forums.juniper.net Open in urlscan Pro
208.74.207.25 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Submission: On February 20 via api (February 20th 2020, 8:34:33 am UTC) from DE

Summary HTTP 169 Redirects Links 115 Behaviour Indicators

Summary

This website contacted 42 IPs in 8 countries across 33 domains to perform 169 HTTP transactions. The main IP is 208.74.207.25, located in United States and belongs to LITHIUM, US. The main domain is forums.juniper.net.
TLS certificate: Issued by DigiCert SHA2 High Assurance Server CA on August 16th 2019. Valid for: a year.

This is the only time forums.juniper.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5	208.74.207.25 208.74.207.25	40402 (LITHIUM) (LITHIUM)
21	23.210.248.45 23.210.248.45	16625 (AKAMAI-AS) (AKAMAI-AS)
3	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2)
2	2a00:1450:400... 2a00:1450:4001:81e::200a	15169 (GOOGLE) (GOOGLE)
2	2001:4de0:ac1... 2001:4de0:ac19::1:b:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
27	93.184.220.97 93.184.220.97	15133 (EDGECAST) (EDGECAST)
1 13	2a02:26f0:6c0... 2a02:26f0:6c00:180::720	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	93.184.220.41 93.184.220.41	15133 (EDGECAST) (EDGECAST)
2	208.74.205.254 208.74.205.254	40402 (LITHIUM) (LITHIUM)
2	52.49.234.3 52.49.234.3	16509 (AMAZON-02) (AMAZON-02)
2	143.204.202.92 143.204.202.92	16509 (AMAZON-02) (AMAZON-02)
1	13.35.253.23 13.35.253.23	16509 (AMAZON-02) (AMAZON-02)
2	18.139.76.45 18.139.76.45	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1	52.212.4.209 52.212.4.209	16509 (AMAZON-02) (AMAZON-02)
1	65.52.62.25 65.52.62.25	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
6	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1 5	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
1 1	68.67.153.60 68.67.153.60	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	185.33.223.203 185.33.223.203	29990 (ASN-APPNEX) (ASN-APPNEX)
1	143.204.202.123 143.204.202.123	16509 (AMAZON-02) (AMAZON-02)
12	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
3	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:819::2003	15169 (GOOGLE) (GOOGLE)
12	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	104.103.106.126 104.103.106.126	16625 (AKAMAI-AS) (AKAMAI-AS)
1	66.117.29.3 66.117.29.3	15224 (OMNITURE) (OMNITURE)
4	143.204.202.79 143.204.202.79	16509 (AMAZON-02) (AMAZON-02)
1 2	172.217.22.38 172.217.22.38	15169 (GOOGLE) (GOOGLE)
1 2	172.217.16.134 172.217.16.134	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE)
2 2	209.167.231.17 209.167.231.17	7160 (NETDYNAMICS) (NETDYNAMICS)
1	23.45.237.36 23.45.237.36	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	143.204.202.20 143.204.202.20	16509 (AMAZON-02) (AMAZON-02)
2 2	52.49.193.31 52.49.193.31	16509 (AMAZON-02) (AMAZON-02)
1 2	143.204.202.106 143.204.202.106	16509 (AMAZON-02) (AMAZON-02)
1 2	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
2 5	2a00:1450:400... 2a00:1450:4001:820::2004	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:81d::2003	15169 (GOOGLE) (GOOGLE)
3	52.72.180.134 52.72.180.134	14618 (AMAZON-AES) (AMAZON-AES)
5	13.35.253.69 13.35.253.69	16509 (AMAZON-02) (AMAZON-02)
2	143.204.202.47 143.204.202.47	16509 (AMAZON-02) (AMAZON-02)
2	172.217.22.66 172.217.22.66	15169 (GOOGLE) (GOOGLE)
1 4	2a00:1450:400... 2a00:1450:4001:81f::2002	15169 (GOOGLE) (GOOGLE)
2	2a05:f500:10:... 2a05:f500:10:101::b93f:9105	14413 (LINKEDIN) (LINKEDIN)
169	42

5 208.74.207.25 (United States)

ASN40402 (LITHIUM, US)
PTR: jnet.lithium.com

forums.juniper.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 23.210.248.45 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-45.deploy.static.akamaitechnologies.com

