urlscan.io logo urlscan.io
SecurityTrails logo

a.rfihub.com Open in urlscan Pro
193.0.160.128  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://a.rfihub.com/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks...
Effective URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroCli...
Submission: On July 07 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 25 IPs in 5 countries across 26 domains to perform 42 HTTP transactions. The main IP is 193.0.160.128, located in United States and belongs to ROCKETFUEL, US. The main domain is a.rfihub.com. The Cisco Umbrella rank of the primary domain is 3055.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 24th 2022. Valid for: a year.
This is the only time a.rfihub.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 7 193.0.160.128 54312 (ROCKETFUEL)
3 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:214... 16509 (AMAZON-02)
1 2 34.252.173.26 16509 (AMAZON-02)
1 13.32.121.37 16509 (AMAZON-02)
6 108.157.4.14 16509 (AMAZON-02)
2 2 142.250.186.98 15169 (GOOGLE)
1 2 185.89.210.46 29990 (ASN-APPNEX)
1 69.173.144.165 26667 (RUBICONPR...)
1 2 52.213.150.8 16509 (AMAZON-02)
1 3.121.27.153 16509 (AMAZON-02)
1 104.90.104.26 16625 (AKAMAI-AS)
1 35.156.69.34 16509 (AMAZON-02)
1 1 13.224.81.100 16509 (AMAZON-02)
2 35.244.174.68 15169 (GOOGLE)
1 54.227.219.230 14618 (AMAZON-AES)
1 2 104.18.19.126 13335 (CLOUDFLAR...)
1 104.90.192.27 16625 (AKAMAI-AS)
1 2 185.94.180.125 35220 (SPOTX-AMS)
1 2600:1f18:612... 14618 (AMAZON-AES)
1 35.156.83.159 16509 (AMAZON-02)
1 34.248.96.95 16509 (AMAZON-02)
1 2 18.157.156.229 16509 (AMAZON-02)
2 2 151.101.194.49 54113 (FASTLY)
2 172.217.16.134 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
2 142.251.36.130 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
42 25
7    193.0.160.128 (United States)

ASN54312 (ROCKETFUEL, US)
a.rfihub.com
p.rfihub.com
3    2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
1    2600:9000:214f:3400:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)
c1.rfihub.net
2    34.252.173.26 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-252-173-26.eu-west-1.compute.amazonaws.com
secure-us.imrworldwide.com
1    13.32.121.37 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-37.fra60.r.cloudfront.net
sb.scorecardresearch.com
6    108.157.4.14 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-14.dus51.r.cloudfront.net
choices.trustarc.com
2    142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net
cm.g.doubleclick.net
2    185.89.210.46 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
ib.adnxs.com
1    69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
2    52.213.150.8 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-150-8.eu-west-1.compute.amazonaws.com
dpm.demdex.net
1    3.121.27.153 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-121-27-153.eu-central-1.compute.amazonaws.com
ps.eyeota.net
1    104.90.104.26 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-90-104-26.deploy.static.akamaitechnologies.com
contextual.media.net
1    35.156.69.34 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-69-34.eu-central-1.compute.amazonaws.com
bs.serving-sys.com
1    13.224.81.100 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-81-100.man50.r.cloudfront.net
live.rezync.com
2    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
idsync.rlcdn.com
1    54.227.219.230 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-227-219-230.compute-1.amazonaws.com
bpi.rtactivate.com
2    104.18.19.126 (None, )

ASN13335 (CLOUDFLARENET, US)
dsum-sec.casalemedia.com
1    104.90.192.27 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-90-192-27.deploy.static.akamaitechnologies.com
x.dlx.addthis.com
2    185.94.180.125 (Amsterdam, Netherlands)

ASN35220 (SPOTX-AMS, US)
sync.search.spotxchange.com
1    2600:1f18:612b:4200:ebc6:a220:81c8:d770 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
partners.tremorhub.com
1    35.156.83.159 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-83-159.eu-central-1.compute.amazonaws.com
aa.agkn.com
1    34.248.96.95 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-96-95.eu-west-1.compute.amazonaws.com
beacon.krxd.net
2    18.157.156.229 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-157-156-229.eu-central-1.compute.amazonaws.com
x.bidswitch.net
2    151.101.194.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
2    172.217.16.134 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f134.1e100.net
ad.doubleclick.net
s0.2mdn.net
4    2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
2    142.251.36.130 (United States)

ASN15169 (GOOGLE, US)
PTR: prg03s12-in-f2.1e100.net
googleads4.g.doubleclick.net
2    2a00:1450:4001:829::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
Apex Domain
Subdomains		 Transfer
7 rfihub.com
a.rfihub.com — Cisco Umbrella Rank: 3055
p.rfihub.com — Cisco Umbrella Rank: 775
12 KB
6 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 120
tpc.googlesyndication.com — Cisco Umbrella Rank: 160
41 KB
6 trustarc.com
choices.trustarc.com — Cisco Umbrella Rank: 699
23 KB
5 doubleclick.net
cm.g.doubleclick.net — Cisco Umbrella Rank: 205
ad.doubleclick.net — Cisco Umbrella Rank: 189
googleads4.g.doubleclick.net — Cisco Umbrella Rank: 287
25 KB
3 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 179
72 KB
2 everesttech.net
sync-tm.everesttech.net — Cisco Umbrella Rank: 612
607 B
2 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 290
1 KB
2 spotxchange.com
sync.search.spotxchange.com — Cisco Umbrella Rank: 501
1 KB
2 casalemedia.com
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 608
2 KB
2 rlcdn.com
idsync.rlcdn.com — Cisco Umbrella Rank: 321
107 B
2 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 192
2 KB
2 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 244
2 KB
2 imrworldwide.com
secure-us.imrworldwide.com — Cisco Umbrella Rank: 1806
1 KB
1 2mdn.net
s0.2mdn.net — Cisco Umbrella Rank: 276
65 KB
1 krxd.net
beacon.krxd.net — Cisco Umbrella Rank: 457
337 B
1 agkn.com
aa.agkn.com — Cisco Umbrella Rank: 445
377 B
1 tremorhub.com
partners.tremorhub.com — Cisco Umbrella Rank: 888
183 B
1 addthis.com
x.dlx.addthis.com — Cisco Umbrella Rank: 1141
191 B
1 rtactivate.com
bpi.rtactivate.com — Cisco Umbrella Rank: 1822
109 B
1 rezync.com
live.rezync.com — Cisco Umbrella Rank: 1762
788 B
1 serving-sys.com
bs.serving-sys.com — Cisco Umbrella Rank: 1051
105 B
1 media.net
contextual.media.net — Cisco Umbrella Rank: 529
616 B
1 eyeota.net
ps.eyeota.net — Cisco Umbrella Rank: 976
344 B
1 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 336
239 B
1 scorecardresearch.com
sb.scorecardresearch.com — Cisco Umbrella Rank: 134
2 KB
1 rfihub.net
c1.rfihub.net — Cisco Umbrella Rank: 5238
6 KB
42 26
Domain Requested by
6 choices.trustarc.com a.rfihub.com
choices.trustarc.com
4 pagead2.googlesyndication.com ad.doubleclick.net
tpc.googlesyndication.com
a.rfihub.com
www.googletagservices.com
4 a.rfihub.com 1 redirects a.rfihub.com
3 p.rfihub.com 2 redirects a.rfihub.com
3 www.googletagservices.com a.rfihub.com
www.googletagservices.com
ad.doubleclick.net
2 tpc.googlesyndication.com ad.doubleclick.net
tpc.googlesyndication.com
2 googleads4.g.doubleclick.net ad.doubleclick.net
2 sync-tm.everesttech.net 2 redirects
2 x.bidswitch.net 1 redirects a.rfihub.com
2 sync.search.spotxchange.com 1 redirects a.rfihub.com
2 dsum-sec.casalemedia.com 1 redirects a.rfihub.com
2 idsync.rlcdn.com a.rfihub.com
2 dpm.demdex.net 1 redirects a.rfihub.com
2 ib.adnxs.com 1 redirects a.rfihub.com
2 cm.g.doubleclick.net 2 redirects
2 secure-us.imrworldwide.com 1 redirects a.rfihub.com
1 s0.2mdn.net a.rfihub.com
1 ad.doubleclick.net www.googletagservices.com
1 beacon.krxd.net a.rfihub.com
1 aa.agkn.com a.rfihub.com
1 partners.tremorhub.com a.rfihub.com
1 x.dlx.addthis.com a.rfihub.com
1 bpi.rtactivate.com a.rfihub.com
1 live.rezync.com 1 redirects
1 bs.serving-sys.com a.rfihub.com
1 contextual.media.net a.rfihub.com
1 ps.eyeota.net a.rfihub.com
1 pixel.rubiconproject.com a.rfihub.com
1 sb.scorecardresearch.com a.rfihub.com
1 c1.rfihub.net a.rfihub.com
42 30

This site contains links to these domains. Also see Links.

