120641454728000V10
  • https://contextual.media.net/cksync.php?type=mf&ovsid=6d33763a-bcfb-43c0-8f79-5c0c6a498cb9&cs=1
45 B
465 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?type=mf&ovsid=6d33763a-bcfb-43c0-8f79-5c0c6a498cb9&cs=1
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Server
23.41.168.23 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-41-168-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
server
Apache
date
Fri, 05 Aug 2022 14:41:05 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

location
//contextual.media.net/cksync.php?type=mf&ovsid=6d33763a-bcfb-43c0-8f79-5c0c6a498cb9&cs=1
date
Fri, 05 Aug 2022 14:41:04 GMT
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
710489.gif
id.rlcdn.com/ Frame B25D 		42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/710489.gif
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:04 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
cksync
cs.media.net/ Frame B25D
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://cs.media.net/cksync?cs=1&type=ttd&ovsid=5e1b1e00-4929-4a58-9799-282bf9b88b13
45 B
450 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=5e1b1e00-4929-4a58-9799-282bf9b88b13
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Server
23.205.72.10 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-205-72-10.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cs.media.net/cksync?cs=1&type=ttd&ovsid=5e1b1e00-4929-4a58-9799-282bf9b88b13
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
199
dcm
s.amazon-adsystem.com/ Frame B25D
Redirect Chain
  • https://cs.media.net/cksync?cs=35&type=tam&ovsid=setstatuscode&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fdcm%3Fpid%3Ddcd3b62c-7a4b-4d79-a73e-c47474a8ab42%26id%3D3027120641454728000V10%26gdpr%3...
  • https://s.amazon-adsystem.com/dcm?pid=dcd3b62c-7a4b-4d79-a73e-c47474a8ab42&id=3027120641454728000V10&gdpr=0&gdpr_consent=
43 B
932 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=dcd3b62c-7a4b-4d79-a73e-c47474a8ab42&id=3027120641454728000V10&gdpr=0&gdpr_consent=
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
HTTP/1.1
Server
209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:05 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
4SWCHM7W8S77K784A10D
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
location
https://s.amazon-adsystem.com/dcm?pid=dcd3b62c-7a4b-4d79-a73e-c47474a8ab42&id=3027120641454728000V10&gdpr=0&gdpr_consent=
cache-control
max-age=0, no-cache, no-store
content-type
text/html
content-length
154
x-mnet-hl2
E
expires
Fri, 05 Aug 2022 14:41:05 GMT
log
c21lg-d.media.net/ Frame B25D 		35 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c21lg-d.media.net/log?logid=kfk&evtid=cs&origin=1&pvgid=data-c&ovsid=OAgeY7Gle1N9gdvlMVnL7Sa2xIbA0Vmu&cs=15&vsid=3027120641454728000V10
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.205.72.10 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-205-72-10.deploy.static.akamaitechnologies.com
Software
Jetty(9.4.35.v20201120) /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
server
Jetty(9.4.35.v20201120)
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Fri, 05 Aug 2022 14:41:05 GMT
match
events-ssc.33across.com/ Frame C9EE 		68 B
82 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://events-ssc.33across.com/match?liv=g&us_privacy=&bidder_id=70&external_user_id=2d9fd305-26b0-4b87-bed6-dde0c1a2eb66
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.117.239.71 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
71.239.117.34.bc.googleusercontent.com
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
via
1.1 google
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
68
content-type
image/png
sd
us-u.openx.net/w/1.0/ Frame C9EE
Redirect Chain
  • https://i.w55c.net/ping_match.gif?ei=OPENX&rurl=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_
  • https://us-u.openx.net/w/1.0/sd?id=537072979&val=fYkDlbmh1OjYvA5
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072979&val=fYkDlbmh1OjYvA5
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:04 GMT
Server
PingMatch/658332f#658332fc5aaa95d8a9be88d89d84d3c319923363 i-074224b1769df550d@us-east-1d@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
Location
https://us-u.openx.net/w/1.0/sd?id=537072979&val=fYkDlbmh1OjYvA5
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame C9EE
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=1339413300440423216
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=1339413300440423216
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=1339413300440423216
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
sd
us-u.openx.net/w/1.0/ Frame C9EE
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=d8Xn0XOV5NFsweeCIMevjXCSu4NslrvWcpGMBTMp
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=d8Xn0XOV5NFsweeCIMevjXCSu4NslrvWcpGMBTMp
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=0&val=d8Xn0XOV5NFsweeCIMevjXCSu4NslrvWcpGMBTMp
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame C9EE
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=openx
  • https://sync.srv.stackadapt.com/sync?nid=50&gdpr=&gdpr_consent=&gdpr_pd=&ssp=openx
  • https://x.bidswitch.net/sync?dsp_id=188&user_id=6_XrCJGTQqVPxVrU8Wo7oJU4mbM&user_group=1&ssp=openx
  • https://us-u.openx.net/w/1.0/sd?id=537072968&val=cf57a75d-4f5e-49b9-b35a-536b2987624c&gdpr=&gdpr_consent=
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072968&val=cf57a75d-4f5e-49b9-b35a-536b2987624c&gdpr=&gdpr_consent=
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
//us-u.openx.net/w/1.0/sd?id=537072968&val=cf57a75d-4f5e-49b9-b35a-536b2987624c&gdpr=&gdpr_consent=
Date
Fri, 05 Aug 2022 14:41:05 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
sd
us-u.openx.net/w/1.0/ Frame C9EE
Redirect Chain
  • https://p.rfihub.com/cm?pub=25&in=1
  • https://us-u.openx.net/w/1.0/sd?id=537073062&val=1797288115146808421
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073062&val=1797288115146808421
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
https://us-u.openx.net/w/1.0/sd?id=537073062&val=1797288115146808421
Date
Fri, 05 Aug 2022 14:41:04 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
sd
us-u.openx.net/w/1.0/ Frame C9EE
Redirect Chain
  • https://um.simpli.fi/ox_match
  • https://us-u.openx.net/w/1.0/sd?id=537072966&val=ADE529A5AF7E4EC0BD84D098CEDEE4E8
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072966&val=ADE529A5AF7E4EC0BD84D098CEDEE4E8
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date
Fri, 05 Aug 2022 14:41:05 GMT
x-content-type-options
nosniff
server
nginx
location
https://us-u.openx.net/w/1.0/sd?id=537072966&val=ADE529A5AF7E4EC0BD84D098CEDEE4E8
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
138
expires
Thu, 04 Aug 2022 14:41:05 GMT
53233
i6.liadm.com/s/ Frame C9EE
Redirect Chain
  • https://i.liadm.com/s/57424?bidder_id=206088&bidder_uuid=5b4203ef-cfe1-4119-9067-2e364160b8d6
  • https://i.liadm.com/s/57424?bidder_id=206088&bidder_uuid=5b4203ef-cfe1-4119-9067-2e364160b8d6&_li_chk=true&previous_uuid=d0f383f5f9f147d296c8c7af8c030420
  • https://i.liadm.com/s/64716?md5=&sha1=&sha2=&bidder_id=206088&bidder_uuid=5b4203ef-cfe1-4119-9067-2e364160b8d6&previous_uuid=9e1f8546616546049fd55f7b5b6c237f
  • https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!{TURN_UUID}
  • https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=3305665001870070297
  • https://i6.liadm.com/s/53233?bidder_id=183658&bidder_uuid=3305665001870070297
43 B
419 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/53233?bidder_id=183658&bidder_uuid=3305665001870070297
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol
HTTP/1.1
Server
2600:1f18:444a:4602:377c:45e6:1b19:7050 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Fri, 05 Aug 2022 14:41:05 GMT
Cache-Control
no-store
Connection
keep-alive
Content-Length
43
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/53233?bidder_id=183658&bidder_uuid=3305665001870070297
Date
Fri, 05 Aug 2022 14:41:05 GMT
Connection
keep-alive
Content-Length
0
Strict-Transport-Security
max-age=31536000; includeSubDomains
g.pixel
aa.agkn.com/adscores/ Frame C9EE 		43 B
654 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9212314908&puid=47763f15-b7f7-40f9-b8a3-5eba4b30eb1f
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.128.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-128-44.jfk50.r.cloudfront.net
Software
AAWebServer /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 8ee187646f657ced7afa83005e9249cc.cloudfront.net (CloudFront)
server
AAWebServer
x-amz-cf-pop
JFK50-P4
access-control-allow-methods
GET, POST, OPTIONS
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
x-cache
Miss from cloudfront
content-type
image/gif
access-control-allow-headers
accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length
43
x-amz-cf-id
0N6cTC9aTsT1NemBj3SvNj1hD8_AiWA2WOt2pduMMKpophUYlRdwKA==
expires
0
709996.gif
id.rlcdn.com/ Frame C9EE 		42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/709996.gif
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
sd
us-u.openx.net/w/1.0/ Frame C9EE
Redirect Chain
  • https://aorta.clickagy.com/pixel.gif?ch=4&cm=447aeb8e-aa41-4726-a474-49712fc47708&redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537073026%26val%3D%7Bvisitor_id%7D
  • https://us-u.openx.net/w/1.0/sd?id=537073026&val=c:cc7af9c12b90d058d68105cfddcc4a9b
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073026&val=c:cc7af9c12b90d058d68105cfddcc4a9b
Requested by
Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=c6a5ba0d-ce02-41bd-a1ea-842c68bd5108&ph=8f5ed5d4-642c-4222-968a-d709c87ac3c8&us_privacy=&r=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dg%26us_privacy%3D%26bidder_id%3D70%26external_user_id%3D
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://us-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date
Fri, 05 Aug 2022 14:41:05 GMT
server
Aorta/20220801.70a5aba4
location
https://us-u.openx.net/w/1.0/sd?id=537073026&val=c:cc7af9c12b90d058d68105cfddcc4a9b
expect
0
access-control-max-age
31536000
access-control-allow-methods
POST, GET, OPTIONS
content-type
text/plain
access-control-allow-origin
access-control-expose-headers
Set-Cookie
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
x-aorta-region
us-east-1
x-aorta-host
695f20b13949
access-control-allow-headers
Origin,cache-control,content-type,man,messagetype,soapaction
content-length
0
crum
dsum-sec.casalemedia.com/ Frame E619
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/ie
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AABCo07F2lgAABCPtU3Fvw&expiration=1660920065
43 B
906 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AABCo07F2lgAABCPtU3Fvw&expiration=1660920065
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bleepingcomputer.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604aa7fd53a1ed-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6oO8IRi3NcwQx7IcKlkNSnYmSwzY3yjsEHtT4UxL%2BuVwzAED4Kc7Pm3fupK3P2Day2i2PHfKfZvSfwnSvi2QT2hCUTvtl0fUcSpQdU5G2L7tSnZ1SEMJD5fD6DygY0OCX%2BJ9SYv5Qf6Eng%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AABCo07F2lgAABCPtU3Fvw&expiration=1660920065
Date
Fri, 05 Aug 2022 14:41:05 GMT
Server
nginx
Connection
keep-alive
Content-Length
0
strict-transport-security
max-age=2592000; includeSubDomains
rum
dsum.casalemedia.com/ Frame E619
Redirect Chain
  • https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1
  • https://casale-match.dotomi.com/match/bounce/current?DotomiTest=44d15bf32c1a08e4&is_secure=true&networkId=19998&version=1
  • https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAADKVTuFEs4vgNvsPt1AAAAAAA&expiration=1659796865&is_secure=true
43 B
934 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAADKVTuFEs4vgNvsPt1AAAAAAA&expiration=1659796865&is_secure=true
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bleepingcomputer.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604aa75fe9a238-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NW753QUtPRlBqvKd5yWYumAEmaQF5ymFlGsVVlNj%2FUbUFr7UsnuSbOCEH3R0bF9Y1wIQYsgcJpqyUqqFmTo7HYf9y9uVolVxyX%2FwdJ5nR0oqllYlvOd9vdJzM6no4Jz%2BdEoiiFLh"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAADKVTuFEs4vgNvsPt1AAAAAAA&expiration=1659796865&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
crum
dsum-sec.casalemedia.com/ Frame E619
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=29
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=1339413300440423216&expiration=1660920065
43 B
910 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=1339413300440423216&expiration=1660920065
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bleepingcomputer.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604aa69b6da1ed-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JATaZGUbrRYhFSy716%2BFPfs%2FCZGLmUoRMeney25yYNCPGN%2BAiKIuAxNzuUJAQwQBtntm1IAjUvOkWleYk30QyLPtgkZq1%2FW6tL7dKgacKPYZmXrzpI5WHFnswUBVivZOccKLLQrd2ALSRg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
server
nginx
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=1339413300440423216&expiration=1660920065
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
rum
dsum-sec.casalemedia.com/ Frame E619
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=SZI6v03COb9SljrsHpBy407FZu1SwWa4TMZK_mqi
43 B
912 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=SZI6v03COb9SljrsHpBy407FZu1SwWa4TMZK_mqi
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bleepingcomputer.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604aa69b74a1ed-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VGt10FU%2BD148mBJi9E1hpXgb05w7z2CfCCQjdE5RdvMgLUlWai%2F2gfjKCBgcXgGfSV8QCTrX8h%2BYuhvkHZUCUx7E8A3CM%2BiypNabUiLVM%2B4g7r5qU7fKD9LQkb9tlUG6DCWr%2BvXnreKTDg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&gdpr=0&external_user_id=SZI6v03COb9SljrsHpBy407FZu1SwWa4TMZK_mqi
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame E619
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=68
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=6_XrCJGTQqVPxVrU8Wo7oJU4mbM
43 B
913 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=6_XrCJGTQqVPxVrU8Wo7oJU4mbM
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bleepingcomputer.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604aa69b71a1ed-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bXUPRtSARCgOJ0mzZHUqlA1%2Fg9nHzeS8I5ubYfXkrU7X8gBZWY74RknHIFbrJ5PUMhbZ2qnxHfpacTZEa%2FysiRqN7tZSXHsNh8p9%2BRf%2F%2FA07n2THVf%2BPH6ECo6zDkoedBaRiJPZF6RRBEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=6_XrCJGTQqVPxVrU8Wo7oJU4mbM
Date
Fri, 05 Aug 2022 14:41:05 GMT
Connection
keep-alive
Content-Length
122
Content-Type
text/html; charset=utf-8
Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB
pr-bh.ybp.yahoo.com/sync/casale/ Frame E619
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB&gdpr_consent=&us_privacy=&gdpr=
  • https://pr-bh.ybp.yahoo.com/sync/casale/Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB
43 B
984 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bleepingcomputer.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Server
2600:1f13:d60:4f01:bbc5:ac74:cf42:940a Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff

Redirect headers

location
https://pr-bh.ybp.yahoo.com/sync/casale/Yu0r_GZu4dfEMT1ZXkpk7AAAAIwAAAIB
date
Fri, 05 Aug 2022 14:41:05 GMT
server
ATS/9.1.0.46
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
rum
r.casalemedia.com/ Frame E619
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48
  • https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&gdpr=0&gdpr_consent=
43 B
947 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&gdpr=0&gdpr_consent=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bleepingcomputer.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604aa6ee4854b5-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5VGbxnyPsYG4RtVnLPzSJFpsiWQX87njIzj3EqH5TGGj4uwLonC31AHIEfuRBbvjPLr2WEF329%2FuQZrVcT4ma%2BQ7w%2BNa%2ByC%2BgsVkGzCtu%2B6YPo9Gc%2FPZdrXL4Mr5XPClFgHb"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:04 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
crum
dsum-sec.casalemedia.com/ Frame E619
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casa...