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

27 93.184.220.97 (London, United Kingdom)

ASN15133 (EDGECAST, US)

jnet.i.lithium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a02:26f0:6c00:180::720 (Ascension Island) 1 redirects

ASN20940 (AKAMAI-ASN1, US)

www.juniper.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 93.184.220.41 (London, United Kingdom)

ASN15133 (EDGECAST, US)

cloud.webtype.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 208.74.205.254 (United States)

ASN40402 (LITHIUM, US)
PTR: sjc1-secure06.stage.lithium.com

forumstage.juniper.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.49.234.3 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-234-3.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.202.92 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-92.fra53.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.253.23 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-23.fra6.r.cloudfront.net

api.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.139.76.45 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-139-76-45.ap-southeast-1.compute.amazonaws.com

junipernetworks.d2.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.212.4.209 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-4-209.eu-west-1.compute.amazonaws.com

junipernetworks.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.52.62.25 (Chicago, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

pls.webtype.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.101.12.157 (Frankfurt am Main, Germany) 1 redirects

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.153.60 (United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: s.ml-attr.com.pxlsrv.net

s.ml-attr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.223.203 (Netherlands) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 317.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.202.123 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-123.fra53.r.cloudfront.net

attr.ml-api.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.103.106.126 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-103-106-126.deploy.static.akamaitechnologies.com

img.en25.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.29.3 (United States)

ASN15224 (OMNITURE, US)

junipernetworks.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 143.204.202.79 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-79.fra53.r.cloudfront.net

secure.rmulus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.22.38 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s16-in-f38.1e100.net

5922977.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.134 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f134.1e100.net

3872718.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.167.231.17 (United States) 2 redirects

ASN7160 (NETDYNAMICS, US)
PTR: e017.en25.com

s1229.t.eloqua.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.45.237.36 (United States)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-237-36.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.202.20 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-20.fra53.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.49.193.31 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-193-31.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.202.106 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-106.fra53.r.cloudfront.net

segments.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9b (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:820::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:81d::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.72.180.134 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-180-134.compute-1.amazonaws.com

lookups.rmulus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 13.35.253.69 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-69.fra6.r.cloudfront.net

research.juniper.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.202.47 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-202-47.fra53.r.cloudfront.net

collect.rmulus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.22.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s17-in-f66.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81f::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:10:101::b93f:9105 (Ireland)

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
27	lithium.com jnet.i.lithium.com	2 MB
25	juniper.net 1 redirects forums.juniper.net www.juniper.net forumstage.juniper.net research.juniper.net	2 MB
21	adobedtm.com assets.adobedtm.com	107 KB
13	twitter.com 1 redirects platform.twitter.com analytics.twitter.com	2 KB
12	t.co t.co	2 KB
10	doubleclick.net 4 redirects 5922977.fls.doubleclick.net 3872718.fls.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net	8 KB
9	rmulus.com secure.rmulus.com lookups.rmulus.com collect.rmulus.com	30 KB
6	facebook.net connect.facebook.net	427 KB
5	google.de www.google.de	549 B
5	google.com 2 redirects www.google.com	2 KB
4	company-target.com 1 redirects api.company-target.com segments.company-target.com	4 KB
4	google-analytics.com www.google-analytics.com	18 KB
4	ads-twitter.com static.ads-twitter.com	8 KB
3	googletagmanager.com www.googletagmanager.com	103 KB
3	facebook.com www.facebook.com	382 B
3	omtrdc.net junipernetworks.d2.sc.omtrdc.net junipernetworks.tt.omtrdc.net	1 KB
3	demandbase.com scripts.demandbase.com api.demandbase.com	19 KB
3	demdex.net dpm.demdex.net junipernetworks.demdex.net	2 KB
3	webtype.com cloud.webtype.com pls.webtype.com	65 KB
3	fontawesome.com use.fontawesome.com	13 KB
2	linkedin.com px.ads.linkedin.com	137 B
2	googleadservices.com www.googleadservices.com	20 KB
2	bidr.io 2 redirects match.prod.bidr.io	1019 B
2	eloqua.com 2 redirects s1229.t.eloqua.com	2 KB
2	adnxs.com 2 redirects secure.adnxs.com	2 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com	29 KB
2	googleapis.com ajax.googleapis.com fonts.googleapis.com	30 KB
1	bluekai.com tags.bluekai.com	745 B
1	en25.com img.en25.com	3 KB
1	gstatic.com fonts.gstatic.com	14 KB
1	ml-api.io attr.ml-api.io	485 B
1	ml-attr.com 1 redirects s.ml-attr.com	277 B
1	everesttech.net 1 redirects cm.everesttech.net	554 B
169	33