Domain
adclick.g.doubleclick.net
Subject Issuer Validity Valid
*.rfihub.com
Sectigo RSA Domain Validation Secure Server CA		 2022-05-24 -
2023-05-24		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-06-20 -
2022-09-12		 3 months crt.sh
*.rfihub.net
Amazon		 2021-12-29 -
2023-01-27		 a year crt.sh
*.scorecardresearch.com
Amazon		 2022-01-29 -
2023-02-27		 a year crt.sh
*.trustarc.com
Amazon		 2022-05-17 -
2023-06-15		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-03-08 -
2023-04-04		 a year crt.sh
*.media.net
DigiCert SHA2 Secure Server CA		 2022-02-20 -
2023-02-22		 a year crt.sh
bs.serving-sys.com
Amazon		 2022-04-10 -
2023-05-09		 a year crt.sh
rtactivate.com
Amazon		 2022-04-13 -
2023-05-12		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2022-02-03 -
2023-02-25		 a year crt.sh
odc-pixel-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2022-02-26 -
2023-03-01		 a year crt.sh
*.tremorhub.com
Amazon		 2022-03-24 -
2023-04-22		 a year crt.sh
*.agkn.com
RapidSSL RSA CA 2018		 2020-07-25 -
2022-09-18		 2 years crt.sh
beacon.krxd.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-11-03 -
2022-11-02		 a year crt.sh
*.doubleclick.net
GTS CA 1C3		 2022-06-06 -
2022-08-29		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2022-06-06 -
2022-08-29		 3 months crt.sh

This page contains 3 frames:

Primary Page: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Frame ID: 07088555BB2EBD61F9C9416842F0B823
Requests: 37 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: BD15FA4D1FBAF36CD7598DE5984E94E4
Requests: 3 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: BB44489C7EA52E1BF39B70036CF8DBD0
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://a.rfihub.com/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:fa... HTTP 302
    https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <(?:iframe|img)[^>]+adnxs\.(?:net|com)
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • (?:<a [^>]*href="[^/]*//[^/]*serving-sys\.com/|<img [^>]*src="[^/]*//[^/]*serving-sys\.com/)
  • serving-sys\.com/
Overall confidence: 100%
Detected patterns
  • <iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon
  • \.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon

Page Statistics

42
Requests

76 %
HTTPS

18 %
IPv6

26
Domains

30
Subdomains

25
IPs

5
Countries

250 kB
Transfer

524 kB
Size

27
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://a.rfihub.com/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1 HTTP 302
    https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-rocketfuel&cg=1975180286928526395&cc=1 HTTP 302
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-rocketfuel&cg=1975180286928526395&cc=1&ja=1
Request Chain 5
  • https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MTk3NTE4MDI4NjkyODUyNjM5NQ==&forward= HTTP 302
  • https://cm.g.doubleclick.net/pixel?in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MTk3NTE4MDI4NjkyODUyNjM5NQ==&forward=&google_tc= HTTP 302
  • https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESEM-tLFs3f_I2ccQsMWNxdlc&google_cver=1
Request Chain 6
  • https://ib.adnxs.com/setuid?entity=18&code=1975180286928526395 HTTP 307
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D1975180286928526395
Request Chain 8
  • https://dpm.demdex.net/ibs:dpid=1121&dpuuid=1975180286928526395&redir= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1975180286928526395&redir=
Request Chain 9
  • https://p.rfihub.com/cm?pub=24472&in=1 HTTP 302
  • https://ps.eyeota.net/match?uid=1975180286928526395&bid=omt9pi0
Request Chain 12
  • https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=1975180286928526395&referrer=https%3A%2F%2Fdecrypt.co%2Fnews HTTP 302
  • https://p.rfihub.com/cm?pub=39342&in=0&userid=741d97df-901f-4367-bb56-f06748ed3bd0%3A1657152141.76&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D741d97df-901f-4367-bb56-f06748ed3bd0%253A1657152141.76 HTTP 302
  • https://idsync.rlcdn.com/501709.gif?partner_uid=741d97df-901f-4367-bb56-f06748ed3bd0%3A1657152141.76
Request Chain 14
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1975180286928526395&forward= HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1975180286928526395&forward=&C=1
Request Chain 17
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1975180286928526395&img=1 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1975180286928526395&img=1&__user_check__=1&sync_id=12f2fb83-fd88-11ec-95cf-1d21b9eb0106
Request Chain 21
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=1975180286928526395&expires=30 HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=1975180286928526395&expires=30
Request Chain 22
  • https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=YsYijQAOO7Y0VAAj HTTP 302
  • https://p.rfihub.com/cm?in=1&pub=21653&userid=YsYijQAOO7Y0VAAj&_test=YsYijQAOO7Y0VAAj

42 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request adr.html
a.rfihub.com/sr/
Redirect Chain
  • http://a.rfihub.com/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.c...
  • https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfih...
6 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
cfc0956e607d9e002a80dac0444ad4597ed16a0fb8cd5527121ae017f0643491

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache
Content-Length
5717
Content-Type
text/html;charset=utf-8
Date
Thu, 07 Jul 2022 00:02:21 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server
Jetty(9.3.29.v20201019)

Redirect headers

Content-Length
0
Date
Thu, 07 Jul 2022 00:02:21 GMT
Location
https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
dcmads.js
www.googletagservices.com/dcm/ 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2a40641661b54c304ebe64ce944b1261fd061962a6f2b86558f3b3d98237ca0a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 06 Jul 2022 23:11:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3040
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8749
x-xss-protection
0
last-modified
Wed, 29 Jun 2022 21:33:10 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Thu, 07 Jul 2022 00:11:41 GMT
bcS.js
c1.rfihub.net/js/ 		18 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c1.rfihub.net/js/bcS.js
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:3400:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
ef6c9aaf36bcf57fd7fd87c21ddfbff8bdaa6da3bfa9a35e1b2fc4e90bdfe756

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 06 Jul 2022 23:54:48 GMT
content-encoding
gzip
last-modified
Wed, 06 Jul 2022 23:54:38 GMT
server
Jetty(9.3.29.v20201019)
age
453
x-cache
Hit from cloudfront
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
via
1.1 6080b2713e502211e152f21f5c59c5a6.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
x-amz-cf-pop
FRA53-C1
content-type
application/x-javascript
content-length
5618
x-amz-cf-id
lV5iSSfSabcn_Hp5kBPxAFxHCYWD5Fo3x7kbyKzzx64nKrEzQaoEOA==
expires
Thu, 07 Jul 2022 00:54:48 GMT
m
secure-us.imrworldwide.com/cgi-bin/
Redirect Chain
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-rocketfuel&cg=1975180286928526395&cc=1
  • https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-rocketfuel&cg=1975180286928526395&cc=1&ja=1
44 B
596 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-rocketfuel&cg=1975180286928526395&cc=1&ja=1
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Server
34.252.173.26 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-252-173-26.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Jul 2022 00:02:21 GMT
server
nginx
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
cross-origin-resource-policy
cross-origin
accept-ch
Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
content-type
image/gif
content-length
44
expires
Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 07 Jul 2022 00:02:21 GMT
server
nginx
location
https://secure-us.imrworldwide.com/cgi-bin/m?ci=us-rocketfuel&cg=1975180286928526395&cc=1&ja=1
access-control-allow-methods
POST, OPTIONS
p3p
P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin
*
cache-control
no-cache
cross-origin-resource-policy
cross-origin
accept-ch
Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
content-length
0
expires
Thu, 01 Dec 1994 16:00:00 GMT
beacon.js
sb.scorecardresearch.com/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js?c1=8&c2=6820648&c3=1&c4=&c5=&c6=
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-37.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ee54b51af15f1f68f707da981f3c135c249a25e9293871e1e0cbd2c24c7b6117

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 06 Jul 2022 01:37:00 GMT
content-encoding
gzip
etag
W/"eaf85c1c6758e84acfe134efd70e9373"
last-modified
Tue, 28 Jun 2022 13:19:23 GMT
server
AmazonS3
age
80722
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 fd38301adb0ceb6cf6c42567f371a2f4.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-amz-cf-pop
FRA60-P1
x-amz-cf-id
3RnGYiO30YbcHcRol7IXJ2Srraw_MXawpJQpmFDBborOLsiqzvKEWA==
ca
choices.trustarc.com/ 		63 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?pid=zeta01&aid=zetaglobal01&cid=101619&c=ff544f78-39da-4942-8e22-fe31cbf264a9&w=160&h=600&plc=tr
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.157.4.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-157-4-14.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
f473a31050a4cbf3818845d0096d7396d89b8753b5b5d79443506b7de0768c69
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *; prefetch-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 00:02:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-amz-cf-pop
DUS51-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding, Origin
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
x-frame-options
SAMEORIGIN
expect-ct
max-age=31536000
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/javascript;charset=UTF-8
via
1.1 67b4a3e116ddb07b50403935474117c6.cloudfront.net (CloudFront)
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *; prefetch-src 'self' *;
x-amz-cf-id
T500ThMRszTD2rgGcyBq9ZvLSn8-C7TglfLJUg6L7WU_4jNDRTiFlQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cm
a.rfihub.com/
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MTk3NTE4MDI4NjkyODUyNjM5NQ==&forward=
  • https://cm.g.doubleclick.net/pixel?in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=MTk3NTE4MDI4NjkyODUyNjM5NQ==&forward=&google_tc=
  • https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESEM-tLFs3f_I2ccQsMWNxdlc&google_cver=1
42 B
1008 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESEM-tLFs3f_I2ccQsMWNxdlc&google_cver=1
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
HTTP/1.1
Server
193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Thu, 07 Jul 2022 00:02:21 GMT
Cache-Control
no-cache
Server
Jetty(9.3.29.v20201019)
Content-Type
image/gif
Content-Length
42
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Thu, 07 Jul 2022 00:02:21 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESEM-tLFs3f_I2ccQsMWNxdlc&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
311
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bounce
ib.adnxs.com/
Redirect Chain
  • https://ib.adnxs.com/setuid?entity=18&code=1975180286928526395
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D1975180286928526395
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D1975180286928526395
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
HTTP/1.1
Server
185.89.210.46 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 07 Jul 2022 00:02:21 GMT
X-Proxy-Origin
138.199.38.132; 138.199.38.132; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid
d57e0c10-115c-43a5-add0-e30edb6f46ba
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 07 Jul 2022 00:02:21 GMT
X-Proxy-Origin
138.199.38.132; 138.199.38.132; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid
ca82c240-030f-447a-a9ba-d45f885c4e90
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D18%26code%3D1975180286928526395
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
tap.php
pixel.rubiconproject.com/ 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=13490&nid=2596&put=1975180286928526395&
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
78e3bdce5107450057bade54d54a0a7e
Content-Type
image/gif
demconf.jpg
dpm.demdex.net/
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=1121&dpuuid=1975180286928526395&redir=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1975180286928526395&redir=
42 B
942 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1975180286928526395&redir=
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
HTTP/1.1
Server
52.213.150.8 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-213-150-8.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