  • https://s.tribalfusion.com/z/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.ca...
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662292708841638
43 B
907 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662292708841638
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bleepingcomputer.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H3
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray
73604aa7ed30a1ed-YYZ
pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=St7upGH%2F0GqMsOE9MPHBaNlWOfVVeOoW%2B1sW9UuA8HDgIHzKF634isbdhoNvUpZ0NlLlansJU5b6AiwkDYA3qGr6MGW5T0ohF6Z00XRRg8iXQo%2FMWiWcS1Lkc0btVvYYuIt3%2Bjoa0CGpDg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
cf-cache-status
DYNAMIC
x-function
209
server
cloudflare
x-reuse-index
261
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
73604aa75a1d4bd0-YUL
p3p
CP="NOI DEVo TAIa OUR BUS"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662292708841638
cache-control
no-cache, private
content-type
text/html
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Thu, 01 Jan 1970 00:00:00 GMT
htw-pixel.gif
cdn.indexww.com/ht/ Frame E619 		43 B
425 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.indexww.com/ht/htw-pixel.gif?Yu0r-GZu4dfEMT1ZXkpk7AAA%26140
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?d=https%3A%2F%2Fwww.bleepingcomputer.com%2F&s=184674&cb=https%3A%2F%2Fcdn.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:c4c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:05 GMT
cf-cache-status
HIT
age
144
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control
cache-maxage=1h
content-length
43
last-modified
Tue, 24 Jan 2017 19:36:04 GMT
server
cloudflare
etag
"761e21-2b-546dc3a097100"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
73604aa6be0f7145-YUL
expires
Fri, 05 Aug 2022 18:41:05 GMT
log
c21lg-d.media.net/ Frame B25D 		35 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c21lg-d.media.net/log?logid=kfk&evtid=cs&origin=1&pvgid=data-con&ovsid=881db265-4e56-45f8-ba66-d8dea844726c&cs=15&vsid=3027120641454728000V10
Requested by
Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CUJ8GUQF&prvid=2030%2C173%2C251%2C175%2C178%2C233%2C157%2C3018%2C2027%2C3017%2C159%2C2026%2C214%2C236%2C3016%2C336%2C117%2C238%2C337%2C359%2C338%2C339%2C97%2C55%2C99%2C77%2C56%2C59%2C3012%2C141%2C222%2C201%2C3007%2C246%2C345%2C4%2C126%2C203%2C226%2C10000%2C228%2C80%2C108%2C229%2C9%2C109%2C307%2C82&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.205.72.10 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-205-72-10.deploy.static.akamaitechnologies.com
Software
Jetty(9.4.35.v20201120) /
Resource Hash
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://contextual.media.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
server
Jetty(9.4.35.v20201120)
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
35
expires
Fri, 05 Aug 2022 14:41:05 GMT
usync.js
eus.rubiconproject.com/ Frame 6436 		31 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=medianet
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.1.200.83 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-1-200-83.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
37e4253e392190e641fe31178e0da5ff17fa01824f5869a35e173ee52be4a5ec

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=medianet
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date
Fri, 05 Aug 2022 14:41:05 GMT
Content-Encoding
gzip
Last-Modified
Tue, 12 Jul 2022 20:44:25 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=14198
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9452
Expires
Fri, 05 Aug 2022 18:37:43 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame E1B0 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220803&jk=1646630767893534&bg=!vb6lvvrNAAZGjrx1Zo47ACkAdvg8WpF_-mUfcJVkTm0_yNzaYsJHhEA2V67zvnGWlj2mVrQmkueqBQIAAABWUgAAAAJoAQeZAxGeH_5IsCnTOaZqMwK_M7plWwKGLvwJ95s-9v9wBvg571OvdbFu_G5mNW1-yn7YDUf1UXW9caD5ts3woYo46V1hD8GrCrKDkNIk6Z1yLkFYeFwTh2oGswGlxJIIzAf_R5c9F8hMzsYpwKdBoZO-G-E5tNB5zGOpbvCZARxVzAUQK-SK_1pOtHnonxpCGa2nKBiXZG1bYkxVX7R4xLNp42kShf0DS4_ZUNRwZX6hNWoABhazNOGCSYygvSkcSqsSBuu7eE7Rmri-R1gNmJVuRoqH6oHufln-1qxY82uaXywbQ4wocUTD8l9kLIlAurc_rJFRvTSWXUxxHnlsfra2G_ua5pbDfMVftQJrLI7xPeTXeDJ9cnr4h8t0pME8iwYFg6D93C2uEWpAV8Y7BQnP9OEeQKZ18ddHKqEfy_yiEKbcB1DCjRTZdbo-_S60vFxHFVxtWmGGxSH1dQqKzCXuk2xTFo_-QHrhxMOjNKDNMBdP9kxzO5zYBBINWmZ7aQCtj_0tsECrR0du6bAR5c0y9LDIEctnSPlW_yNqsey22aG-p3hxt8Jmx2NB2xKFwXkaTdy5ceLGTKPtVKTrZxmrYUjuKP2mZk8pdGbS8PwYU0mmmP4faTZFv-9JRaXoaXjLXC5gOaBkeX7WbK3WqKW35BknhSLC6mwh_ygoU86QTp8QNIKGVs0UcT9KuySLdIFCu7vghZzLEDE-ybqtEBpMa57bjwt9_2Kns4WFEB43yqqCMam_XgoWsiccESFQ2hKVTBaQ4MSvrqDEMA9BvjGNyfkB567yKetXaW4-xnFrJ0Dwcaei_QMHdKCrd84Vag4BYHI7WWYZMPcEp6imQ6n1WWwE4PDh95UP-_cD3cBXLq7gh0Pw3DBv8drXRXuHQwX4hMGESbt81fKgFaFYY5VvuxKNsmNkBLa7I4NQIUWxOaLG5z1CChAgdkubv4muKXoLoZGB2uqIXM_TLDmmF-SeU-_Qnd1A9ZW-m1sEdGkZ9b3yFM4F8atTCSOjkN5CpyYaXWf_zI8hICOQ7mMJzhlRv_9t3A
Requested by
Host: www.bleepingcomputer.com
URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers
cksync.php
contextual.media.net/ Frame 6436
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=medianet&khaos=L6GKR815-T-8KOJ
  • https://contextual.media.net/cksync.php?type=rbcn&ovsid=L6GKR815-T-8KOJ
45 B
451 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?type=rbcn&ovsid=L6GKR815-T-8KOJ
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=medianet
Protocol
H2
Server
23.41.168.23 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-41-168-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
server
Apache
date
Fri, 05 Aug 2022 14:41:05 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Fri, 05 Aug 2022 14:41:05 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://contextual.media.net/cksync.php?type=rbcn&ovsid=L6GKR815-T-8KOJ
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
c57992b917a1c5de787b922c662fdf18
Expires
0
activeview
pagead2.googlesyndication.com/pcs/ Frame 676C 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssseyve0c36ofUPTtz28Ow2UhnTb9tAlEzGNCczmOwXQH-tkxIwmHPWZvcVkWoq-Rg_gFC3IwJ7IzUARObP165SZ-neBzN_StHzyVZVdzaZxu1wT6g5uEM45CHDAoLfHIZT5BdFxYSWYg&sai=AMfl-YTx-A0jgRoSn-DxfJkKCfub9P1Gss8lWgTN5gjvfiPWcIbC--758leg048MsGBSy-JszutoiBNzOb2UIMe5f1EBfHRpJ0I3034&sig=Cg0ArKJSzA-O9WeRz3tEEAE&cid=CAASEuRolhmcaUZS24jyY4aFJR8hDw&id=lidar2&mcvt=1004&p=0,0,90,728&mtos=1004,1004,1004,1004,1004&tos=1004,0,0,0,0&v=20220803&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2655341515&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1659710463333&rpt=819&met=ie&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81d::2002 New York, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Aug 2022 14:41:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 3940 		0
745 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.24 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 05 Aug 2022 14:41:05 GMT
X-Proxy-Origin
149.56.153.179; 149.56.153.179; 577.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid
90a5ff92-e81c-41c8-882d-e9a25b653ac2
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
demand-source
d.pub.network/ 		59 B
96 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/demand-source
Requested by
Host: a.pub.network
URL: https://a.pub.network/core/pubfig/pubfig.engine.4.29.0.PFG-915.06b26c4f2be286767debeffd81549545f22e345e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash
0b03c4e89b248daeb0c2ed482fb6c31e6c2863e9dc0eb650b65a38b7367e9513

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.bleepingcomputer.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type
application/json

Response headers

date
Fri, 05 Aug 2022 14:41:06 GMT
content-encoding
gzip
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Accept-Encoding, User-Agent
content-type
application/json
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via
1.1 google
demand-source
d.pub.network/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://d.pub.network/demand-source
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.201.71.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.71.201.35.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.bleepingcomputer.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
https://www.bleepingcomputer.com
access-control-max-age
1800
allow
GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Fri, 05 Aug 2022 14:41:06 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers Accept-Encoding, User-Agent
via
1.1 google
SPug
simage4.pubmatic.com/AdServer/ Frame 7596 		0
260 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=156961&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156961&userIdMacro=PM_UID&gdpr=0&gdpr_consent=&predirect=https%3A%2F%2Fc.deployads.com%2Fcs%2Fpubm%3Fb%3DPM_UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.84 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 14:41:04 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s7.addthis.com
URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Domain
googleads.g.doubleclick.net
URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&h=500&slotname=4359266829&adk=3764243768&adf=155314479&pi=t.ma~as.4359266829&w=834&cr_col=4&cr_row=2&fwrn=2&lmt=1659026025&rafmt=9&psa=0&format=834x500&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&crui=image_stacked&fwr=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710460273&bpp=4&bdt=658&idt=235&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&abxe=1&correlator=2768181573619&frm=20&pv=2&ga_vid=1170813820.1659710460&ga_sid=1659710461&ga_hid=1896539107&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=215&ady=4087&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763505%2C31068775&oid=2&pvsid=369477549655474&tmod=1475282787&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=MhpC7LwGAx&p=https%3A//www.bleepingcomputer.com&dtd=257
Domain
googleads.g.doubleclick.net
URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-0920899300397823&output=html&adk=1812271804&adf=3025194257&lmt=1659026025&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1659710460289&bpp=2&bdt=673&idt=274&shv=r20220803&mjsv=m202208030101&ptt=9&saldr=aa&abxe=1&prev_fmts=834x500&nras=1&correlator=2768181573619&frm=20&pv=1&ga_vid=1170813820.1659710460&ga_sid=1659710461&ga_hid=1896539107&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44763505%2C31068775&oid=2&pvsid=369477549655474&tmod=1475282787&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=282
Domain
imasdk.googleapis.com
URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Domain
capi-tier-1-us-east-2.connatix.com
URL
https://capi-tier-1-us-east-2.connatix.com/rtb/g?v=174545
Domain
hb.emxdgt.com
URL
https://hb.emxdgt.com/?t=2000&ts=1659710460834&src=pbjs
Domain
ap.lijit.com
URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_6.2.0
Domain
firstimpression-d.openx.net
URL
https://firstimpression-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=d20e1fe5-a78f-4836-819d-63906e01e0e0&nocache=1659710460840&schain=1.0%2C1!firstimpression.io%2C5971%2C1%2C%2C%2C&aus=300x250&divids=fiInstance_101902_0_1628619430506725_unit&aucs=&auid=540115649
Domain
ib.adnxs.com
URL
https://ib.adnxs.com/ut/v3/prebid
Domain
fastlane.rubiconproject.com
URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18438&site_id=202928&zone_id=1041214&size_id=15&rp_schain=1.0,1!firstimpression.io,5971,1,,,&rf=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F&tg_i.ref=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw&tg_i.page=https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F&tg_i.domain=bleepingcomputer.com&tg_i.figroup=a10&tk_flint=pbjs_lite_v6.2.0&x_source.tid=d20e1fe5-a78f-4836-819d-63906e01e0e0&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.5609443007777759
Domain
htlb.casalemedia.com
URL
https://htlb.casalemedia.com/cygnus?s=475493&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%2217726b12daac6bc%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%22%2C%22ref%22%3A%22https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsecurity%2Fcyberspies-use-google-chrome-extension-to-steal-emails-undetected%2F%3Futm_source%3Dnewsletter%26utm_medium%3Demail%26utm_term%3D2022-08-05%26utm_campaign%3DFw%2BItalian%2BInternal%2BRevenue%2BService%2BBreached%2BAudius%2BHacked%2BPrestaShop%2BZero-Day%2BFlaw%22%2C%22domain%22%3A%22bleepingcomputer.com%22%2C%22publisher%22%3A%7B%22domain%22%3A%22bleepingcomputer.com%22%7D%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.2.0%22%2C%22userIds%22%3A%5B%5D%2C%22fpd%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%221816bd40c96ab6c%22%2C%22banner%22%3A%7B%22topframe%22%3A0%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22475493%22%2C%22sid%22%3A%22300x250%22%7D%7D%5D%7D%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22firstimpression.io%22%2C%22sid%22%3A%225971%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%7D%7D
Domain
capi-tier-1-us-east-2.connatix.com
URL
https://capi-tier-1-us-east-2.connatix.com/core/us?v=174545
Domain
capi-tier-1-us-east-2.connatix.com
URL
https://capi-tier-1-us-east-2.connatix.com/core/us?v=174545
Domain
capi-tier-1-us-east-2.connatix.com
URL
https://capi-tier-1-us-east-2.connatix.com/core/us?v=174545
Domain
token.rubiconproject.com
URL
https://token.rubiconproject.com/khaos.jpg?
Domain
sync.go.sonobi.com
URL
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsonobi-usync%3Fuid%3D%5BUID%5D
Domain
bcp.crwdcntrl.net
URL
https://bcp.crwdcntrl.net/6/map
Domain
sync.inmobi.com
URL
https://sync.inmobi.com/TAM?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D
Domain
sync.crwdcntrl.net
URL
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341%26partner_url%3Dhttps%253A%252F%252Fr.casalemedia.com%252Frum%253Fcm_dsp_id%253D64%2526external_user_id%253D677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341%2526gdpr%253D0%2526gdpr_consent%253D
Domain
bcp.crwdcntrl.net
URL
https://bcp.crwdcntrl.net/5/ct=y/c=5436/tp=SVRN/tpid=FGHRhPZHXp7Ir1doSteX52FA/pv=y?https://ce.lijit.com%2Fmerge%3Fpid%3D5001%263pid%3D%24%7Bprofile_id%7D&gdpr=0&gdpr_consent=
Domain
sync.crwdcntrl.net
URL
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%26partner_device_id%3D677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341%26partner_url%3Dhttps%253A%252F%252Fce.lijit.com%252Fmerge%253Fpid%253D16%25263pid%253D677e4d26-958e-4cc1-b03f-f3c95336b02d-62ed2bfe-4341%2526gdpr%253D0%2526gdpr_consent%253D
Domain
token.rubiconproject.com
URL
https://token.rubiconproject.com/token?pid=25470
Domain
id.crwdcntrl.net
URL
https://id.crwdcntrl.net/id
Domain
api.rlcdn.com
URL
https://api.rlcdn.com/api/identity/envelope?pid=106

Verdicts & Comments Add Verdict or Comment

315 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery function| cnxps object| freestar object| apd_options function| gtag object| dataLayer object| adsbygoogle function| Blazy object| fixto function| validate_comment_box_not_empty function| cz_strip_tags function| cz_br2nl function| editForm string| loginhash boolean| main_nav_hide_flag number| scrollTop string| main_nav_hide_timer function| call_main_nav_hide number| cz_header_pos number| prevScrollTop function| loadDeferredStyles function| raf object| __cfBeacon boolean| fifabAlready function| fi_fab object| google_tag_manager undefined| commonInit function| visibilityEventsManagerDOM function| visibilityEventsManager function| scrollEventsManager function| DeviceDetector object| FI object| JSON_PIWIK object| _fipaq object| FIPiwik object| AnalyticsTracker function| fiQuery object| google_tag_data string| GoogleAnalyticsObject function| ga function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| addthis_share object| addthis_config object| cnx_usr_storage function| onYouTubeIframeAPIReady object| gaGlobal object| fsdata object| _comscore object| fsprebid object| gaplugins object| gaData boolean| __@@##MUH object| google_js_reporting_queue number| google_srt object| google_logging_queue number| tmod object| google_ad_modifications object| ggeac object| google_persistent_state_async boolean| google_measure_js_timing object| google_reactive_ads_global_state boolean| _gfp_a_ object| google_sa_queue function| google_process_slots boolean| google_apltlad function| google_spfd number| google_lpabyc number| google_unique_id object| google_sv_map string| google_user_agent_client_hint number| google_rum_task_id_counter object| oattr object| fiUtils object| $customVisiblity object| $waitOn object| COMSCORE function| udm_ object| ns_p function| load_script object| confiant object| googletag function| google_sa_impl object| googleToken object| googleIMState boolean| _gfp_p_ function| processGoogleToken number| google_global_correlator object| google_prev_clients object| ampInaboxIframes object| ampInaboxPendingMessages object| _atw string| addthis_exclude boolean| addthis_use_personalization string| addthis_options_default string| addthis_options_rank string| addthis_options object| __callbacks object| google_image_requests object| player_instance_22b583aa3d9c43758254b3dbce2e7d86 object| cnxEnfStorage function| cnxsetTimeout function| cnxsetInterval object| cnxPlugins function| Tapad object| fsprebidChunk object| _pbjsGlobals object| mnet object| headertag object| __bt_tag_d object| __bt_intrnl boolean| __bt_already_invoked function| cnxProxyTask object| $jscomp function| getVPAIDAd object| cnxtimeouts object| cnxintervals function| oldSetTimeout function| oldSetInterval function| clearAll object| apstag object| _qevents boolean| apstagLOADED boolean| creativeVendorLibraryLoaded function| quantserve function| __qc object| ezt object| _qoptions function| qtrack undefined| nQuery number| ntvLoadStart object| ntv object| prdom object| onFocusEvents function| ntvjQueryInit function| ntvExtends function| ntvAppendStylesheet function| ntvAppendScript function| ntvGetElementViewability function| ntvArticleTracker function| ntvViewableImpressionTracker object| PostRelease object| ntvToutAds boolean| onFocus object| ID5 object| ats object| PublisherCommonId boolean| inDapIF boolean| inGptIF object| dicnf object| viewReq function| vu object| _icesc number| infolinks_pid object| regeneratorRuntime object| ox_esp object| criteo_syncframe_state object| criteo_pubtag object| criteo_identitytag_126 object| Criteo object| Criteo_identitytag_126 