	Domain	Requested by
27	jnet.i.lithium.com	forums.juniper.net use.fontawesome.com assets.adobedtm.com
21	assets.adobedtm.com	forums.juniper.net assets.adobedtm.com
13	www.juniper.net	1 redirects forums.juniper.net forumstage.juniper.net
12	analytics.twitter.com	static.ads-twitter.com
12	t.co	forums.juniper.net static.ads-twitter.com research.juniper.net
6	connect.facebook.net	assets.adobedtm.com connect.facebook.net forums.juniper.net
5	research.juniper.net	secure.rmulus.com research.juniper.net
5	www.google.de	forums.juniper.net research.juniper.net
5	www.google.com	2 redirects research.juniper.net forums.juniper.net
5	forums.juniper.net	forums.juniper.net jnet.i.lithium.com
4	googleads.g.doubleclick.net	1 redirects www.googleadservices.com
4	www.google-analytics.com	forums.juniper.net
4	secure.rmulus.com	assets.adobedtm.com secure.rmulus.com
4	static.ads-twitter.com	assets.adobedtm.com forums.juniper.net
3	lookups.rmulus.com	secure.rmulus.com
3	www.googletagmanager.com	forums.juniper.net research.juniper.net
3	www.facebook.com	forums.juniper.net connect.facebook.net
3	use.fontawesome.com	forums.juniper.net use.fontawesome.com
2	px.ads.linkedin.com	research.juniper.net
2	www.googleadservices.com	www.googletagmanager.com
2	collect.rmulus.com	research.juniper.net forums.juniper.net
2	stats.g.doubleclick.net	1 redirects forums.juniper.net
2	segments.company-target.com	1 redirects forums.juniper.net
2	match.prod.bidr.io	2 redirects
2	api.company-target.com	scripts.demandbase.com
2	s1229.t.eloqua.com	2 redirects
2	3872718.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	5922977.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	secure.adnxs.com	2 redirects
2	junipernetworks.d2.sc.omtrdc.net	assets.adobedtm.com forums.juniper.net
2	scripts.demandbase.com	assets.adobedtm.com
2	dpm.demdex.net	assets.adobedtm.com forums.juniper.net
2	forumstage.juniper.net	forums.juniper.net assets.adobedtm.com
2	cloud.webtype.com	forums.juniper.net assets.adobedtm.com
2	maxcdn.bootstrapcdn.com	forums.juniper.net
1	tags.bluekai.com	forums.juniper.net
1	junipernetworks.tt.omtrdc.net	assets.adobedtm.com
1	img.en25.com	forums.juniper.net
1	fonts.gstatic.com	jnet.i.lithium.com
1	attr.ml-api.io	forums.juniper.net
1	s.ml-attr.com	1 redirects
1	platform.twitter.com	1 redirects
1	pls.webtype.com	forums.juniper.net
1	junipernetworks.demdex.net	assets.adobedtm.com
1	cm.everesttech.net	1 redirects
1	fonts.googleapis.com	forums.juniper.net
1	api.demandbase.com	assets.adobedtm.com
1	ajax.googleapis.com	forums.juniper.net
169	48

This site contains links to these domains. Also see Links.