DCS
dcs-prod-irl1-2-v036-023a167f8.edge-irl1.demdex.com 2 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
5nQp+lSSSDY=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-irl1-1-v036-0f118980a.edge-irl1.demdex.com 0 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
AtJvnoTQQ+c=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1975180286928526395&redir=
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
match
ps.eyeota.net/
Redirect Chain
  • https://p.rfihub.com/cm?pub=24472&in=1
  • https://ps.eyeota.net/match?uid=1975180286928526395&bid=omt9pi0
0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ps.eyeota.net/match?uid=1975180286928526395&bid=omt9pi0
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
HTTP/1.1
Server
3.121.27.153 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-121-27-153.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Thu, 07 Jul 2022 00:02:21 GMT
Content-Length
0
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location
https://ps.eyeota.net/match?uid=1975180286928526395&bid=omt9pi0
Date
Thu, 07 Jul 2022 00:02:21 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cksync.php
contextual.media.net/ 		45 B
616 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=3&type=rkt&ovsid=1975180286928526395
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.90.104.26 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-90-104-26.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
server
Apache
date
Thu, 07 Jul 2022 00:02:21 GMT
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control
max-age=0, no-cache, no-store
content-type
image/gif
content-length
45
x-mnet-hl2
E
expires
Thu, 07 Jul 2022 00:02:21 GMT
serving
bs.serving-sys.com/ 		0
105 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bs.serving-sys.com/serving?cn=um&dpid=12&rtu=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D17945%26userid%3D%5B%25tp_UserID%25%5D
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.156.69.34 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-69-34.eu-central-1.compute.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 00:02:21 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
content-length
0
p3p
CP="NOI DEVa OUR BUS UNI"
501709.gif
idsync.rlcdn.com/
Redirect Chain
  • https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=1975180286928526395&referrer=https%3A%2F%2Fdecrypt.co%2Fnews
  • https://p.rfihub.com/cm?pub=39342&in=0&userid=741d97df-901f-4367-bb56-f06748ed3bd0%3A1657152141.76&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D741d97df-901f-4367-bb56-f06748ed3bd0...
  • https://idsync.rlcdn.com/501709.gif?partner_uid=741d97df-901f-4367-bb56-f06748ed3bd0%3A1657152141.76
0
9 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/501709.gif?partner_uid=741d97df-901f-4367-bb56-f06748ed3bd0%3A1657152141.76
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H3
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 00:02:21 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0

Redirect headers

Location
https://idsync.rlcdn.com/501709.gif?partner_uid=741d97df-901f-4367-bb56-f06748ed3bd0%3A1657152141.76
Date
Thu, 07 Jul 2022 00:02:21 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
/
bpi.rtactivate.com/tag/ 		43 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bpi.rtactivate.com/tag/?id=11017&user_id=1975180286928526395
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.227.219.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-227-219-230.compute-1.amazonaws.com
Software
awselb/2.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 00:02:21 GMT
server
awselb/2.0
content-length
43
content-type
image/gif
rum
dsum-sec.casalemedia.com/
Redirect Chain
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1975180286928526395&forward=
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1975180286928526395&forward=&C=1
43 B
946 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=1975180286928526395&forward=&C=1
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H3
Server
104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

cf-ray
726c4f953ee79104-FRA
pragma
no-cache
date
Thu, 07 Jul 2022 00:02:21 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Osr7iQLnpha6JhpBYTXhmk4vYl2tqknvASrwWqmT0dD3Gs%2Byg%2BieQgW5gPJ50f48aVJ6FqsLDdIg5OxdS5d%2Bb%2B7EAmi%2BItd8PbUr5V03u1wu1ARIgPReT7Amuo5KC%2FDlsxnQUXGDSpshwg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
0

Redirect headers

pragma
no-cache
date
Thu, 07 Jul 2022 00:02:21 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vyfM2OYjWnUDz7CL6AMasVFlDrEY3ivC1HW5joo2rnIEqOpsPBcDJ1KGbTWDqCiG6Ih4TAX3iAu65%2Fv8Z3dlXimpwke93K%2FtnaeyNmVovtBboN6%2B0P3uvFNckOYcLB8XpXa2LHZp4s0eGA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location
/rum?cm_dsp_id=57&external_user_id=1975180286928526395&forward=&C=1
cache-control
no-cache
cf-ray
726c4f950a0b9001-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
expires
0
360947.gif
idsync.rlcdn.com/ 		0
98 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/360947.gif?partner_uid=1975180286928526395
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 00:02:21 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
rocketfuel_sync
x.dlx.addthis.com/e/ 		43 B
191 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.dlx.addthis.com/e/rocketfuel_sync?na_exid=1975180286928526395
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.90.192.27 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-90-192-27.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=2628000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Jul 2022 00:02:22 GMT
cache-control
max-age=0, no-cache, no-store
expires
Thu, 07 Jul 2022 00:02:22 GMT
content-length
43
strict-transport-security
max-age=2628000
content-type
image/gif
partner
sync.search.spotxchange.com/
Redirect Chain
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1975180286928526395&img=1
  • https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1975180286928526395&img=1&__user_check__=1&sync_id=12f2fb83-fd88-11ec-95cf-1d21b9eb0106
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.search.spotxchange.com/partner?adv_id=7180&uid=1975180286928526395&img=1&__user_check__=1&sync_id=12f2fb83-fd88-11ec-95cf-1d21b9eb0106
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
HTTP/1.1
Server
185.94.180.125 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Thu, 07 Jul 2022 00:02:21 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
25
Connection
keep-alive
Content-Length
43