boolean| IL_INIT object| $iceboot object| INFOLINKS number| __google_lidar_ function| osdlfm number| __google_lidar_adblocks_count_ function| __google_lidar_radf_ function| _defineProperty function| _typeof object| iqscript number| $iceId function| lotameIsCompatible function| sync16589_c function| sync16589_d undefined| sync16589_e undefined| sync16589_f undefined| sync16589_g function| sync16589_h object| sync16589_j function| sync16589_k function| sync16589_l object| sync16589_ object| sync16589_la function| sync16589_a function| sync16589_b function| sync16589_i function| sync16589_m function| sync16589_n function| sync16589_o function| sync16589_p function| sync16589_aa function| sync16589_q function| sync16589_r function| sync16589_s function| sync16589_t function| sync16589_u function| sync16589_ba function| sync16589_ca function| sync16589_v function| sync16589_da function| sync16589_w function| sync16589_x function| sync16589_y function| sync16589_ea function| sync16589_z function| sync16589_A function| sync16589_B function| sync16589_C function| sync16589_D function| sync16589_E function| sync16589_F function| sync16589_G function| sync16589_H function| sync16589_I function| sync16589_fa function| sync16589_J function| sync16589_K function| sync16589_ga function| sync16589_ha function| sync16589_L function| sync16589_M function| sync16589_ia function| sync16589_ja function| sync16589_ka function| sync16589_N function| sync16589_O function| sync16589_P function| sync16589_Q function| sync16589_R function| sync16589_S function| sync16589_T function| sync16589_U function| sync16589_V function| sync16589_W function| sync16589_X function| sync16589_Z function| sync16589_Y function| sync16589__ function| sync16589_0 function| sync16589_1 function| sync16589_2 function| sync16589_4 function| sync16589_5 function| sync16589_ma function| sync16589_3 function| sync16589_7 function| sync16589_6 function| sync16589_na function| sync16589_8 function| sync16589_oa function| sync16589_9 function| sync16589_pa function| sync16589_$ function| sync16589_qa object| lotame_sync_16589 function| getIfbip function| hb_iceChunk object| hb_ice object| $ICE_HB object| _google_rum_ns_ function| mb function| Goog_AdSense_Lidar_sendVastEvent function| Goog_AdSense_Lidar_getViewability function| Goog_AdSense_Lidar_getUrlSignalsArray function| Goog_AdSense_Lidar_getUrlSignalsList object| module$contents$ima$CompanionAdSelectionSettings_CompanionAdSelectionSettings object| module$contents$ima$AdsRenderingSettings_AdsRenderingSettings object| ima object| module$contents$ima$AdCuePoints_AdCuePoints object| module$contents$ima$AdError_AdError object| module$contents$ima$AdErrorEvent_AdErrorEvent object| module$contents$ima$AdEvent_AdEvent object| module$contents$ima$AdsManagerLoadedEvent_AdsManagerLoadedEvent object| google function| ILVideo function| cnxAddEventListener

239 Cookies

Domain/Path Name / Value
www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected Name: ntvSession
Value: {}
www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected Name: logglytrackingsession
Value: c611cb7f-87fe-415c-be5a-71c6c194ae4e
.mrtnsvr.com/sync Name: userId
Value: 6GCOCGpaM
.3lift.com/sync Name: sync
Value: CgoIoQEQi8bP86YwCgoIgQIQi8bP86YwCgoI4gEQi8bP86YwCgoI5gEQi8bP86YwCgoIhwIQi8bP86YwCgkICRCLxs_zpjAKCQg6EIvGz_OmMAoJCAsQi8bP86YwCgoIjAIQi8bP86YwCgkIXxCLxs_zpjA=
i.liadm.com/s Name: _li_ss
Value: MgYI0gEQ6RIyCQj_____BxD3Eg
.bleepingcomputer.com/ Name: session_id
Value: 97b9e0fc3a9b5cf4d54e819ec9d7e46f
www.bleepingcomputer.com/ Name: lav
Value: 14472
www.bleepingcomputer.com/ Name: __atuvc
Value: 1%7C31
www.bleepingcomputer.com/ Name: __atuvs
Value: 62ed2bfc5fe0d047000
www.bleepingcomputer.com/ Name: fsbotchecked
Value: true
.addthis.com/ Name: ouid
Value: 62ed2bfc0001aa1ba0940c8ddb0ffa0c7df67f4097a13eecceca
.addthis.com/ Name: di2
Value: aVSpW#%!k#$M`#!AgP2TIPv7LW6Lj6Hq#4(X#34Q#1:R#19w
.addthis.com/ Name: um
Value: j.'2022080514410015100336890890'
.addthis.com/ Name: uid
Value: 62ed2bfc58984d3b
.addthis.com/ Name: na_id
Value: 2022080514410015100336890890
.addthis.com/ Name: vc
Value: 2
.bleepingcomputer.com/ Name: _ga_GD465VRQLD
Value: GS1.1.1659710460.1.0.1659710460.0
.bleepingcomputer.com/ Name: _ga
Value: GA1.2.1170813820.1659710460
.bleepingcomputer.com/ Name: _gid
Value: GA1.2.1788668596.1659710460
.bleepingcomputer.com/ Name: _gat_gtag_UA_91740_1
Value: 1
.addthis.com/ Name: uvc
Value: 1%7C31
cdn.firstimpression.io/ Name: OAID
Value: b3d2c4a5ca92ad2819b824f65ca37d48
capi.connatix.com/ Name: cnx_userId
Value: 933fd47c58244ca6a52cbcf58f42109f
.addthis.com/ Name: loc
Value: MDAwMDBOQUNBUUMyMjU1MTA2NDQ2MjAwMDBDSA==
www.bleepingcomputer.com/ Name: cnx_userId
Value: 933fd47c58244ca6a52cbcf58f42109f
.scorecardresearch.com/ Name: UID
Value: 161546972ef88c5e25fad8d1659710460
www.bleepingcomputer.com/ Name: _fssid
Value: 90448ff4-fdeb-4bed-a793-a0e248b1152b&utm_source=newsletter&utm_medium=email&utm_campaign=Fw%20Italian%20Internal%20Revenue%20Service%20Breached%20Audius%20Hacked%20PrestaShop%20Zero-Day%20Flaw&utm_term=2022-08-05
.reddit.com/ Name: csv
Value: 2
.adnxs.com/ Name: uuid2
Value: 2739567155738641687
.ctnsnet.com/ Name: cid_5cfe8a2639f640e5b1695c208dac0136
Value: 1
.adsrvr.org/ Name: TDID
Value: 5e1b1e00-4929-4a58-9799-282bf9b88b13
.bleepingcomputer.com/ Name: __gpi
Value: UID=000006ba7b1a7bdf:T=1659710460:RT=1659710460:S=ALNI_MZ_TG2a_LrNVBJcmyUeRoGOW0_43w
.casalemedia.com/ Name: CMID
Value: Yu0r-GZu4dfEMT1ZXkpk7AAA
.casalemedia.com/ Name: CMPS
Value: 140
.casalemedia.com/ Name: CMPRO
Value: 140
.spotxchange.com/ Name: audience
Value: 9ff5e893-14cc-11ed-a211-1e3873bf0203
.springserve.com/ Name: ssid
Value: 30adb6a2-20cc-47a9-849b-2e4c2578d2ff
.springserve.com/ Name: sst
Value: 1659710460903
.bidr.io/ Name: bito
Value: AABCo07F2lgAABCPtU3Fvw
.bidr.io/ Name: bitoIsSecure
Value: ok
www.bleepingcomputer.com/ Name: _pbjs_userid_consent_data
Value: 3524755945110770
.bleepingcomputer.com/ Name: cookie
Value: bff5912f-3c7f-4e16-9d16-a4165c5ab4b0
.rubiconproject.com/ Name: khaos
Value: L6GKR815-T-8KOJ
.sharethrough.com/ Name: stx_user_id
Value: 4c80c7a3-6d1f-4dd4-acc8-e868d31a6624
.openx.net/ Name: i
Value: 8858e032-51bc-449f-8837-1ad8afd14ac4|1659710461
.quantserve.com/ Name: mc
Value: 62ed2bfd-6e7a0-81e96-a9c3f
.bleepingcomputer.com/ Name: __qca
Value: P0-790958859-1659710461411
.postrelease.com/ Name: visitor
Value: dd31867c-6418-41ee-a987-e71c2b6b8bca
www.bleepingcomputer.com/ Name: _ntv_uid
Value: dd31867c-6418-41ee-a987-e71c2b6b8bca
.yahoo.com/ Name: A3
Value: d=AQABBP0r7WICEG1rDhAM7HJ4wns3qJyjqaEFEgEBAQF97mL3YgAAAAAA_eMAAA&S=AQAAArNy9YqxeVW0NpYuKSggK0A
www.bleepingcomputer.com/ Name: _lr_geo_location
Value: CA
.deployads.com/ Name: d7s_uid
Value: rg5csd1tcc0x
.pub.network/ Name: _fsuid
Value: 3bca9bb6-975c-44fa-ba76-73f932a13403
.adnxs.com/ Name: icu
Value: ChgIodc0EAoYASABKAEw_de0lwY4AUABSAEKGAi98loQChgBIAEoATD817SXBjgBQAFIARD917SXBhgB
.id5-sync.com/ Name: id5
Value: e3e55e84-b767-4f5c-821f-c0a5e91e8309#1659710461942#1
.bleepingcomputer.com/ Name: __gads
Value: ID=835553f923e6e3e0-223edfd6acd4005a:T=1659710460:S=ALNI_MYNr0G4fKGbu1U96qpvTCzZlfquOA
.doubleclick.net/ Name: IDE
Value: AHWqTUlu2_4Yeaz-ZsBQP8cPllv9rAsQU8Ve_SN_CSTlS_A4w0KiPz6VOGETq2ANJo0
.criteo.com/ Name: uid
Value: bf233d43-c5a0-435a-a69f-8266f03c4e1a
.infolinks.com/ Name: cuid
Value: fcc31345-e707-4a86-89ae-6ca63cf6247f
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~Yu0r-gAENBckxgA0
.bleepingcomputer.com/ Name: lotame_domain_check
Value: bleepingcomputer.com
.openx.net/ Name: univ_id
Value: 537072971|5e1b1e00-4929-4a58-9799-282bf9b88b13|1659710462414551
.amazon-adsystem.com/ Name: ad-id
Value: A4xwBpDHYUtBr9VxD13z6Bc
.amazon-adsystem.com/ Name: ad-privacy
Value: 0
.3lift.com/ Name: tluid
Value: 4526249851231332969674
.360yield.com/ Name: tuuid
Value: 3c0f15ce-8eea-410e-b543-893a366e7f9d
.360yield.com/ Name: tuuid_lu
Value: 1659710462
.infolinks.com/ Name: ANUSERCOOKIE
Value: 2739567155738641687
.infolinks.com/ Name: OXUSERCOOKIE
Value: 7063fdfa-ebef-4ce4-932e-e5c23351dcac
.tynt.com/ Name: uid
Value: SaOgzmLtK/6jrA/BVA/tfQ==
.postrelease.com/ Name: status
Value: 1
.postrelease.com/ Name: ver
Value: 1
.zemanta.com/ Name: zuid
Value: jTKicE_GJ9EQ0uhYWhcr
.intentiq.com/ Name: IQver
Value: 1.9
.intentiq.com/ Name: intentIQCDate
Value: 1659710462554
.infolinks.com/ Name: TPLSERCOOKIE
Value: 4526249851231332969674
.infolinks.com/ Name: VRUSERCOOKIE
Value: y-XfMAf1hE2uFXgX1lXrm6Q.5N3nduaJ3oehpLkx0-~A
.pubmatic.com/ Name: KADUSERCOOKIE
Value: 52C108B0-611A-4584-A232-D339F84A7A29
.contextweb.com/ Name: V
Value: Qjuqd5zMsyOS
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: 8329d94842b5919a
.lijit.com/ Name: ljtrtbexp
Value: eJyrVjI0U7IyNDMzsDQyMDAz0lGyMEblmxoYGKKKGBqg8o3MIXxjQ1MjM6NaALJXEIE%3D
.lijit.com/ Name: ljt_reader
Value: FGHRhPZHXp7Ir1doSteX52FA
.infolinks.com/ Name: IXUSERCOOKIE
Value: Yu0r-GZu4dfEMT1ZXkpk7AAA&140
.yieldmo.com/ Name: yieldmo_id
Value: g777f76d8ca4bf6562c5%7C1659710462626%7C0%7C
.infolinks.com/ Name: IMDUSERCOOKIE
Value: 3c0f15ce-8eea-410e-b543-893a366e7f9d
.simpli.fi/ Name: suid
Value: ADE529A5AF7E4EC0BD84D098CEDEE4E8