Domain
www.juniper.net
support.juniper.net
my.juniper.net
license.juniper.net
entitlementsearch.juniper.net
kb.juniper.net
prsearch.juniper.net
apps.juniper.net
learningportal.juniper.net
openlearning.juniper.net
cloud.contentraven.com
www.certmetrics.com
iam-signin.juniper.net
userregistration.juniper.net
www.facebook.com
twitter.com
plus.google.com
www.linkedin.com
foo.net
www.rfidjournal.com
blog.avast.com
arstechnica.com
www.joesandbox.com
www.hybrid-analysis.com
khoros.com
investor.juniper.net
newsroom.juniper.net
events.juniper.net
partners.juniper.net
www.youtube.com
www.instagram.com

Subject Issuer	Validity	Valid
secure07.lithium.com DigiCert SHA2 High Assurance Server CA	`2019-08-16` - `2020-09-02`	a year	crt.sh
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA	`2019-10-22` - `2021-10-01`	2 years	crt.sh
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2019-10-28` - `2020-12-23`	a year	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh
*.i.lithium.com Go Daddy Secure Certificate Authority - G2	`2019-11-28` - `2022-01-28`	2 years	crt.sh
www.juniper.net DigiCert SHA2 Secure Server CA	`2019-05-17` - `2020-08-15`	a year	crt.sh
s1.wac.edgecastcdn.net DigiCert SHA2 Secure Server CA	`2018-11-05` - `2020-11-20`	2 years	crt.sh
secure06.stage.lithium.com DigiCert SHA2 High Assurance Server CA	`2019-12-11` - `2020-03-19`	3 months	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
*.demandbase.com Go Daddy Secure Certificate Authority - G2	`2018-09-20` - `2020-11-19`	2 years	crt.sh
*.d2.sc.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2019-04-23` - `2020-04-14`	a year	crt.sh
*.webtype.com Sectigo RSA Domain Validation Secure Server CA	`2019-06-30` - `2021-07-12`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-01-16` - `2020-04-15`	3 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-14` - `2020-08-18`	a year	crt.sh
*.ml-api.io Amazon	`2020-02-06` - `2021-03-06`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-02-18` - `2021-02-06`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-01-02` - `2020-12-28`	a year	crt.sh
*.en25.com DigiCert SHA2 Secure Server CA	`2019-06-21` - `2020-08-19`	a year	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-19` - `2020-11-25`	3 years	crt.sh
rmulus.com Amazon	`2019-04-23` - `2020-05-23`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
odc-prod-01.oracle.com DigiCert ECC Secure Server CA	`2018-12-10` - `2020-03-10`	a year	crt.sh
*.company-target.com Go Daddy Secure Certificate Authority - G2	`2019-06-19` - `2021-08-18`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2019-05-29` - `2021-06-29`	2 years	crt.sh
www.google.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Frame ID: 2FE3F949F5B398F3F04000F599ADDC66
Requests: 129 HTTP requests in this frame

Frame: https://junipernetworks.demdex.net/dest5.html?d_nsid=0
Frame ID: 84FCF164EF33DFAFCE8623ADFA627F29
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5caeb27864746d4fde0010d0.html
Frame ID: D7C88AF0E58C4A0D206D8975B5A57A17
Requests: 1 HTTP requests in this frame

Frame: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5d487bc864746d25bd00073a.html
Frame ID: A05653AF69486C7D82097B01FB41DDAF
Requests: 1 HTTP requests in this frame

Frame: https://5922977.fls.doubleclick.net/activityi;dc_pre=CIe2m6nc3-cCFaHjuwgdWiQGsw;src=5922977;type=pageview;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=916199057962.9031
Frame ID: 9BC192C1CCC8B1C1E33922CC3F0E39A3
Requests: 1 HTTP requests in this frame

Frame: https://3872718.fls.doubleclick.net/activityi;dc_pre=CKDCoKnc3-cCFaPjuwgduxoL8A;src=3872718;type=gojpnet;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7781161242936.281
Frame ID: 940BA27C61FD372D7C91C95353B70AD7
Requests: 1 HTTP requests in this frame

Frame: https://secure.rmulus.com/?_pevId=CS1uhb4IHD7uKuApJc5uYRIeuVvdvGCc-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=enabled&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dpgvw%26_pdataSource%3Dweb%26_pqStr%3Denabled%26jnpr_vID%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&jnpr_vID=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pidSource=secure.rmulus.com&_pidName=rmulusId&_pclIp=disabled&_plkpPrfl=disabled
Frame ID: 25998A35F28C3CA5BC7FC95B1DB90FBE
Requests: 1 HTTP requests in this frame

Frame: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
Frame ID: 19841EEEFCE2EC1A0AF3B745C02AB3F5
Requests: 17 HTTP requests in this frame

Frame: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
Frame ID: D8480AB46B95B0132C6223DB062E4A53
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Adobe DTM (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/assets.adobedtm.com\//i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<script[^>]* src=[^>]+fontawesome(?:\.js)?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

169
Requests

100 %
HTTPS

28 %
IPv6

33
Domains

48
Subdomains

42
IPs

8
Countries

4971 kB
Transfer

12267 kB
Size

21
Cookies

115 Outgoing links

These are links going to different origins than the main page.