Redirect headers

Date
Thu, 07 Jul 2022 00:02:21 GMT
Server
nginx
Location
/partner?adv_id=7180&uid=1975180286928526395&img=1&__user_check__=1&sync_id=12f2fb83-fd88-11ec-95cf-1d21b9eb0106
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
73
Connection
keep-alive
Content-Length
0
sync
partners.tremorhub.com/ 		43 B
183 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://partners.tremorhub.com/sync?UIRF=1975180286928526395&r=aN-Dqg68r4E8
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:612b:4200:ebc6:a220:81c8:d770 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 00:02:21 GMT
server
Apache-Coyote/1.1
p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type
image/gif
g.pixel
aa.agkn.com/adscores/ 		43 B
377 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9212192898&rf=1975180286928526395
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.156.83.159 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-156-83-159.eu-central-1.compute.amazonaws.com
Software
AAWebServer /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Jul 2022 00:02:21 GMT
server
AAWebServer
access-control-allow-methods
GET, POST, OPTIONS
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
access-control-allow-headers
accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length
43
expires
0
usermatch.gif
beacon.krxd.net/ 		0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?partner_id=rfuel&partner_user_id=1975180286928526395
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.248.96.95 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-248-96-95.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 00:02:21 GMT
cache-control
private, no-cache, no-store
x-request-time
D=48 t=1657152141
x-served-by
beacon-n008-dub-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
sync
x.bidswitch.net/ul_cb/
Redirect Chain
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=1975180286928526395&expires=30
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=1975180286928526395&expires=30
43 B
495 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=1975180286928526395&expires=30
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
HTTP/1.1
Server
18.157.156.229 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-157-156-229.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Thu, 07 Jul 2022 00:02:21 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=1975180286928526395&expires=30
Date
Thu, 07 Jul 2022 00:02:21 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
cm
p.rfihub.com/
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D
  • https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=YsYijQAOO7Y0VAAj
  • https://p.rfihub.com/cm?in=1&pub=21653&userid=YsYijQAOO7Y0VAAj&_test=YsYijQAOO7Y0VAAj
42 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.rfihub.com/cm?in=1&pub=21653&userid=YsYijQAOO7Y0VAAj&_test=YsYijQAOO7Y0VAAj
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
HTTP/1.1
Server
193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Thu, 07 Jul 2022 00:02:21 GMT
Cache-Control
no-cache
Server
Jetty(9.3.29.v20201019)
Content-Type
image/gif
Content-Length
42
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Thu, 07 Jul 2022 00:02:21 GMT
via
1.1 varnish
server
Varnish
x-timer
S1657152142.932429,VS0,VE0
x-served-by
cache-hhn4067-HHN
x-cache
HIT
location
https://p.rfihub.com/cm?in=1&pub=21653&userid=YsYijQAOO7Y0VAAj&_test=YsYijQAOO7Y0VAAj
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
impl_v90.js
www.googletagservices.com/dcm/ 		54 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v90.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
aafbe63767b52106445fc908e63387cf0c3064c6f9b9545d70b77b123f626cc6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://a.rfihub.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Mon, 04 Jul 2022 13:13:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
211748
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21331
x-xss-protection
0
last-modified
Mon, 27 Jun 2022 13:07:10 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 04 Jul 2023 13:13:13 GMT
B27793146.340177558;dc_ver=90.265;sz=160x600;u_sd=1;dc_adk=4042925164;ord=ouvle1;click=https%3A%2F%2Fa.rfihub.com%2Facs%2Fb%2Fc3Q9aHRtbCZhYT01MDM5NzQzLDEyMTU0OTA0NywyMjc1NTU3LDE4Mzk3MTI4OSwxNzMxNzM...
ad.doubleclick.net/ddm/adj/N1789332.3951609ZETA_DSP/ 		46 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N1789332.3951609ZETA_DSP/B27793146.340177558;dc_ver=90.265;sz=160x600;u_sd=1;dc_adk=4042925164;ord=ouvle1;click=https%3A%2F%2Fa.rfihub.com%2Facs%2Fb%2Fc3Q9aHRtbCZhYT01MDM5NzQzLDEyMTU0OTA0NywyMjc1NTU3LDE4Mzk3MTI4OSwxNzMxNzMsMTQwMjk3OCw1MTFlODI5NDc2Y2ZlOTljOWVkMzFmZTgxOTI0MGJjZSxwLDQzOTk5LDUyOTkxMSw1Njc2NTU5MSw0ODI1ODksMTIyNDI4OSZtdD0xJnJiPTM0NSZyZT0yMDc4NSZoY2k9JnV1aWQ9MTk3NTE4MDI4NjkyODUyNjM5NSZkaT0mZGM9MyZkaXNyYz0wJmJpcD0xMzguMTk5LjM4LjEzMiZkaWQ9dGlkXzE0MDI5Nzh8bWVkX3JlZ3VsYXImbGltcD0x%2Fn%2F;uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.;dc_rfl=0,https%3A%2F%2Fa.rfihub.com%2Fsr%2Fadr.html%3Fw%3D160%26h%3D600%26co%3Dsej%3Afalse%2Coptimize%3Afalse%2CserverId%3Asjc-152%2CnewUser%3Afalse%2CscoreMicroClicks%3A4%2CscoreMicroConversions%3A0%2CuV%3A967600%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Asjc-152.sjc-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1657120805517%2Cmt%3A1%2Cdid%3Atid_1402978%7Cmed_regular%2CexId%3A3043445387292664551%2Cuuid%3A1975180286928526395%2CdiSrc%3A0%2Cip%3A65.117.15.154%2Cfcc%3A3%2Cfd%3A3%2Cfaf%3A3%2Ctagid%3A24756072%2Csid%3A8438%2Cge%3A%26ep%3D1.609761%26ri%3D511e829476cfe99c9ed31fe819240bce%26rs%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26ai%3D5039743%26rt%3D1402978%26re%3D20785%26ug%3D%26pv%3D0%26ra%3D1208054820.5994256549716035%26rb%3D345%26ca%3D%26rc%3D%26rd%3D%26ua%3D%26ub%3D%26uc%3D%26ud%3D%26ue%3D%26pa%3Dppre1208054826486%26pb%3D%26pc%3D%26pd%3D%26pg%3D%26ct%3D1657120805482%26di%3D%26app%3D0%26pe%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26pf%3D%26sig%3D2147483615%2C805507055%26loc%3Dhttps%3A%2F%2Fdecrypt.co%2Chttps%3A%2F%2Fdecrypt.co%26dtv%3D1$0;xdt=0;crlt=wf5_mqoWc0;stc=1;chaa=1;sttr=23;prcl=s
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v90.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.134 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s06-in-f134.1e100.net
Software
cafe /
Resource Hash
a9123e40ac8adb5f4b3d86de03305d24b5a55e4603c2450c276ed3195cb22026
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://a.rfihub.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma
no-cache
date
Thu, 07 Jul 2022 00:02:21 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
23602
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ 		138 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1789332.3951609ZETA_DSP/B27793146.340177558;dc_ver=90.265;sz=160x600;u_sd=1;dc_adk=4042925164;ord=ouvle1;click=https%3A%2F%2Fa.rfihub.com%2Facs%2Fb%2Fc3Q9aHRtbCZhYT01MDM5NzQzLDEyMTU0OTA0NywyMjc1NTU3LDE4Mzk3MTI4OSwxNzMxNzMsMTQwMjk3OCw1MTFlODI5NDc2Y2ZlOTljOWVkMzFmZTgxOTI0MGJjZSxwLDQzOTk5LDUyOTkxMSw1Njc2NTU5MSw0ODI1ODksMTIyNDI4OSZtdD0xJnJiPTM0NSZyZT0yMDc4NSZoY2k9JnV1aWQ9MTk3NTE4MDI4NjkyODUyNjM5NSZkaT0mZGM9MyZkaXNyYz0wJmJpcD0xMzguMTk5LjM4LjEzMiZkaWQ9dGlkXzE0MDI5Nzh8bWVkX3JlZ3VsYXImbGltcD0x%2Fn%2F;uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.;dc_rfl=0,https%3A%2F%2Fa.rfihub.com%2Fsr%2Fadr.html%3Fw%3D160%26h%3D600%26co%3Dsej%3Afalse%2Coptimize%3Afalse%2CserverId%3Asjc-152%2CnewUser%3Afalse%2CscoreMicroClicks%3A4%2CscoreMicroConversions%3A0%2CuV%3A967600%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Asjc-152.sjc-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1657120805517%2Cmt%3A1%2Cdid%3Atid_1402978%7Cmed_regular%2CexId%3A3043445387292664551%2Cuuid%3A1975180286928526395%2CdiSrc%3A0%2Cip%3A65.117.15.154%2Cfcc%3A3%2Cfd%3A3%2Cfaf%3A3%2Ctagid%3A24756072%2Csid%3A8438%2Cge%3A%26ep%3D1.609761%26ri%3D511e829476cfe99c9ed31fe819240bce%26rs%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26ai%3D5039743%26rt%3D1402978%26re%3D20785%26ug%3D%26pv%3D0%26ra%3D1208054820.5994256549716035%26rb%3D345%26ca%3D%26rc%3D%26rd%3D%26ua%3D%26ub%3D%26uc%3D%26ud%3D%26ue%3D%26pa%3Dppre1208054826486%26pb%3D%26pc%3D%26pd%3D%26pg%3D%26ct%3D1657120805482%26di%3D%26app%3D0%26pe%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26pf%3D%26sig%3D2147483615%2C805507055%26loc%3Dhttps%3A%2F%2Fdecrypt.co%2Chttps%3A%2F%2Fdecrypt.co%26dtv%3D1$0;xdt=0;crlt=wf5_mqoWc0;stc=1;chaa=1;sttr=23;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 00:02:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43256
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1656329918998510"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 07 Jul 2022 00:02:21 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20220629/r20110914/elements/html/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20220629/r20110914/elements/html/omrhp.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1789332.3951609ZETA_DSP/B27793146.340177558;dc_ver=90.265;sz=160x600;u_sd=1;dc_adk=4042925164;ord=ouvle1;click=https%3A%2F%2Fa.rfihub.com%2Facs%2Fb%2Fc3Q9aHRtbCZhYT01MDM5NzQzLDEyMTU0OTA0NywyMjc1NTU3LDE4Mzk3MTI4OSwxNzMxNzMsMTQwMjk3OCw1MTFlODI5NDc2Y2ZlOTljOWVkMzFmZTgxOTI0MGJjZSxwLDQzOTk5LDUyOTkxMSw1Njc2NTU5MSw0ODI1ODksMTIyNDI4OSZtdD0xJnJiPTM0NSZyZT0yMDc4NSZoY2k9JnV1aWQ9MTk3NTE4MDI4NjkyODUyNjM5NSZkaT0mZGM9MyZkaXNyYz0wJmJpcD0xMzguMTk5LjM4LjEzMiZkaWQ9dGlkXzE0MDI5Nzh8bWVkX3JlZ3VsYXImbGltcD0x%2Fn%2F;uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.;dc_rfl=0,https%3A%2F%2Fa.rfihub.com%2Fsr%2Fadr.html%3Fw%3D160%26h%3D600%26co%3Dsej%3Afalse%2Coptimize%3Afalse%2CserverId%3Asjc-152%2CnewUser%3Afalse%2CscoreMicroClicks%3A4%2CscoreMicroConversions%3A0%2CuV%3A967600%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Asjc-152.sjc-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1657120805517%2Cmt%3A1%2Cdid%3Atid_1402978%7Cmed_regular%2CexId%3A3043445387292664551%2Cuuid%3A1975180286928526395%2CdiSrc%3A0%2Cip%3A65.117.15.154%2Cfcc%3A3%2Cfd%3A3%2Cfaf%3A3%2Ctagid%3A24756072%2Csid%3A8438%2Cge%3A%26ep%3D1.609761%26ri%3D511e829476cfe99c9ed31fe819240bce%26rs%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26ai%3D5039743%26rt%3D1402978%26re%3D20785%26ug%3D%26pv%3D0%26ra%3D1208054820.5994256549716035%26rb%3D345%26ca%3D%26rc%3D%26rd%3D%26ua%3D%26ub%3D%26uc%3D%26ud%3D%26ue%3D%26pa%3Dppre1208054826486%26pb%3D%26pc%3D%26pd%3D%26pg%3D%26ct%3D1657120805482%26di%3D%26app%3D0%26pe%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26pf%3D%26sig%3D2147483615%2C805507055%26loc%3Dhttps%3A%2F%2Fdecrypt.co%2Chttps%3A%2F%2Fdecrypt.co%26dtv%3D1$0;xdt=0;crlt=wf5_mqoWc0;stc=1;chaa=1;sttr=23;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 06 Jul 2022 22:46:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4563
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3159
x-xss-protection
0
server
cafe
etag
1394524276809619753
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 20 Jul 2022 22:46:18 GMT
view
googleads4.g.doubleclick.net/pcs/ 		0
575 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvvOP_et8dQ7KAGMYCsQa0NzmbUKZJ0F-Ax2DEnHmJBY6zcDMl5H4uwZ26pZsjEdLLHQHnYyS5tqx2yuk3uIoZGTcB7Hk7p0v684P83HaLWuvY6rpxceRVmZAV14zRI4ubLffd4SA&sig=Cg0ArKJSzNX4fqrzA8rHEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220629.41193&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1789332.3951609ZETA_DSP/B27793146.340177558;dc_ver=90.265;sz=160x600;u_sd=1;dc_adk=4042925164;ord=ouvle1;click=https%3A%2F%2Fa.rfihub.com%2Facs%2Fb%2Fc3Q9aHRtbCZhYT01MDM5NzQzLDEyMTU0OTA0NywyMjc1NTU3LDE4Mzk3MTI4OSwxNzMxNzMsMTQwMjk3OCw1MTFlODI5NDc2Y2ZlOTljOWVkMzFmZTgxOTI0MGJjZSxwLDQzOTk5LDUyOTkxMSw1Njc2NTU5MSw0ODI1ODksMTIyNDI4OSZtdD0xJnJiPTM0NSZyZT0yMDc4NSZoY2k9JnV1aWQ9MTk3NTE4MDI4NjkyODUyNjM5NSZkaT0mZGM9MyZkaXNyYz0wJmJpcD0xMzguMTk5LjM4LjEzMiZkaWQ9dGlkXzE0MDI5Nzh8bWVkX3JlZ3VsYXImbGltcD0x%2Fn%2F;uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.;dc_rfl=0,https%3A%2F%2Fa.rfihub.com%2Fsr%2Fadr.html%3Fw%3D160%26h%3D600%26co%3Dsej%3Afalse%2Coptimize%3Afalse%2CserverId%3Asjc-152%2CnewUser%3Afalse%2CscoreMicroClicks%3A4%2CscoreMicroConversions%3A0%2CuV%3A967600%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Asjc-152.sjc-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1657120805517%2Cmt%3A1%2Cdid%3Atid_1402978%7Cmed_regular%2CexId%3A3043445387292664551%2Cuuid%3A1975180286928526395%2CdiSrc%3A0%2Cip%3A65.117.15.154%2Cfcc%3A3%2Cfd%3A3%2Cfaf%3A3%2Ctagid%3A24756072%2Csid%3A8438%2Cge%3A%26ep%3D1.609761%26ri%3D511e829476cfe99c9ed31fe819240bce%26rs%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26ai%3D5039743%26rt%3D1402978%26re%3D20785%26ug%3D%26pv%3D0%26ra%3D1208054820.5994256549716035%26rb%3D345%26ca%3D%26rc%3D%26rd%3D%26ua%3D%26ub%3D%26uc%3D%26ud%3D%26ue%3D%26pa%3Dppre1208054826486%26pb%3D%26pc%3D%26pd%3D%26pg%3D%26ct%3D1657120805482%26di%3D%26app%3D0%26pe%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26pf%3D%26sig%3D2147483615%2C805507055%26loc%3Dhttps%3A%2F%2Fdecrypt.co%2Chttps%3A%2F%2Fdecrypt.co%26dtv%3D1$0;xdt=0;crlt=wf5_mqoWc0;stc=1;chaa=1;sttr=23;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.36.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