.crwdcntrl.net/ Name: _cc_cc
Value: ctst
.infolinks.com/ Name: SOVRNUSERCOOKIE
Value: FGHRhPZHXp7Ir1doSteX52FA
.33across.com/ Name: 33x_ps
Value: u%3D117854800278182%3As1%3D1659710462731%3Ats%3D1659710462731
.bidswitch.net/ Name: tuuid
Value: cf57a75d-4f5e-49b9-b35a-536b2987624c
.bidswitch.net/ Name: c
Value: 1659710462
.bidswitch.net/ Name: tuuid_lu
Value: 1659710462
.sitescout.com/ Name: ssi
Value: 677e4d26-958e-4cc1-b03f-f3c95336b02d#1659710462749
.w55c.net/ Name: wfivefivec
Value: fYkDlbmh1OjYvA5
.infolinks.com/ Name: OUTHUSERCOOKIE
Value: y-PWSL87RE2uGK26blnBCsq2vu5MyjQIet~A
.bfmio.com/ Name: __106_cid
Value: 5e1b1e00-4929-4a58-9799-282bf9b88b13
.bfmio.com/ Name: __io_cid
Value: 5e1b1e00-4929-4a58-9799-282bf9b88b13
.ads.yieldmo.com/ Name: ptrt
Value: 5e1b1e00-4929-4a58-9799-282bf9b88b13
.lijit.com/ Name: _ljtrtb_27
Value: 5e1b1e00-4929-4a58-9799-282bf9b88b13
.sundaysky.com/ Name: sskyu
Value: d6.b25b5b9e55d14e60b452d4f769bb00e9
.sundaysky.com/ Name: sskyCreationTime
Value: 1659710462788
.mathtag.com/ Name: uuid
Value: 3d9b62ed-2bff-4400-97d4-14b35df0617d
.bttrack.com/ Name: GLOBALID
Value: 2uKlc8-sIBd987FnJwfFZuL_Bw8HXyv-9nA4HYrKIUMIRkJtCPbG1_rImZ2o4_VVJGr2KqIfqJQC4TM1
.lijit.com/ Name: _ljtrtb_10
Value: 1797288115146808421
.w55c.net/ Name: matchcasale
Value: 5
sync.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-ebf5eb08-9193-42a5-4fc5-5ad4f16a3ba0.XZlpOGMv6neA7azMCF5jU9hjn8JFhAIqS60kP0DejRU
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3A6_XrCJGTQqVPxVrU8Wo7oJU4mbM.I2YiXXNJTfzesE4ZID8xLeXVTudiRTlTzCD54tshc4s
.infolinks.com/ Name: ZMNUSERCOOKIE
Value: GZWay77ga066zVKhv2Jj
.bfmio.com/ Name: __187_cid
Value: 6GCOCGpaM
.mfadsrvr.com/ Name: tuuid
Value: 6d33763a-bcfb-43c0-8f79-5c0c6a498cb9
.mfadsrvr.com/ Name: c
Value: 1659710462
.mfadsrvr.com/ Name: tuuid_lu
Value: 1659710462
.infolinks.com/ Name: 33AUSERCOOKIE
Value: 2278742228126
.sundaysky.com/ Name: sskya
Value: "e2JmOnt0czoiM2Z3ZTRlIix0OiJuaSJ9fQ=="
.infolinks.com/ Name: ZTUSERCOOKIE
Value: 1797288115146808422
.bfmio.com/ Name: __172_cid
Value: 6_XrCJGTQqVPxVrU8Wo7oJU4mbM
.intentiq.com/ Name: intentIQ
Value: 81Dwmi4JAK
.bfmio.com/ Name: __147_cid
Value: d6.b25b5b9e55d14e60b452d4f769bb00e9
.contextweb.com/ Name: pb_rtb_ev
Value: 3-1fcx|2N.0.AAADKPn7AX7OtANm4FZhAAAAAAA|3oy.0|4is.0.CAESEDnhnNckMBR8zwGZusKjj3o|7TY.0
.admixer.net/ Name: am-uid
Value: 70192a28055842dbbc24a64288fe5dd7
.cpx.to/ Name: cpSess
Value: 4ae7714e81a4147c
.cpx.to/ Name: dsp_app_nexus
Value: 2739567155738641687#1659710462857
.smartadserver.com/ Name: pid
Value: 1063148059880476994
.ads.yieldmo.com/ Name: ptrmf
Value: 6d33763a-bcfb-43c0-8f79-5c0c6a498cb9
.ads.yieldmo.com/ Name: ptreps
Value: AAADKPn7AX7OtwMQet6pAAAAAAA
.turn.com/ Name: uid
Value: 3305665001870070297
.bfmio.com/ Name: __169_cid
Value: 3089492219756286489
.intentiq.com/ Name: CSDT
Value: UEQ6MTUwMTlfMCZURGVCeGJm
.intentiq.com/ Name: ASDT
Value: 0
.intentiq.com/ Name: IQPData
Value: 2503514547#1659710462916#0#1659710462916
.infolinks.com/ Name: PUBMUSERCOOKIE
Value: 52C108B0-611A-4584-A232-D339F84A7A29
.bfmio.com/ Name: __157_cid
Value: y-ckmjeWBE2pI1NHQJpXW4LYcjh2egbfsA1CcthmIV6A--~A
.tapad.com/ Name: TapAd_TS
Value: 1659710463028
.tapad.com/ Name: TapAd_DID
Value: 922f411c-87a1-4cd3-9a9c-aaee6eaa8133
.lijit.com/ Name: ljtrtb
Value: eJwNysENgEAIBMBeeEvCIshiN5KcTRh713nPI15ySi4MlplGe2tcSe3qVqfP3UMOdtkE9l9Ul5NAIg4awyHvB1qEEB4%3D
.lijit.com/ Name: _ljtrtb_83
Value: L6GKR815-T-8KOJ
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value: 1!5222
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005%22%7D
.infolinks.com/ Name: R1USERCOOKIE
Value: RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&f768eed5-116b-4628-8dfd-ee55bda2f9ac"
.linkedin.com/ Name: lidc
Value: "b=OGST02:s=O:r=O:a=O:p=O:g=2729:u=1:x=1:i=1659710463:t=1659796863:v=2:sig=AQHUpafSNe6zPyEfbiZ42E93_kgxb89b"
.bfmio.com/ Name: __bfio_sync
Value: D971938BBF4C912C88DD3EBC660254DD
.mathtag.com/ Name: mt_mop
Value: 4:1659710464
beacon.lynx.cognitivlabs.com/ Name: UID
Value: b704875c-2b1f-4567-aeb4-363cf99265a0
beacon.lynx.cognitivlabs.com/ Name: ss
Value: Bh%2FPAuxPsLIePNosECRkItahESvvodpgkIcC3hHaAjzTYkSkC6Sh%2BlLhjJHL79FJPy1DX2%2FTgkBhGsXAlAcsVQ%3D%3D
cs.chocolateplatform.com/ Name: choco_cookie
Value: cp-47b29d1053eb47df45981a04e468c5bc
.adnxs.com/ Name: anj
Value: dTM7k!M41.D>6NRF']wIg2Hb6nX6-E!@wnfH8K6pQK`!5=E<*L5?%M/.C5(?69=v#j4sqkfR__j0e/N:8gV+YUOe5z%nugO%v4VB%nlg7)`_ra
.adotmob.com/ Name: uid
Value: 07fa220407856ba7fed99db8
.adotmob.com/ Name: uuid
Value: 07fa220407856ba7fed99db8
.adotmob.com/ Name: partners
Value: IX%3A1659710464216
www.bleepingcomputer.com/ Name: _lr_retry_request
Value: true
www.bleepingcomputer.com/ Name: _lr_env_src_ats
Value: false
.ads.pubmatic.com/ Name: KCCH
Value: YES
.tynt.com/ Name: pids
Value: %5B%7B%22p%22%3A%22af668bdd51%22%2C%22f%22%3A1%2C%22ts%22%3A1659710464819%7D%2C%7B%22p%22%3A%223bfd58deb3%22%2C%22f%22%3A1%2C%22ts%22%3A1659710464819%7D%2C%7B%22p%22%3A%22029cc11ae7%22%2C%22f%22%3A1%2C%22ts%22%3A1659710464819%7D%2C%7B%22p%22%3A%227daaa56bb0%22%2C%22f%22%3A1%2C%22ts%22%3A1659710462549%7D%2C%7B%22p%22%3A%227912d88d74%22%2C%22f%22%3A1%2C%22ts%22%3A1659710464819%7D%2C%7B%22p%22%3A%2224c05c7b76%22%2C%22f%22%3A1%2C%22ts%22%3A1659710462549%7D%2C%7B%22p%22%3A%22bac1bc34e2%22%2C%22f%22%3A1%2C%22ts%22%3A1659710462549%7D%2C%7B%22p%22%3A%22d26852f088%22%2C%22f%22%3A1%2C%22ts%22%3A1659710462549%7D%2C%7B%22p%22%3A%2222833ea406%22%2C%22f%22%3A1%2C%22ts%22%3A1659710462549%7D%2C%7B%22p%22%3A%225cb91279ed%22%2C%22f%22%3A1%2C%22ts%22%3A1659710464819%7D%2C%7B%22p%22%3A%22f9a4a8fd15%22%2C%22f%22%3A1%2C%22ts%22%3A1659710462549%7D%2C%7B%22p%22%3A%22008c314e8f%22%2C%22f%22%3A1%2C%22ts%22%3A1659710464819%7D%5D
.pubmatic.com/ Name: DPSync3
Value: 1660867200%3A201_197%7C1660262400%3A164%7C1659744000%3A174
.media.net/ Name: visitor-id
Value: 3027120641454728000V10
.pubmatic.com/ Name: KRTBCOOKIE_80
Value: 22987-CAESEJFHW0DnIkRIkugAM465Eh4&KRTB&16514-CAESEJFHW0DnIkRIkugAM465Eh4&KRTB&23025-CAESEJFHW0DnIkRIkugAM465Eh4&KRTB&23386-CAESEJFHW0DnIkRIkugAM465Eh4
c.deployads.com/ Name: d7s_dc
Value: 44pubmb52C108B0-611A-4584-A232-D339F84A7A29q
.bing.com/ Name: MUID
Value: 30639349C76860B6369D82BEC6EF61FF
.c.bing.com/ Name: MR
Value: 0
.pubmatic.com/ Name: KRTBCOOKIE_218
Value: 4056-Yu0r-gAENBckxgA0&KRTB&22978-Yu0r-gAENBckxgA0&KRTB&23194-Yu0r-gAENBckxgA0&KRTB&23209-Yu0r-gAENBckxgA0
.pubmatic.com/ Name: KRTBCOOKIE_27
Value: 16735-uid:3d9b62ed-2bff-4400-97d4-14b35df0617d&KRTB&16736-uid:3d9b62ed-2bff-4400-97d4-14b35df0617d&KRTB&23019-uid:3d9b62ed-2bff-4400-97d4-14b35df0617d&KRTB&23208-uid:3d9b62ed-2bff-4400-97d4-14b35df0617d
.linkedin.com/ Name: li_sugr
Value: acd100cd-9f14-4234-ad6e-0c82957994d0
.openx.net/ Name: pd
Value: v2|1659710462.2|iKvMgakWgy.g6mmfYbwn8uYvPmKvJeShEgKwrg2f8vuoqvRwike
.adform.net/ Name: C
Value: 1
.deepintent.com/ Name: CDIUSER
Value: di_88a365179ee04600b9fd3
.bleepingcomputer.com/ Name: cto_bundle
Value: FN4hK19XMEJDdCUyQjBLNXdGJTJGeERFNk9XMVUwTzFVQzJZeXJSejNkaUNRT1BjN1BWWk1tVGxLc1BzVnlRenh3TW9IUkolMkZLZ2RXMVhMcjdBQVRwT0xXejhVc0JqdENXQ29nRk50ZUtyblJ5ckxoQm83TUk0Q2RhUFdsd0ZIVXM0RktJTWY0RnMyMlptT2xpTXpaUktwcFh5aVpORmRXTXl2cjAyTGJlMSUyQlpHZWJRRXhuNCUzRA
.bleepingcomputer.com/ Name: cto_bidid
Value: b9iQW19KUEFXRlVBQTY5UmMxZDZvMVFUYnZWZ3cxQlRnUktDUkNHbFp4OSUyRkZMc0lWQzZxMG5Ja2lTVE81S3NWdUU4QVpjQzh2bURQSTlwNU9Yc3pBbThGOGdYNWZBUDNxSyUyQnd5SUtCbTZEUzRRVSUyQjJuNEw1M3VSeE5iRkwyUm45ZERKQQ
.w55c.net/ Name: matchmedianet
Value: 5
.adsrvr.org/ Name: TDCPM
Value: CAESFAoFdGFwYWQSCwjK18bd0b77OhAFEhYKB3N2eDl0NTASCwj6hfft0b77OhAFEhcKCHB1Ym1hdGljEgsIzuO17tG--zoQBRgBIAEoAjILCMC5g5zovvs6EAU4AVoHOG0zM3prNGAC
.adform.net/ Name: uid
Value: 1339413300440423216
.pubmatic.com/ Name: KRTBCOOKIE_377
Value: 6810-5e1b1e00-4929-4a58-9799-282bf9b88b13&KRTB&22918-5e1b1e00-4929-4a58-9799-282bf9b88b13&KRTB&22926-5e1b1e00-4929-4a58-9799-282bf9b88b13&KRTB&23031-5e1b1e00-4929-4a58-9799-282bf9b88b13
.ipredictive.com/ Name: cu
Value: 52c14264-5a43-426b-bee4-a3fcf6f47bcd|1659710464963
.pubmatic.com/ Name: KRTBCOOKIE_22
Value: 14911-3305665001870070297&KRTB&23150-3305665001870070297
.pubmatic.com/ Name: KRTBCOOKIE_148
Value: 19421-uid:ADE529A5AF7E4EC0BD84D098CEDEE4E8
.mfadsrvr.com/ Name: ssh
Value: !medianet,1659710464!yieldmo,1659710462
.rlcdn.com/ Name: pxrc
Value: CPzXtJcGEgUI6AcQABIFCOhHEAQSBgiQvCsQAg==
.casalemedia.com/ Name: CMRUM3
Value: 4962ed2bfe05a0&0562ed2bfe05a00&2e62ed2bfe27602739567155738641687&0d62ed2c00276007fa220407856ba7fed99db8&5862ed2bfe2760Yu0r-gAENBckxgA0&4062ed2c0005a0&f162ed2bfe05a0&8262ed2c00a8c0&c362ed2bfe2760av-4eabf8d8-ed30-4315-9f9e-4cd80da18c86&2762ed2bfe27605e1b1e00-4929-4a58-9799-282bf9b88b13&6f62ed2c0005a0&2f62ed2bfe2760fYkDlbmh1OjYvA5&0462ed2bfe27603305665001870070297&2d62ed2bff05a0CAESEGOuU3crHOa3YpqFdRUe8Sg&7b62ed2c0005a0&5162ed2c0005a0&8362ed2c0005a0&0362ed2bfe27605b3662ed-2bfe-4400-8a13-d2fbbcb60e53&e662ed2bfe2760&9c62ed2bfe2760060b4244-ee38-489d-b7ed-1a0a44b9f67a&4162ed2c0005a0&ce62ed2c0005a0
.casalemedia.com/ Name: CMST
Value: Yu0r-mLtLAAA
.pubmatic.com/ Name: pi
Value: 0:3
.rlcdn.com/ Name: rlas3
Value: Trf+5SF+kZB5soywkbWPKuiIFaADmfLpk9vly9p4X04=
.pippio.com/ Name: didts
Value: 1659710465
.pippio.com/ Name: nnls
Value:
.media.net/ Name: data-rk
Value: 1797288115146808421~~8
.pippio.com/ Name: did
Value: vUBCF2dk3_PA27th
.quantserve.com/ Name: d
Value: EEMBEwHkJoqsMK67gQA
.sitescout.com/ Name: _ssuma
Value: eyIyNCI6MTY1OTcxMDQ2NTAzNCwiMyI6MTY1OTcxMDQ2NDg4OSwiNDgiOjE2NTk3MTA0NjI4MDQsIjM5IjoxNjU5NzEwNDYyODA0LCI3IjoxNjU5NzEwNDYyODA0fQ
.media.net/ Name: data-g
Value: CAESEFgMg3usawxqdfA6VaByDpo~~8
.media.net/ Name: data-ttd
Value: 5e1b1e00-4929-4a58-9799-282bf9b88b13~~1
.analytics.yahoo.com/ Name: IDSYNC
Value: "192u~26f2:175w~26f2:18za~26f2"
.media.net/ Name: data-tam
Value: setstatuscode~~35
.pubmatic.com/ Name: SPugT
Value: 1659710465
.fg8dgt.com/ Name: tuuid
Value: 746fa3a7-1e1f-4377-a42d-1e8b819f2547
.fg8dgt.com/ Name: c
Value: 1659710465
.fg8dgt.com/ Name: tuuid_lu
Value: 1659710465
.w55c.net/ Name: matchopenx
Value: 5
.media.net/ Name: data-xu
Value: fYkDlbmh1OjYvA5~~8
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAAADvEyGtoZmppbmhgYmZkbmK-igXBNzUwMwcAG6Mq3iAAAAA
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAAAOMSNjS3NDeysDA0NDU0MbMwsDAxMhTiM9RNN8h1L0v0zjE01U0CAKtBSPklAAAA
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAAAOMSNjS3NDeysDA0NDU0MbMwsDAxMhTiM9RNN8h1L0v0zjE01U0CAKtBSPklAAAA
.liadm.com/ Name: lidid
Value: d0f383f5-f9f1-47d2-96c8-c7af8c030420
.media.net/ Name: data-o
Value: 93d8b6f4-533b-4188-b1ae-ac5e7919ebe5~~8
.media.net/ Name: data-mm
Value: 3d9b62ed-2bff-4400-97d4-14b35df0617d~~8
.media.net/ Name: data-mf
Value: 6d33763a-bcfb-43c0-8f79-5c0c6a498cb9~~1
.technoratimedia.com/ Name: tads_uid
Value: 2CCFD23426C14CFEA3E35E48E80B07E4
.technoratimedia.com/ Name: tads_uid_cd
Value: 20220805104105-0400
.technoratimedia.com/ Name: tads_zora
Value: 2
.technoratimedia.com/ Name: tads_uidp_73
Value: AABCo07F2lgAABCPtU3Fvw
.dotomi.com/ Name: DotomiTest
Value: 44d15bf32c1a08e4
.pswec.com/ Name: tuuid
Value: 73f090ab-bdec-4945-8da9-a0da1a2d146b
.pswec.com/ Name: c
Value: 1659710465
.pswec.com/ Name: tuuid_lu
Value: 1659710465
.rubiconproject.com/ Name: audit
Value: 1|mFVHqHkj5bHwwn20S8Pxxu1WuCoMxA8a+JUixCbOKdq1qvqujlplhBnUkPr6AtUAVS4LSz3wVNcfBYRBeRcCfxh/6qRlWSa6aNgdOVL2Yy+ZLSzkyHji57KpUjWTmmg0
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005%22%7D
.agkn.com/ Name: ab
Value: 0001%3AAVQCjN0I2Sdj5tGIlAuWV3J%2FZLbw87k1
.pippio.com/ Name: pxrc
Value: CIHYtJcGEgQIAhAAEgYI7OsBEAA=
.adsymptotic.com/ Name: U
Value: f4afa80c45c1ed9c138786b2ab937a45
.media.net/ Name: data-co
Value: AAADKVTuFEs4ugNmwCf-AAAAAAA~~8
.media.net/ Name: data-ze
Value: jTKicE_GJ9EQ0uhYWhcr~~8
.linksynergy.com/ Name: icts
Value: 2022-08-05T14:41:05Z
.linksynergy.com/ Name: rmuid
Value: ebe91ff2-a33a-4611-a642-90ff34fac4c9
.media.net/ Name: data-r
Value: L6GKR815-T-8KOJ~~1
.media.net/ Name: data-c
Value: bf233d43-c5a0-435a-a69f-8266f03c4e1a~~1
.media.net/ Name: data-c-ts
Value: 1659710465
.media.net/ Name: data-r1
Value: RX-ae383cc1-4aec-472a-93ad-a48dcc3d101e-005~~8
.tribalfusion.com/ Name: ANON_ID
Value: a4nr6iSZdIiiSTnMSYlN7Zdd6SnfpgXZafYPxUSmnitgk7OwEkQqoCm11w0rLPGOpUQJuZbQOrhX
.media.net/ Name: data-bs
Value: cf57a75d-4f5e-49b9-b35a-536b2987624c~~1
.casalemedia.com/ Name: CMTS
Value: 139
.mookie1.com/ Name: id
Value: 10596055133603141835
.mookie1.com/ Name: mdata
Value: 1|10596055133603141835|1659710465343
.mookie1.com/ Name: ov
Value: e538c0d57063e1904b254f044cd1dbc2
.mookie1.com/ Name: syncdata_TAP
Value: 1
.mookie1.com/ Name: syncdata_NEU
Value: 1
.pubmatic.com/ Name: KRTBCOOKIE_699
Value: 22727-AABCo07F2lgAABCPtU3Fvw
.pubmatic.com/ Name: PugT
Value: 1659710465
.pubmatic.com/ Name: SyncRTB3
Value: 1660867200%3A166_7_71_220_54_21_22_13_178%7C1660262400%3A223_2
.pubmatic.com/ Name: ipc
Value: 0^^1^0
.pubmatic.com/ Name: chkChromeAb67Sec
Value: 8

17 Console Messages

Source Level URL
Text
security error URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Message:
Refused to execute script from 'https://id.rlcdn.com/1000.gif?memo=CIq8KxoNCPzXtJcGEgUI6AcQAEIASiA5MzNmZDQ3YzU4MjQ0Y2E2YTUyY2JjZjU4ZjQyMTA5Zg' because its MIME type ('image/gif') is not executable.
javascript warning URL: https://cd.connatix.com/connatix.playspace.js
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://vpaid.springserve.com/production/vpaid_6d8da985.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://cd.connatix.com/connatix.playspace.js
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://vpaid.springserve.com/production/vpaid_6d8da985.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080101.js(Line 5)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080101.js(Line 5)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network error URL: https://ib.adnxs.com/&https://ads.yieldmo.com/v000/sync?userid=2739567155738641687&pn_id=an
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network error URL: https://s0.2mdn.net/pagead/js/r20220803/r20110914/client/qs_click_protection_fy2021.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://s0.2mdn.net/pagead/js/r20220803/r20110914/client/window_focus_fy2021.js
Message:
Failed to load resource: the server responded with a status of 404 ()
javascript error URL: https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/?utm_source=newsletter&utm_medium=email&utm_term=2022-08-05&utm_campaign=Fw+Italian+Internal+Revenue+Service+Breached+Audius+Hacked+PrestaShop+Zero-Day+Flaw
Message:
Access to XMLHttpRequest at 'https://api.rlcdn.com/api/identity/envelope?pid=106' from origin 'https://www.bleepingcomputer.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://api.rlcdn.com/api/identity/envelope?pid=106
Message:
Failed to load resource: net::ERR_FAILED
network error URL: https://s0.2mdn.net/sadbundle/14586128274924466605/undefinedwdz6kj
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests;
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

123a2100834ae971547f5f25bc6644f9.safeframe.googlesyndication.com
33across-match.dotomi.com
a.pub.network
a.tribalfusion.com
aa.agkn.com
aax-eu.amazon-adsystem.com
acdn.adnxs.com
ad-delivery.net
ad.360yield.com
ad.doubleclick.net
ad.mrtnsvr.com
ad.turn.com
ad4m.at
ads.pubmatic.com
ads.yahoo.com
ads.yieldmo.com
adservice.google.ca
adservice.google.com
amazon-tam-match.dotomi.com
aorta.clickagy.com
ap.lijit.com
api-public.addthis.com
api.floors.dev
api.intentiq.com
api.rlcdn.com
as-sec.casalemedia.com
ats.rlcdn.com
b1sync.zemanta.com
bcp.crwdcntrl.net
beacon.lynx.cognitivlabs.com
bh.contextweb.com
bidder.criteo.com
btloader.com
btlr.sharethrough.com
bttrack.com
c.amazon-adsystem.com
c.bing.com
c.deployads.com
c.pub.network
c1.adform.net
c21lg-d.media.net
c2shb.pubgw.yahoo.com
c2shb.ssp.yahoo.com
capi-tier-1-us-east-2.connatix.com
capi.connatix.com
casale-match.dotomi.com
cd.connatix.com
cdn.firstimpression.io
cdn.id5-sync.com
cdn.indexww.com
cdn.jsdelivr.net
cds.connatix.com
ce.lijit.com
cks.connatix.com
cm.g.doubleclick.net
cms-xch-chicago.33across.com
confiant-integrations.global.ssl.fastly.net
contextual.media.net
cs.chocolateplatform.com
cs.media.net
d.pub.network
d.turn.com
data.adsrvr.org
de.tynt.com
dis.criteo.com
dsum-sec.casalemedia.com
dsum.casalemedia.com
eb2.3lift.com
ecdn.analysis.fi
ecdn.firstimpression.io
ejyazl.clicks.mlsend.com
eu-u.openx.net
eus.rubiconproject.com
events-ssc.33across.com
fastlane.rubiconproject.com
firstimpression-d.openx.net
fonts.googleapis.com
fonts.gstatic.com
freestar-d.openx.net
freestar-io.videoplayerhub.com
geo.privacymanager.io
google-bidout-d.openx.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
grid.bidswitch.net
gum.criteo.com
hb.emxdgt.com
hbopenbid.pubmatic.com
hbx.media.net
hde.tynt.com
htlb.casalemedia.com
i.ctnsnet.com
i.liadm.com
i.w55c.net
i6.liadm.com
ib.adnxs.com
id.crwdcntrl.net
id.rlcdn.com
id5-sync.com
idsync.rlcdn.com
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
image8.pubmatic.com
imasdk.googleapis.com
img.connatix.com
ins.connatix.com
inv-nets.admixer.net
jadserve.postrelease.com
js-sec.indexww.com
lb.eu-1-id5-sync.com
m.addthis.com
m.fg8dgt.com
match.adsrvr.org
match.deepintent.com
match.prod.bidr.io
match.sharethrough.com
medianet-match.dotomi.com
mug.criteo.com
nep.advangelists.com
oa.openxcdn.net
oajs.openx.net
odr.mookie1.com
onetag-sys.com
p.adsymptotic.com
p.rfihub.com
pagead2.googlesyndication.com
partner.googleadservices.com
pghub.io
pippio.com
pixel-eu.rubiconproject.com
pixel-sync.sitescout.com
pixel-us-east.rubiconproject.com
pixel.advertising.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.tapad.com
pm.w55c.net
pr-bh.ybp.yahoo.com
prebid.media.net
pulsepoint-match.dotomi.com
px.ads.linkedin.com
r.casalemedia.com
resources.infolinks.com
router.infolinks.com
rt3055.infolinks.com
rtb.adentifi.com
rtb.mfadsrvr.com
rtb.openx.net
rules.quantcount.com
s.amazon-adsystem.com
s.cpx.to
s.ntv.io
s.tribalfusion.com
s0.2mdn.net
s7.addthis.com
s9.addthis.com
sb.scorecardresearch.com
secure-assets.rubiconproject.com
secure.adnxs.com
secure.cdn.fastclick.net
secure.quantserve.com
securepubads.g.doubleclick.net
simage2.pubmatic.com
simage4.pubmatic.com
ssbsync-us.smartadserver.com
ssbsync.smartadserver.com
ssc-cms.33across.com
ssc.33across.com
ssum-sec.casalemedia.com
ssum.casalemedia.com
stags.bluekai.com