prg03s12-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 07 Jul 2022 00:02:21 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1789332.3951609ZETA_DSP/B27793146.340177558;dc_ver=90.265;sz=160x600;u_sd=1;dc_adk=4042925164;ord=ouvle1;click=https%3A%2F%2Fa.rfihub.com%2Facs%2Fb%2Fc3Q9aHRtbCZhYT01MDM5NzQzLDEyMTU0OTA0NywyMjc1NTU3LDE4Mzk3MTI4OSwxNzMxNzMsMTQwMjk3OCw1MTFlODI5NDc2Y2ZlOTljOWVkMzFmZTgxOTI0MGJjZSxwLDQzOTk5LDUyOTkxMSw1Njc2NTU5MSw0ODI1ODksMTIyNDI4OSZtdD0xJnJiPTM0NSZyZT0yMDc4NSZoY2k9JnV1aWQ9MTk3NTE4MDI4NjkyODUyNjM5NSZkaT0mZGM9MyZkaXNyYz0wJmJpcD0xMzguMTk5LjM4LjEzMiZkaWQ9dGlkXzE0MDI5Nzh8bWVkX3JlZ3VsYXImbGltcD0x%2Fn%2F;uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.;dc_rfl=0,https%3A%2F%2Fa.rfihub.com%2Fsr%2Fadr.html%3Fw%3D160%26h%3D600%26co%3Dsej%3Afalse%2Coptimize%3Afalse%2CserverId%3Asjc-152%2CnewUser%3Afalse%2CscoreMicroClicks%3A4%2CscoreMicroConversions%3A0%2CuV%3A967600%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Asjc-152.sjc-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1657120805517%2Cmt%3A1%2Cdid%3Atid_1402978%7Cmed_regular%2CexId%3A3043445387292664551%2Cuuid%3A1975180286928526395%2CdiSrc%3A0%2Cip%3A65.117.15.154%2Cfcc%3A3%2Cfd%3A3%2Cfaf%3A3%2Ctagid%3A24756072%2Csid%3A8438%2Cge%3A%26ep%3D1.609761%26ri%3D511e829476cfe99c9ed31fe819240bce%26rs%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26ai%3D5039743%26rt%3D1402978%26re%3D20785%26ug%3D%26pv%3D0%26ra%3D1208054820.5994256549716035%26rb%3D345%26ca%3D%26rc%3D%26rd%3D%26ua%3D%26ub%3D%26uc%3D%26ud%3D%26ue%3D%26pa%3Dppre1208054826486%26pb%3D%26pc%3D%26pd%3D%26pg%3D%26ct%3D1657120805482%26di%3D%26app%3D0%26pe%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26pf%3D%26sig%3D2147483615%2C805507055%26loc%3Dhttps%3A%2F%2Fdecrypt.co%2Chttps%3A%2F%2Fdecrypt.co%26dtv%3D1$0;xdt=0;crlt=wf5_mqoWc0;stc=1;chaa=1;sttr=23;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Mon, 04 Jul 2022 11:50:18 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
216723
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 04 Jul 2023 11:50:18 GMT
cz_us_pros_independence-day_v1_160x600.jpg
s0.2mdn.net/11961459/ 		64 KB
65 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/11961459/cz_us_pros_independence-day_v1_160x600.jpg
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.134 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s06-in-f134.1e100.net
Software
sffe /
Resource Hash
b401ad8f8b3ec2ba8e85531b1ab2423260c24155a32702d8c5eb7dd7c725e236
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 00:02:21 GMT
x-content-type-options
nosniff
last-modified
Mon, 27 Jun 2022 21:31:37 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
66009
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 08 Jul 2022 00:02:21 GMT
tk.gif
a.rfihub.com/ 		42 B
871 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.rfihub.com/tk.gif?rb=345&re=20785&aa=5039743,121549047,2275557,183971289,173173,1402978,511e829476cfe99c9ed31fe819240bce,palaceresorts.com,43999,529911,56765591,482589,1224289&pa=ppre1208054826486&id=&mt=1&dc=3&di=&hci=&uuid=1975180286928526395&disrc=0&ra=1521416420.5835370175909711&ct=1657152141642
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Thu, 07 Jul 2022 00:02:21 GMT
Cache-Control
no-cache
Server
Jetty(9.3.29.v20201019)
Content-Type
image/gif
Content-Length
42
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cap
choices.trustarc.com/ 		43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=zetaglobal01&pid=zeta01&cid=101619&w=160&h=600&c=a7d9
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.157.4.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-157-4-14.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *; prefetch-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 00:02:21 GMT
via
1.1 67b4a3e116ddb07b50403935474117c6.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
DUS51-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
vary
Origin
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
x-frame-options
SAMEORIGIN
expect-ct
max-age=31536000
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *; prefetch-src 'self' *;
x-amz-cf-id
m9_VdyOKvdrqnGr_3eM_lJpwLlTQXBrXxcPrslrh9ajF6OkBYQaVlg==
expires
Mon, 26 Jul 1997 05:00:00 GMT
view
googleads4.g.doubleclick.net/pcs/ 		0
63 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvvOP_et8dQ7KAGMYCsQa0NzmbUKZJ0F-Ax2DEnHmJBY6zcDMl5H4uwZ26pZsjEdLLHQHnYyS5tqx2yuk3uIoZGTcB7Hk7p0v684P83HaLWuvY6rpxceRVmZAV14zRI4ubLffd4SA&sig=Cg0ArKJSzNX4fqrzA8rHEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=75&vt=11&dtpt=74&dett=2&cstd=0&cisv=r20220629.41193&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1789332.3951609ZETA_DSP/B27793146.340177558;dc_ver=90.265;sz=160x600;u_sd=1;dc_adk=4042925164;ord=ouvle1;click=https%3A%2F%2Fa.rfihub.com%2Facs%2Fb%2Fc3Q9aHRtbCZhYT01MDM5NzQzLDEyMTU0OTA0NywyMjc1NTU3LDE4Mzk3MTI4OSwxNzMxNzMsMTQwMjk3OCw1MTFlODI5NDc2Y2ZlOTljOWVkMzFmZTgxOTI0MGJjZSxwLDQzOTk5LDUyOTkxMSw1Njc2NTU5MSw0ODI1ODksMTIyNDI4OSZtdD0xJnJiPTM0NSZyZT0yMDc4NSZoY2k9JnV1aWQ9MTk3NTE4MDI4NjkyODUyNjM5NSZkaT0mZGM9MyZkaXNyYz0wJmJpcD0xMzguMTk5LjM4LjEzMiZkaWQ9dGlkXzE0MDI5Nzh8bWVkX3JlZ3VsYXImbGltcD0x%2Fn%2F;uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.;dc_rfl=0,https%3A%2F%2Fa.rfihub.com%2Fsr%2Fadr.html%3Fw%3D160%26h%3D600%26co%3Dsej%3Afalse%2Coptimize%3Afalse%2CserverId%3Asjc-152%2CnewUser%3Afalse%2CscoreMicroClicks%3A4%2CscoreMicroConversions%3A0%2CuV%3A967600%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Asjc-152.sjc-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1657120805517%2Cmt%3A1%2Cdid%3Atid_1402978%7Cmed_regular%2CexId%3A3043445387292664551%2Cuuid%3A1975180286928526395%2CdiSrc%3A0%2Cip%3A65.117.15.154%2Cfcc%3A3%2Cfd%3A3%2Cfaf%3A3%2Ctagid%3A24756072%2Csid%3A8438%2Cge%3A%26ep%3D1.609761%26ri%3D511e829476cfe99c9ed31fe819240bce%26rs%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26ai%3D5039743%26rt%3D1402978%26re%3D20785%26ug%3D%26pv%3D0%26ra%3D1208054820.5994256549716035%26rb%3D345%26ca%3D%26rc%3D%26rd%3D%26ua%3D%26ub%3D%26uc%3D%26ud%3D%26ue%3D%26pa%3Dppre1208054826486%26pb%3D%26pc%3D%26pd%3D%26pg%3D%26ct%3D1657120805482%26di%3D%26app%3D0%26pe%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26pf%3D%26sig%3D2147483615%2C805507055%26loc%3Dhttps%3A%2F%2Fdecrypt.co%2Chttps%3A%2F%2Fdecrypt.co%26dtv%3D1$0;xdt=0;crlt=wf5_mqoWc0;stc=1;chaa=1;sttr=23;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.36.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
prg03s12-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 07 Jul 2022 00:02:21 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame BD15 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://a.rfihub.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
216722
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 04 Jul 2022 11:50:19 GMT
expires
Tue, 04 Jul 2023 11:50:19 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aHhPXGVii6m1UdQEw4dl9bTaUK-_iBumPQ-RERU6U4M.js
pagead2.googlesyndication.com/bg/ Frame BD15 		36 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/aHhPXGVii6m1UdQEw4dl9bTaUK-_iBumPQ-RERU6U4M.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
68784f5c65628ba9b551d404c38765f5b4da50afbf881ba63d0f9111153a5383
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Tue, 05 Jul 2022 21:21:30 GMT
content-encoding
br
x-content-type-options
nosniff
age
96051
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13869
x-xss-protection
0
last-modified
Mon, 27 Jun 2022 08:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 05 Jul 2023 21:21:30 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame BD15 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BvmxsjSLGYuWYJP3U7_UPxPWvwAkAAAAAOAHgBAI&bg=!Z2SlZCDNAAaLlKKnq5Q7ACkAdvg8WnGuGu2Emcmp0yG8qtlYeo-7UXa0DknsjqWXSxCnN27_PbUBHQIAAABQUgAAAAJoAQcKABPPbuL7r6ygtZjiyTczncE9BhlsmQKRLfCtoEoSNb7RdSmsZOUGeiq8Mg3kAMJRNdVFbxAtPNnJQPIYRm0-skXjtvxfF4HpMOwGJWBnRbDdZERQbd858_DCzTPwjVYDXb7kXMJinPmmbZUKzGVyHK4gbQMk4FlQttyfHEV4tv6JfWjNvSxwnkcY8w30e0G6DKnTQLE5d6iSxE7ZEvfnr9uDRLPaj6zvI8Gb4dX6x_4OHKR5474u1lQWh_xCrcDD5ySyFzo6XwhDLcVxfwik3flfsVB-SNJyHDuTK0nI5UaCrbEwmJYYZW6iLFjWuAFV0tUau7OtPcGVEnktB86Doog_YiFtCn0KUoZcKfH0sXbZ9Fqjc78jjTzsypZwFEfM6P2-qzgUK8drpb7iBqU-jQbvtemb7_prEj_r-b-vUYJ0YzVO6h2TV73vsS2sV3iyxW5IAu5FEtMA6d0i5hY9vyRP6Nj3ty4EfxWT00DSSwxGbjCeyK4aU2V5g8gs7u6ko4JYT2nFAwJki96KmMdGv_tvouzy_XKpkNmlvJvd-VpS0SakPDfKTD7Gzy7Sir8Y426Gi1qCTyuk3lOSKubDig_ONNFNSuuG1MUS4WMb_gHFo62iknhNpQR3lxNzWmNNZyfeR3jjFAFaLJg9ZtJtvHV-kXDff8VsCxOYcEMujTcquwKTWZVGIUwe9ssPcEKx_cbvRXCzng6thOiclNuD09wbAkns3pzlzJIIk9oL-jawGDDsw_jTogS2qGN4kKYAcKyJzPaIk_M0fAwak85gu7LYhneSE-69VBsNo6rbg4pwIJBKVjI8NiML-Ke5_SJ-JveqyaPJb52J65BQC30DdJdz_d71Wl7wH4-30xUHNNuw1ZsMm_FycjuWauSwnc9PNv_ORIrUCDzf
Requested by
Host: a.rfihub.com
URL: https://a.rfihub.com/sr/adr.html?w=160&h=600&co=sej:false,optimize:false,serverId:sjc-152,newUser:false,scoreMicroClicks:4,scoreMicroConversions:0,uV:967600,uG:0,uE:0,uD:0,url:sjc-152.sjc-rtb1.rfihub.com,bB:true,bt:1657120805517,mt:1,did:tid_1402978|med_regular,exId:3043445387292664551,uuid:1975180286928526395,diSrc:0,ip:65.117.15.154,fcc:3,fd:3,faf:3,tagid:24756072,sid:8438,ge:&ep=1.609761&ri=511e829476cfe99c9ed31fe819240bce&rs=https://decrypt.co/news&ai=5039743&rt=1402978&re=20785&ug=&pv=0&ra=1208054820.5994256549716035&rb=345&ca=&rc=&rd=&ua=&ub=&uc=&ud=&ue=&pa=ppre1208054826486&pb=&pc=&pd=&pg=&ct=1657120805482&di=&app=0&pe=https://decrypt.co/news&pf=&sig=2147483615,805507055&loc=https://decrypt.co,https://decrypt.co&dtv=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Jul 2022 00:02:21 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstMD6xF7-TkJlWtXZ-zA-zmxdyZDcy6NoK6DYQhhQywXzZJgTZGJs6e2kHmhYfUdxjiEZvj89y2szfXXKi-Tec&sig=Cg0ArKJSzLwA-a2zJxqtEAE&id=lidar2&mcvt=1000&p=8,8,608,168&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220627&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=32&adk=4042925164&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1657152141366&rpt=345&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 07 Jul 2022 00:02:22 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
get
choices.trustarc.com/ 		287 B
627 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.157.4.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-157-4-14.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma
public
date
Fri, 17 Jun 2022 06:28:21 GMT
via
1.1 67b4a3e116ddb07b50403935474117c6.cloudfront.net (CloudFront)
server
nginx
age
1704842
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
DUS51-P2
timing-allow-origin
*
content-length
287
x-amz-cf-id
eIvnpfTszN-chCig0sQOjiptZZL-bPuCIs2XXCTDpz30OLsQoHA1Ng==
expires
Sun, 17 Jul 2022 06:28:21 GMT
get
choices.trustarc.com/ Frame BB44 		287 B
628 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?pid=zeta01&aid=zetaglobal01&cid=101619&c=ff544f78-39da-4942-8e22-fe31cbf264a9&w=160&h=600&plc=tr
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.157.4.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-157-4-14.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma
public
date
Fri, 17 Jun 2022 06:28:21 GMT
via
1.1 67b4a3e116ddb07b50403935474117c6.cloudfront.net (CloudFront)
server
nginx
age
1704842
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
DUS51-P2
timing-allow-origin
*
content-length
287
x-amz-cf-id
ToxmESXVL_H77dLnmqHEo9NXnABmBTxCMDZSSicfA576CS2KD00oig==
expires
Sun, 17 Jul 2022 06:28:21 GMT
get
choices.trustarc.com/ Frame BB44 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.157.4.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-157-4-14.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma
public
date
Wed, 29 Jun 2022 01:54:23 GMT
via
1.1 67b4a3e116ddb07b50403935474117c6.cloudfront.net (CloudFront)
server
nginx
age
684480
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
x-amz-cf-pop
DUS51-P2
timing-allow-origin
*
content-length
739
x-amz-cf-id
4HgEnG4AJS23-V93L0lkrCLzWocKNL19n_wegHbmqDemxKGbGQBmOQ==
expires
Fri, 29 Jul 2022 01:54:23 GMT
cap
choices.trustarc.com/ 		43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=zetaglobal01-cy&pid=zeta01&cid=101619&w=160&h=600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.157.4.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-157-4-14.dus51.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *; prefetch-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://a.rfihub.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 00:02:23 GMT
via
1.1 67b4a3e116ddb07b50403935474117c6.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
DUS51-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
vary
Origin
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
x-frame-options
SAMEORIGIN
expect-ct
max-age=31536000
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *; prefetch-src 'self' *;
x-amz-cf-id
NYBoxJXxglLI-erNWrOmsKVqJ3kaGtTwdWZc6wBC3nIzfrc0eVkc3A==
expires
Mon, 26 Jul 1997 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