static.cloudflareinsights.com
static.criteo.net
sync-amz.ads.yieldmo.com
sync-tm.everesttech.net
sync.1rx.io
sync.adotmob.com
sync.bfmio.com
sync.crwdcntrl.net
sync.go.sonobi.com
sync.inmobi.com
sync.intentiq.com
sync.ipredictive.com
sync.mathtag.com
sync.search.spotxchange.com
sync.srv.stackadapt.com
sync.targeting.unrulymedia.com
sync.technoratimedia.com
sync1.intentiq.com
t.pswec.com
tags.bluekai.com
tags.crwdcntrl.net
tags.rd.linksynergy.com
tlx.3lift.com
token.rubiconproject.com
tpc.googlesyndication.com
tv.springserve.com
u.openx.net
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
v1.addthisedge.com
vid.connatix.com
vop.sundaysky.com
vpaid.springserve.com
widgets.outbrain.com
www.bleepingcomputer.com
www.bleepstatic.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.reddit.com
x.bidswitch.net
yieldmo-match.dotomi.com
z.moatads.com
ap.lijit.com
api.rlcdn.com
bcp.crwdcntrl.net
capi-tier-1-us-east-2.connatix.com
fastlane.rubiconproject.com
firstimpression-d.openx.net
googleads.g.doubleclick.net
hb.emxdgt.com
htlb.casalemedia.com
ib.adnxs.com
id.crwdcntrl.net
imasdk.googleapis.com
s7.addthis.com
sync.crwdcntrl.net
sync.go.sonobi.com
sync.inmobi.com
token.rubiconproject.com
104.18.101.194
104.18.18.126
104.18.19.126
104.20.60.209
104.26.13.6
104.36.115.114
104.36.115.98
107.178.246.49
107.178.254.65
108.138.106.4
108.138.106.5
108.138.106.62
108.138.109.24
108.138.128.34
108.138.128.44
108.139.29.15
141.95.98.71
142.250.64.66
142.251.40.162
142.251.40.166
150.136.156.92
151.101.1.194
151.101.193.108
151.101.193.140
151.101.194.137
151.101.194.49
151.101.66.137
159.203.145.121
162.19.138.120
169.197.150.7
172.66.41.9
18.211.160.120
18.215.195.104
184.29.128.213
184.29.129.105
184.29.129.187
184.29.129.7
184.29.129.81
184.50.205.90
185.167.164.42
192.132.33.46
192.35.249.127
198.148.27.140
199.127.204.142
199.187.193.181
199.187.193.182
199.38.167.128
2001:4998:14:800::1001
204.62.13.72
207.198.113.90
209.54.182.161
213.19.162.90
216.200.232.253
23.1.200.83
23.205.72.10
23.208.216.126
23.21.31.186
23.217.153.125
23.3.125.24
23.41.168.23
23.92.190.69
2600:1f13:d60:4f01:bbc5:ac74:cf42:940a
2600:1f18:444a:4602:377c:45e6:1b19:7050
2600:9000:2209:8c00:15:6f6c:b180:93a1
2600:9000:2209:f800:6:44e3:f8c0:93a1
2602:803:c002:200::42
2606:4700:10::6816:3456
2606:4700:20::681a:18b
2606:4700:20::681a:246
2606:4700:20::681a:68b
2606:4700:20::681a:832
2606:4700:20::ac43:4a81
2606:4700:4400::6812:230b
2606:4700:440e::6812:2fe6
2606:4700::6810:5614
2606:4700::6811:6bef
2606:4700::6812:c4c
2606:ae80:1471:15::440
2607:f8b0:4006:806::2002
2607:f8b0:4006:806::2003
2607:f8b0:4006:809::2002
2607:f8b0:4006:80b::200e
2607:f8b0:4006:80c::2002
2607:f8b0:4006:80e::2006
2607:f8b0:4006:817::2001
2607:f8b0:4006:81d::2002
2607:f8b0:4006:81f::2002
2607:f8b0:4006:820::2003
2607:f8b0:4006:820::200a
2607:f8b0:4006:822::2004
2607:f8b0:4006:822::200a
2607:f8b0:4006:824::2008
2620:100:a001::4
2620:100:a001::c
2620:112:f002:bbbb::21
2620:112:f002:bbbb::23
2620:116:800b:21:b08a:1dc5:659b:4055
2620:1ec:21::14
2620:1ec:c11::200
3.128.4.146
3.142.67.21
3.143.83.164
3.225.208.56
3.230.217.116
3.66.208.67
3.82.84.88
34.102.146.192
34.102.163.6
34.107.148.139
34.117.239.71
34.120.135.53
34.149.20.76
34.195.22.64
34.197.236.209
34.225.50.230
34.236.83.94
34.252.120.220
34.98.64.218
34.98.67.3
35.186.193.173
35.186.253.211
35.190.60.146
35.190.90.30
35.201.71.192
35.207.24.140
35.211.141.197
35.211.165.199
35.211.178.172
35.227.238.208
35.241.45.217
35.244.159.8
35.71.139.29
51.222.39.185
52.201.176.252
52.205.90.144
52.223.40.198
52.45.33.138
52.54.63.203
52.72.103.54
52.85.61.114
52.85.61.52
52.85.61.71
52.95.126.160
54.146.59.225
54.157.83.177
54.161.197.14
54.198.77.107
54.211.243.57
54.225.229.70
54.235.126.54
54.85.233.220
54.86.39.214
63.251.86.49
64.202.112.63
67.202.105.21
67.202.105.31
68.67.160.24
68.67.160.75
74.119.119.129
74.119.119.139
74.119.119.150
75.126.248.142
8.28.7.81
8.28.7.82
8.28.7.83
8.28.7.84
8.43.72.97
8.43.72.98
0097b607cce4ec29775d373d089aa50748d1fbfea8c986021a6c53c9457e0b4b
00a6c0c3e96c824b25ca0e2d5a7f85e3ca4714536cfc035789c37888bb815f04
01bc51916b803898564983636aed4d2f8bcfb541fe04e1bdfa475a5c18e93731
04028504c7003cf18134266f76d7f0330d55d9c0579aa9455fde0bd623531e5e
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
055891de2cb3e91b122490bc2b957d63e5b17c3240cae769b9e8f6f53a327b5c
069c73a8f36f81eadecc1bed9ada8543673a36531a9d52097151128b53356eb8
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
094b946adc39ade08f6d927ea066c8fef3ba6ee5c12919873172315ef7428e92
0b03c4e89b248daeb0c2ed482fb6c31e6c2863e9dc0eb650b65a38b7367e9513
0b37f3d8aa5e1f298bf71477c945f576745020ce44f048ec67e19a93cd285372
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0f427d0f88a0698c955ff63bf13af4ca80c9b32f218b5e210847450da901a74f
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d
16af933f9846ccea77bac90bbfbc9d807b0bdb047f6d7439ca8d866375581b3f
179d24471f149868157b3b0ab265d6cc20c30f0e395d84dc1ca558185d6776ad
17dbb476b9e2ac4cd30bc27ff21cd2d44a4d2d188dcc9dfcc7b151e20d9c89bc
184634ee0cb092f99cb59c4921367ab539bae35944cf9caf4a478d36799399eb
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1
19db4a2cde712e2ceaac317e732b4ec40b62818a938a8bf8391ad68470845019
1b6dfbc0392b3e04e6f10a39a7c097635148b6bc998c13ffbda40d5b3df488c8
1d352797c9473d7a0f0d88d182633330a8a7058a68cd6c052a8a2e2e6ffba4e4
1e78c1b27c45c2639fbe39bc1c1cd3c730e063e84eeff35361267f732ed132a5
1f42b6c9dab0b73174621c0daba5d82d4f2d841fed05a3784952e660b13fb78b
2066e0bd2557cb00d97d2711dddc4ffa570565502da087043cfaa0f0a3b2b218
22e977346d45bab9f531ce1132d7ecfbe8e46868eaea790a0d4dcd1d0649d74b
23a6e592e1c5016418efbfc51f5a01c3a3fb579c39a6dc516f386339a9b1deea
27f794b49afca139ace5946f462e5beab9c56e63069fdcad147354d77e4b2cd1
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
29dddfd258fe3a296e8d4500931e721cee78cae5125898935948c5a44171f5ea
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2aa6077f3885e767739ccfd37a74f1ad23ddfdd830580c70cb1706459f5c216a
2bc3adfe623c9caac41c12e0f43d04be7388404647669c823041250b6ab5f81c
2c87952cc1c23627496c7874271042bdb6af21efdf7cbf36ec4d98e6cec34d04
2d133a459f387f3b40062c6d4c300ba6bb2ae97b51d2ab3a6f9529f947f71a1f
2e97486781680e1c848b5637488ea6e1b3932856cd77e1724da79206c7238d84
31cd7d9398307ca2e6cfaa111bbe7b69d69cbaaed2ff74034412ebc5008671fd
32ca9c7e0e2a6157b7de311cff19c1549eeb9aae9a1735e5f885b44db5acd31d
32e73e8e0eec3e6c1345d84e7ef091b90e71fb0045814043b34c914156235eb9
33b843f4d668565995a11eb3880a71ba19f7df315dda2cd861a41f0d2caa776c
33eb81af8a0101c1ad2a210f322fb362ce1598e6e37f0a7ecc62d6ff39add590
354e06318502869bd84903e585a0025c6f19b415bffe50f7add86efb992d015e
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
37e4253e392190e641fe31178e0da5ff17fa01824f5869a35e173ee52be4a5ec
3944260a019167894c628f2f937b1288fe4ed83c10afd0152b9af3f7d5e8c29f
3c20e2a596aedf731d02b9bcd07cfb16b1c7361b61c0835de994fb8a4086454c
3c86cbaf4650545c3e3bee0af35466103862b44986a2f8b55ab43a7ff0562ebd
3c8a8f4d7fc689c26598752a7d8413962509ec55d6f906f49380c653c3a90e54
3d34b2f2e02c7937501dd51255ee7900c9ec823f07b3d8d0fc19c5e242058cf9
3d510e16e6e569e573980fd67a55221795d539fd56688ecaca8d284255e86ee6
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
407905d396003842527dfe340373240e6a3e1ba08d256c2b0f0daef77286a5df
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44e833e054136b4163bd18444c416d74b45a16e5f63525695c2f0fdc5b12f4e2
45ee3b2409a4a573217d9cfda3544824c61cc2db05814b64e74aac8facdd4265
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4901b094a91ea6d5aba73774bb9803fdca22599cfca597ef81249225b5ed01b4
4a2f02cf72af07f9d20ff148aeed0c8e46b1c55d269203e1fdbb73ee2d01267e
4b05d7f4339a505c65d2fcb1b21addd2a13a0c155ddf7ca766d1e7203b2b6cae
4b1efabc6698442d98298ab29ed5e00e8deec2dd8e58d6c0cda4b5396c4b514b
4b47d637db7fc8c910e1c276ef28b2905e55de8bfe8ad585a5f16dd2a1ce884b
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d312294a06982e0377c120ec4264047c63fcb56b327468835938bcc8f144ece
4d604890c12b74a21be13d586a57279d86ac84d5dd498fad33d440d03713f850
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e51341a20800a9009f155ae20c835a27f844c085b5c03daef420ecd548ad668
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
52b5e20e4eecedfc9de4511e2ec933f8c18a263418beae1b86b07141ddd89cc5
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54d48ce61e8a34b10a7664b5df1391be4d8d5b9569fa316a1c6d99bf0ddd4468
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
56fdff270381c058502252316f4b8b4a5f0bfa2acedf8f60523a11b4bb836da7
58e9be9056f29021130a164e95e3dffa1a2dba08eaa4f9983ec25a3016d1a947
58f0acb066d020ca6caff4b7bff42a2def03c2b365c7972937c48feeb10e9de8
5b139ee2287a60520cb2d9c079572424c81275ec251e7fb206b3cb74dedb0a09
5b3dfc6ccf10c5c7f91ed47799416e50f266fb560ef1f428f075b2efb822aa66
5dfa0078c5b54df5233dd27554bf415c57a641563bf65f581ff8411c57518908
5e18eb52350b579d188ce7635a9f6dc75626b5ff9a1b551dafcff90218a849e9
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6395e6f9f6fbcd953f0ffa40615094c565d86c265fb5028e64dd2dc872b5ce69
647b443d5e7289157070e2648fcecdefac8bd6c19acb58d2e21cd526b683dcfc
649fc78f0d874b4e2e7cde4d0ee7255fe6c6a8ed2e909566752e4ac82d7abd03
65e8cd6177664d41cf8ce26c9bc6c1cf1313f1e5c81a969446c5fc05b6540e06
67d86a29de7993fbd23b7dde2c4f26bdc434055c35a4b08c830c0d02fcfa6dd2
68261b285e56b4116386f06f7c0ed12539d900472e7798ff87574ad133c8d0b7
6944932614fd1731a3fb07e467418396dcc63bc507372a6568583cbafd1ea67b
6b6f602a8c6dd1b64fb70f7b5b98518cf67688b20bdd24e63d60ac1f9eedcb9e
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d23d10111755a12c87198df1c71cce449de31eca9643030c6327a2157f9bd86
6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11
6dacb50615cee383aa9774f9ebcdaf300566aa2bc06589533992c971ffaf8d09
6e86593083facba2710a2312f26bd7b436d7ef299f99cbc2ccc1b32693ec3144
6ff0c935db4bafb846e7301df9b53f97f1d434a67a84dd9587633e9359d01b3a
70fbc2bab5280ce8aa1b20c58a0df76cfaff01701e7f99f5216a986714955f5d
70fd869f92915eb3c9f85d2d2b5a473ba45239ae463b35267642335337c46f06
715c6cb849c389191d344d3ba6604c4131cf3ea43102bcaafcfb9213584f2227
77cfce49fc53e3b0f71b3b187f412685311d1a871a86899bbac5c42c75a95267
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7b48a74fa0f94d83ae6d60c772f5e7aa66e7be1b63ccf223ca14e34d3d7b0d22
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
7b90d309e5a23a082e9f2ad8f2dd3c24bc0f184cb951e33b0701076641e89f4b
7be08fa39b228a6d403237a8fb2be3078d3744e1ed3b325c50184172a2153767
7c42933014424dabb2256a0732a9f792559d26ba09a84308c278f52834522f9a
7ca9cc2f0dbf61b9ba6038feb1a9ea059366a6ed563cfb056b5e8e691a834322
7d6d26827b887aa09b2a5eb7c001e35b93773e53c36ddbfc127ad824e0a6ba39
7d9ea571c1c27d271ca98090aa5bea957a6b48e2e1ba33c607c0292c019e1e5f
7da91bcbdf161536ca58c1cdac36075d933ac89342fda8004db994842dc50ba3
7e262106f82cc52663e403f5b73795bbeab9ca0630c33c03579354fbcd4fae1e
827252be04765631f8ff21fee8ffe1028e27dfa52f62c08ef3182609a0a0e991
82ce13e2c820ee573b220031ab439c307af9c4c2370144a3d4636d32c53c5648
82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83d759db31ca45ecf1332034be2645e8b69e976313ea721cfb0d5a20022ec0c6
85ae9534729617e69eafa40195c7854697eb3d13b4205f3ee467e07c4af0a24b
85af3052d288ffd9157258dfe4daf5309f0b64d0067ab8221cd0c62909c18419
85b0bab835f1c9d35073860412074c375c341a1fc9f1f51e12b0931cc58438a0
86cce5a3c4670c786318309ad0e741b426b903f4e7d3d100e3b261472f72b7ac
8733e2183f16906b2fa2e58fdab82cf336f249ab71ac1b184470da2dd3c6e29f
87a82f5e6d9b41405d3c37aba538a38f9e87a6fedb79d1c6bd0034e8342e89fc
8a719dfbca2b4fc363e174b3f4e0f6ed16229e8bdcd22d6001d7d4411a8d86cd
8abfc24ad72c339c94d00068a378e6dd1cf4b255971ca75413c1366669105d1c
8bb82dd7a61884a5ea9526ea9eb65412156f2a80db6d6a647ba5d46d0c3ae3a4
8c44af787f51e875d3ecc44f5bb1989fce5aeeaa1a48cc0851aec4344b5e6d73
8e3a7c03d6e80eb066480affc9f6de10cd5385b021a4557144ddf46691c4cb74
8e8003ad291ba3bd8691f5b0754b18daa4f89147dd3f27f204c651cd8d5fbf8f
9180f589b3c6ace89b0d577f9bbc4d136d2fab3e2c19831caa0bd815f0702d83
942935ead42820e6c9184f099c77dde34fa4be70d395a17c47b5d7ad07967339
94c4cb2855f0ef44546259b2c956b69c6f7ede7652d670b39002c6a291a49dfa
956035a88a8424f2d36b292231cd4cd7ed705d412b47a7aa929f7b537196c1cb
95efc6a1b0e18636b608c1280049e1e31e5dac2f28c111ae489cea912f8b927b
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
99887c8a3e382dd055b9504a2141c52fd90fa929ebf16f39ba8526a2c7110362
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b275633d988ced8193909a8ac647af4e26e76c198af398fa90e9ce0128c2590
9cdb6bfef8d4212d9bf634ca6724a28e85dfa69cd404e6f9d3760d70a7873949
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a0581edfe4381f4bbfce9f2fcd46f64962abbaeed3b02ef87a0339297b728f83
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a25aecab67d35194b393545bb70a9910e9bd2ecac2d491d288f286839e6f4104
a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952
a4511cadf9003592e382be0d27b9dd174276653624d2a04ddee381cbc13a901c
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5910455615630589802ca15818aa163322871e6468f06a3660c53d6ab2936bb
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a7b5f5f96f81dea4efc53e1d4dae8b37c28bec27a45b42ccf604ee759e20caec
a8a100b8fe7f638e675253612230bd56a79c2fb3d5112360c505e72adb6a41c6
a8c21cfb9234d86cb9696ac8d13eb0ea8523e39271d4229349bb1636882c3f47
a8ce99d3ee0eaaa09a25f8a1a605e5f8b261b8d3fb0ce253471cea9078db1572
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
ab10cd1e4265908fcfe59de2620daec0e48fe88cab8ff0409f35b26339b28f28
ab2a8eb1386228b4a597ed6a7435b7038e38ffd2c6573523ddf557aad8243527
ab52a578c101a14bbc790f87f9a7400dda65469f23c6ce85c461e07cdf776460
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910
ae938820655d8afb2bcaac1a4c8e03cb464fd7cf04c3f4c9f9ce7917eae728c0
af1b8f7cfc50efd8c00554c463799bb14c246a4334f5f0f4222fd457ad325c72
af44d280920264564147250d0841eebf33288a04c932c182c06ec21600a228c2
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1c53b6a0b98361abf63f5687663d98245346d2ce21834665e1cf566cbbc3db2
b27e00c213fe0cd2eb76782e758d795349ecd28808fe41d5347527a4757b923a
b2bdac211f43fbee9eeb4d50f8755206599f76296cd15316a97c9d2cb2050d2f
b34676178982122b66b0a55d3ee411fa343b1d19a6c119c0c9b0ea2c892738a1
b51534cb26157816c7e911f832c303cdcd6188f22e0a82267ffd2c2e242f84b0
b828ff80281ac609c4118c36e6a5d076d64cfbd7833d06da92525d95239e20a6
b959860ce89107664ae76a8e671ddd7bb6144e05cf394fc12015208a00d7921c
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd8c49a688ffb9c7a2bee814769e58a5e2c0e3e1710c58571f51b092d5eacc35
bf27786b4381176350787d768bf5f7c5310ba640aa48ee98a3d2c310ddd971ab
bf9a6aaa5de75621eb5615f77d4bb2d3a5412eaa0aa540d14f42adbecac0c888
c005a7590a3e928eecba2e971960bce8ad11d75cac66b90a93820b5f2c6809b8
c01223e6eeba43391e1a50e0826166abf19fb19db960fc06264a8f45f119a08d
c13d034eaf2fa73680d0abdbe02ac23b73e3128b5c7f0ee7018eb7b3fbe84a72
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c2d924d5121ba5bf48cca12c37456c9e5f8e80ac340d8eb7cca76b828b527ff0
c5b078f88fcff1352aa7bbcef2c3524c7d23b254eed0492edf5200877d9c5ed4
c5ed3845c583e493c2325f69b4f77fdfbfcef499e85bf3e2568152f94a85c3b9
c697819e479ff298cad5834f13e71d3d543f6826537287c54958a7a8c37c5886
c836edd9ebc623383226ac4fadadf0f8f78b80e10dffaa17d4e849b35b40753b
c9bfbc2b802937d34983a32a97f9703769f7dc7a9ffebbe99e186aeb5141add1
ca22345f969dd8077c21281572a34d4a51bc6a5ad9d764bd1338b2c12a68c3e3
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
caaad167bdc9f23c7ca08c7ef87267f4d5856b4348008c55b4c4c6d4f37785a8
cb260fbfa3add6553864bf1c8dd753a45d7a1504b159c8aa6cbec89f9223a89d
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
cf019a1e03162a3ab267c3dc07d7eb9b1ddb76ce703755c49a7ca9edbd1d87db
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfac05f501d6d4d62e29fff1049569c3c2aa8732af8db3a36e8fa252f05f5861
d020fa6036628dd1d6dbf760edc742273359e93119832249bdce332d05d6db4d
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
d0b93c317eebe6c627afb454e7e0f8ac61be284b72294e285fa5075fe32eba70
d2b9fa207d3cadcfa01ca54f1f40350be3e0d1aaed7381ded622216c7d8972b7
d719b3d0205b7c6224af04234b243a2c7e0a8fb583eacc1b76501712e4b09de8
d7487dfbd9e3fb543f7cc23691fb51abf7a650da4c8e35e58794f259c7c2c968
d8a34aeacc4054bd4e119e538c7eb4956421014f48a9b603d3f9314a7435b5a6
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
d9a05a0f0ffaa6ab5ed560f61e1757a9d8e46d2b923f5dd091aed59d1b8f9812
db0a0e03b318eb33f68ca9ca7951341f6b0225c7f3dc6833c91baf14b01cd939
db89d7ba6f8614450b7f3e031e5993d7a1b67eb4fe69d828169af47d1d8f3f38
dc0aae23650aa076289af5ffb6d6710cb055add251e06549908396b44fb4f621
de317176fa6b64a8e89bbd45d20b6be2560bbfa96e7e53e63eb754e18bfe6c1f
e0c5b5e752cd2a0d348cc1602dc240770d1991a8015394a0044c703d8bc0e3b7
e17869a70ccc5de32555c6bcb36a29bc81694ad22d56fb59a55970f411e0e845
e184bca5250d746337a75e77cb6005b56adb74d4168bf016ba7768f19de85341
e2011bd80729e0cce877fec1ccbb08da0567f6da1aa08dc3ffcd17febabf3e1c
e30a952eadc89f735e92201acd81796193eebddb8926d345c6ce092126c9257a
e34982f0d74202dce676d2e74d3581d8543af1665f94350d85b4f8004f1a7324
e388b3b31d60f93c207eb0c3adf525a852c14b3da4c5d45a79ce4f2144885fb2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73
e496ae93d61efe7f675549e936856514d63b70a8a1f600f3f9c76f5828a67fba
e72a4d605e3d5af4047f1f34af4008981be221e0809e57805c6011c451f81c14
e812a1ff304fda278e8742be6a70d0e2f0f6008c15d0ebfdb864219c3046eab9
eafabf8ad63add70d4a78cc87f44f00d7fc515d5f66a7ea8fa6040416092b7b7
eb4a29554c161fc6298d26273c106770fbe6c66bff37bb0db2e7826a9f84cb4d
ebadeabe6c6c78e858bc32e90d4b3cd06739e65b12f3aea6ce7aba3cd0fa3385
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152
ee54b51af15f1f68f707da981f3c135c249a25e9293871e1e0cbd2c24c7b6117
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f12a472ffaefb1c6f2e58d33843428d73207563063b635923ea53745fd7cd017
f383c9d665701194066c208c394a1387bbc99a2350ef8995aa629ce298760e13
f4dd34536fb83f493b179bdd29aed9a4f6cb4e6150229ca506e576410e8080ad
f568ec43cbc7ea256cc5f1293bfa7c696bcc5483ccb9d6818c8d6021c4095888
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f8068094a8667a6909fb6be78a81faf80389fa3a64c279de04df85ab699f9b30
f85636282234e35cef17c5248247d5927bc09577261912c426b8a324278f371f
f8a52990bbe6892abb730d241570fbfbd2ff2fc707fdd3004c7dba6e843bbae3
fa07e7c14831ddfda77803fc361e569d7197c8b1e09f66fd01c8c69927b5fd2f
fc26d6046596f8492a0121c2dc9af463f49c9ce6af0c3b18e659555797215f4c
fcf98f11f5274728b6f7fbbd189704c82782214f6487e7df907c1d0d7ba360f6
fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505
fd573d81010f2f2538ee691ffb3ec04cb90644b412e464f2dd728295902c6cbc