77 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| dcmads object| google_tag_data object| goog_ddm_ps function| clsn object| dicnf object| google_js_reporting_queue number| google_srt function| btrp function| pdib3 function| vv function| sasrc function| stcc object| GoogleTyFxhY string| rfiTrackParameters function| rfiDoBeforeAdSelect function| rfiDoOnAdSelectCallback object| __rfiVisibilityCode number| __rfiBeaconInterval number| __rfiBeaconLimit undefined| __rfiBeaconUrl number| __rfiVisibilityCheckInterval function| rfiDebug function| rfiGetAdUnitEl function| rfiFindElementPos function| rfiFindScrollOffsets function| rfiFindClientDimensions function| rfiGetElementVisibility function| rfiSetCookie function| rfiGetCookie function| rfiDeleteCookie function| rfiAddEvent function| rfiRemoveEvent function| rfiFindFlashVersion function| rfiDef function| rfiCommaTextEscape function| rfiEscape function| rfiReportClick function| rfiURLPrefix function| rfiAddClickTrack function| rfibeac function| rfiConv function| rfiAdServe function| rfiCSTrack function| rfiPerformanceTrack function| rfiBOrA function| rfiParseDebugAdStringFromURL string| _rfiPagePre string| _rfiAServer object| COMSCORE function| udm_ object| _comscore number| PROBABILITY_TO_FIRE string| timestampString number| timestamp boolean| shouldFire undefined| viewabilityOptions number| __google_lidar_ function| osdlfm number| __google_lidar_adblocks_count_ function| __google_lidar_radf_ object| truste string| te_clr1_072e4962_86bc_4c4b_bf48_0db47aa4b6fe_ib object| te_clr1_072e4962_86bc_4c4b_bf48_0db47aa4b6fe_bi string| readyState object| iever function| omrhp boolean| bResult

27 Cookies

Domain/Path Name / Value
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAAAOMSNrQ0NzW0MDCyMLM0sjA1MjO2NBXiM9R1rfArjig0iHcui7AAAK-AZE0lAAAA
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAAAOMSNrQ0NzW0MDCyMLM0sjA1MjO2NBXiM9R1rfArjig0iHcui7AAAK-AZE0lAAAA
.rfihub.com/ Name: ub
Value: H4sIAAAAAAAAAOPqZ0x0dHe3zCkscLS1dfRIMTQ3BiJHJ0NHR0en9JQII13vfKB4mamRpaWhIYZ4Mg71OdjVO2VgiKSjiQAApB-mcpIAAAA
.adnxs.com/ Name: uuid2
Value: 6286233818016890126
.adnxs.com/ Name: anj
Value: dTM7k!M4/YErk#WF']wIg2C%<G_C@W!@wnfH8KAM.xpH^GmVS$G4v%eE:=*fE:=7eEt+35i!OqW4hB^u!2>h9/+0J2!!/1qEhQk5
.eyeota.net/ Name: SERVERID
Value: 21613~DM
.doubleclick.net/ Name: IDE
Value: AHWqTUmp1AuQvcK2dvCwtjsKHsrH5FXbN59Vge7ukPzwVurJ30SRrw-XHnIl_Bkyy5g
.casalemedia.com/ Name: CMID
Value: YsYijRb3aHmhJlw-EfORzwAA
.casalemedia.com/ Name: CMPS
Value: 3236
.casalemedia.com/ Name: CMPRO
Value: 3236
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.imrworldwide.com/ Name: IMRID
Value: 12eb68c0-fd88-11ec-aaf5-d799d6645bba
.casalemedia.com/ Name: CMTS
Value: 3225
.spotxchange.com/ Name: audience
Value: 12f2fb2d-fd88-11ec-95cf-1d21b9eb0106
.media.net/ Name: visitor-id
Value: 3001537410733224000V10
.media.net/ Name: data-rk
Value: 1975180286928526395~~3
.bidswitch.net/ Name: tuuid
Value: 11fb81b0-8519-4279-8c48-99df27635613
.bidswitch.net/ Name: c
Value: 1657152141
.bidswitch.net/ Name: tuuid_lu
Value: 1657152141
.krxd.net/ Name: _kuid_
Value: O8SD_1ic
.rezync.com/ Name: zync-uuid
Value: 741d97df-901f-4367-bb56-f06748ed3bd0:1657152141.76
live.rezync.com/ Name: sd-session-id
Value: .eJwVysEKgjAYAOBXif_sQWczJ3QQlChqIgxku0jZDtO0cJPGxHdvHT_4Vmg_ch7vk5wMZGZeZADdS3lpyFbQyo1ygAwicsBRGqI0ISjFKIkJhi0ALbVW76lVz__ePfykrraiGGJx4qZiuRUqDG-Ox9fmoijjRvQ58mcvmtrxsf5WfYko6yxlZ0uLcqGOH2Hbfr8ZMWk.Fae0DQ.gaEbd7zzC8Hi-ynhpJSwNW7qYNw
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~YsYijQAOO7Y0VAAj
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAAAOOSMXR2dA129dUt8XErNk6L9zRKTg4s9g33q0jJSQ7iNTQzNTc0NTI0MTQzMprFiMQ3sTBehcY_hcZ_hcb_hcafxITKn4XGX4TGX4XG34TG34WungWVfwuZb2pmuohVILI4MjMr0NHf3zzSIMzRMWsVK5ISSxPTTaxoVnCjeQmNP0nYyNzEMMXSPCVN19LAME3XxNjMXDcpydRMN83AzNzEIjXFOCnFwAqhSc_cbJYwkiEW5kaLhFENfYTGBwC5A_rgtQEAAA
.rfihub.com/ Name: euds
Value: H4sIAAAAAAAAAOOSMXR2dA129dUt8XErNk6L9zRKTg4s9g33q0jJSV7FKBBZHJmZFejo728eaRDm6JjVxGJkbmKYYmmekqZraWCYpmtibGaum5RkaqabZmBmbmKRmmKclGJgZWhmam5oamRoYqhnbgYAftOwGmYAAAA
.demdex.net/ Name: demdex
Value: 28642428278898873874289499527410480889
.dpm.demdex.net/ Name: dpm
Value: 28642428278898873874289499527410480889

7 Console Messages

Source Level URL
Text
javascript warning URL: https://www.googletagservices.com/dcm/dcmads.js(Line 45)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/impl_v90.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.googletagservices.com/dcm/dcmads.js(Line 45)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.googletagservices.com/dcm/impl_v90.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
other warning URL: https://www.googletagservices.com/dcm/impl_v90.js(Line 88)
Message:
Unrecognized feature: 'attribution-reporting'.
javascript warning URL: https://www.googletagservices.com/dcm/impl_v90.js(Line 99)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ad.doubleclick.net/ddm/adj/N1789332.3951609ZETA_DSP/B27793146.340177558;dc_ver=90.265;sz=160x600;u_sd=1;dc_adk=4042925164;ord=ouvle1;click=https%3A%2F%2Fa.rfihub.com%2Facs%2Fb%2Fc3Q9aHRtbCZhYT01MDM5NzQzLDEyMTU0OTA0NywyMjc1NTU3LDE4Mzk3MTI4OSwxNzMxNzMsMTQwMjk3OCw1MTFlODI5NDc2Y2ZlOTljOWVkMzFmZTgxOTI0MGJjZSxwLDQzOTk5LDUyOTkxMSw1Njc2NTU5MSw0ODI1ODksMTIyNDI4OSZtdD0xJnJiPTM0NSZyZT0yMDc4NSZoY2k9JnV1aWQ9MTk3NTE4MDI4NjkyODUyNjM5NSZkaT0mZGM9MyZkaXNyYz0wJmJpcD0xMzguMTk5LjM4LjEzMiZkaWQ9dGlkXzE0MDI5Nzh8bWVkX3JlZ3VsYXImbGltcD0x%2Fn%2F;uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.;dc_rfl=0,https%3A%2F%2Fa.rfihub.com%2Fsr%2Fadr.html%3Fw%3D160%26h%3D600%26co%3Dsej%3Afalse%2Coptimize%3Afalse%2CserverId%3Asjc-152%2CnewUser%3Afalse%2CscoreMicroClicks%3A4%2CscoreMicroConversions%3A0%2CuV%3A967600%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Asjc-152.sjc-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1657120805517%2Cmt%3A1%2Cdid%3Atid_1402978%7Cmed_regular%2CexId%3A3043445387292664551%2Cuuid%3A1975180286928526395%2CdiSrc%3A0%2Cip%3A65.117.15.154%2Cfcc%3A3%2Cfd%3A3%2Cfaf%3A3%2Ctagid%3A24756072%2Csid%3A8438%2Cge%3A%26ep%3D1.609761%26ri%3D511e829476cfe99c9ed31fe819240bce%26rs%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26ai%3D5039743%26rt%3D1402978%26re%3D20785%26ug%3D%26pv%3D0%26ra%3D1208054820.5994256549716035%26rb%3D345%26ca%3D%26rc%3D%26rd%3D%26ua%3D%26ub%3D%26uc%3D%26ud%3D%26ue%3D%26pa%3Dppre1208054826486%26pb%3D%26pc%3D%26pd%3D%26pg%3D%26ct%3D1657120805482%26di%3D%26app%3D0%26pe%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26pf%3D%26sig%3D2147483615%2C805507055%26loc%3Dhttps%3A%2F%2Fdecrypt.co%2Chttps%3A%2F%2Fdecrypt.co%26dtv%3D1$0;xdt=0;crlt=wf5_mqoWc0;stc=1;chaa=1;sttr=23;prcl=s, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.googletagservices.com/dcm/impl_v90.js(Line 99)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ad.doubleclick.net/ddm/adj/N1789332.3951609ZETA_DSP/B27793146.340177558;dc_ver=90.265;sz=160x600;u_sd=1;dc_adk=4042925164;ord=ouvle1;click=https%3A%2F%2Fa.rfihub.com%2Facs%2Fb%2Fc3Q9aHRtbCZhYT01MDM5NzQzLDEyMTU0OTA0NywyMjc1NTU3LDE4Mzk3MTI4OSwxNzMxNzMsMTQwMjk3OCw1MTFlODI5NDc2Y2ZlOTljOWVkMzFmZTgxOTI0MGJjZSxwLDQzOTk5LDUyOTkxMSw1Njc2NTU5MSw0ODI1ODksMTIyNDI4OSZtdD0xJnJiPTM0NSZyZT0yMDc4NSZoY2k9JnV1aWQ9MTk3NTE4MDI4NjkyODUyNjM5NSZkaT0mZGM9MyZkaXNyYz0wJmJpcD0xMzguMTk5LjM4LjEzMiZkaWQ9dGlkXzE0MDI5Nzh8bWVkX3JlZ3VsYXImbGltcD0x%2Fn%2F;uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.;dc_rfl=0,https%3A%2F%2Fa.rfihub.com%2Fsr%2Fadr.html%3Fw%3D160%26h%3D600%26co%3Dsej%3Afalse%2Coptimize%3Afalse%2CserverId%3Asjc-152%2CnewUser%3Afalse%2CscoreMicroClicks%3A4%2CscoreMicroConversions%3A0%2CuV%3A967600%2CuG%3A0%2CuE%3A0%2CuD%3A0%2Curl%3Asjc-152.sjc-rtb1.rfihub.com%2CbB%3Atrue%2Cbt%3A1657120805517%2Cmt%3A1%2Cdid%3Atid_1402978%7Cmed_regular%2CexId%3A3043445387292664551%2Cuuid%3A1975180286928526395%2CdiSrc%3A0%2Cip%3A65.117.15.154%2Cfcc%3A3%2Cfd%3A3%2Cfaf%3A3%2Ctagid%3A24756072%2Csid%3A8438%2Cge%3A%26ep%3D1.609761%26ri%3D511e829476cfe99c9ed31fe819240bce%26rs%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26ai%3D5039743%26rt%3D1402978%26re%3D20785%26ug%3D%26pv%3D0%26ra%3D1208054820.5994256549716035%26rb%3D345%26ca%3D%26rc%3D%26rd%3D%26ua%3D%26ub%3D%26uc%3D%26ud%3D%26ue%3D%26pa%3Dppre1208054826486%26pb%3D%26pc%3D%26pd%3D%26pg%3D%26ct%3D1657120805482%26di%3D%26app%3D0%26pe%3Dhttps%3A%2F%2Fdecrypt.co%2Fnews%26pf%3D%26sig%3D2147483615%2C805507055%26loc%3Dhttps%3A%2F%2Fdecrypt.co%2Chttps%3A%2F%2Fdecrypt.co%26dtv%3D1$0;xdt=0;crlt=wf5_mqoWc0;stc=1;chaa=1;sttr=23;prcl=s, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://idsync.rlcdn.com/360947.gif?partner_uid=1975180286928526395
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: https://idsync.rlcdn.com/501709.gif?partner_uid=741d97df-901f-4367-bb56-f06748ed3bd0%3A1657152141.76
Message:
Failed to load resource: the server responded with a status of 451 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.rfihub.com
aa.agkn.com
ad.doubleclick.net
beacon.krxd.net
bpi.rtactivate.com
bs.serving-sys.com
c1.rfihub.net
choices.trustarc.com
cm.g.doubleclick.net
contextual.media.net
dpm.demdex.net
dsum-sec.casalemedia.com
googleads4.g.doubleclick.net
ib.adnxs.com
idsync.rlcdn.com
live.rezync.com
p.rfihub.com
pagead2.googlesyndication.com
partners.tremorhub.com
pixel.rubiconproject.com
ps.eyeota.net
s0.2mdn.net
sb.scorecardresearch.com
secure-us.imrworldwide.com
sync-tm.everesttech.net
sync.search.spotxchange.com
tpc.googlesyndication.com
www.googletagservices.com
x.bidswitch.net
x.dlx.addthis.com
104.18.19.126
104.90.104.26
104.90.192.27
108.157.4.14
13.224.81.100
13.32.121.37
142.250.186.98
142.251.36.130
151.101.194.49
172.217.16.134
18.157.156.229
185.89.210.46
185.94.180.125
193.0.160.128
2600:1f18:612b:4200:ebc6:a220:81c8:d770
2600:9000:214f:3400:1:76cf:fe80:93a1
2a00:1450:4001:829::2001
2a00:1450:4001:82b::2002
2a00:1450:4001:831::2002
3.121.27.153
34.248.96.95
34.252.173.26
35.156.69.34
35.156.83.159
35.244.174.68
52.213.150.8
54.227.219.230
69.173.144.165
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9
29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb
2a40641661b54c304ebe64ce944b1261fd061962a6f2b86558f3b3d98237ca0a
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
68784f5c65628ba9b551d404c38765f5b4da50afbf881ba63d0f9111153a5383
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a9123e40ac8adb5f4b3d86de03305d24b5a55e4603c2450c276ed3195cb22026
aafbe63767b52106445fc908e63387cf0c3064c6f9b9545d70b77b123f626cc6
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b401ad8f8b3ec2ba8e85531b1ab2423260c24155a32702d8c5eb7dd7c725e236
cfc0956e607d9e002a80dac0444ad4597ed16a0fb8cd5527121ae017f0643491
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
ee54b51af15f1f68f707da981f3c135c249a25e9293871e1e0cbd2c24c7b6117
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef6c9aaf36bcf57fd7fd87c21ddfbff8bdaa6da3bfa9a35e1b2fc4e90bdfe756
f473a31050a4cbf3818845d0096d7396d89b8753b5b5d79443506b7de0768c69