URL: https://www.juniper.net/us/en/contact-us/
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/
Title:

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/why-juniper/
Title: Why Juniper?

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/case-studies-customer-success/
Title: Customer Success

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/partners/
Title: Partnership

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/insights/
Title: Thought Leadership

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/how-to-buy/
Title: How to Buy

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/
Title: Products & Solutions

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/ipc/
Title: Identity & Policy Control

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/network-edge-services/
Title: Network Edge Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/nos/
Title: Network Operating System

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/packet-optical/
Title: Packet Optical

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/routing/
Title: Routers

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/management-operations-sdn/
Title: SDN, Management & Operations

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/security/
Title: Security

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/switching/
Title: Switches

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/wireless/
Title: Wireless

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/products-services/a-z/
Title: All Products A-Z

Search URL Search Domain Scan URL

URL: https://www.juniper.net/support/eol/
Title: End of Life

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/
Title: Solutions

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/enterprise/
Title: Enterprise

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/cloud/
Title: Cloud Provider

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/service-provider/
Title: Service Provider

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/automation/
Title: Automation

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/metro/
Title: Metro

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/multicloud/
Title: Multicloud

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/security/
Title: Security

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/segment-routing/
Title: Segment Routing

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/sd-wan/
Title: SD-WAN

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/cable/
Title: Cable

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/financial/
Title: Financial Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/federal-government/
Title: Federal Government

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/healthcare/
Title: Healthcare

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/mobile-provider/
Title: Mobile Provider

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/solutions/nfv/telco-cloud/
Title: Telco

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/
Title: Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/advisory-services/
Title: Advisory Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/implementation-services/
Title: Implementation Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/maintenance-services/
Title: Maintenance Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/managed-services/
Title: Managed Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/onsite-technical-services/
Title: Onsite Technical Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/remote-operational-services/
Title: Remote Operational Services

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/services/taas/
Title: Testing as a Service

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/
Title: Support

Search URL Search Domain Scan URL

URL: https://my.juniper.net/#dashboard/overview
Title: MyJuniper

Search URL Search Domain Scan URL

URL: https://my.juniper.net/#dashboard/servicerequests
Title: Service Request Management

Search URL Search Domain Scan URL

URL: https://my.juniper.net/#dashboard/rmas
Title: RMA Management

Search URL Search Domain Scan URL

URL: https://license.juniper.net/licensemanage/
Title: Product License Keys

Search URL Search Domain Scan URL

URL: https://entitlementsearch.juniper.net/entitlementsearch/
Title: Product Entitlement Search

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/uib/index.page
Title: Update Install Base

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/requesting-support/
Title: Contact Support

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/
Title: Downloads

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=ex
Title: EX Series

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=mx
Title: MX Series

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=srx
Title: SRX Series

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=space
Title: Junos Space

Search URL Search Domain Scan URL

URL: https://support.juniper.net/support/downloads/?f=ssg
Title: SSG Series

Search URL Search Domain Scan URL

URL: https://kb.juniper.net/
Title: Knowledge Base

Search URL Search Domain Scan URL

URL: https://www.juniper.net/documentation/
Title: TechLibrary

Search URL Search Domain Scan URL

URL: https://prsearch.juniper.net/InfoCenter/index?page=prsearch
Title: Problem Report Search

Search URL Search Domain Scan URL

URL: https://apps.juniper.net/home/
Title: Pathfinder

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/security/
Title: Security Intelligence

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/security/report-vulnerability/
Title: Report a Vulnerability

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/
Title: Training

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=10735
Title: Schedule of Classes

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=EDU-JUN-ALL-HOME
Title: All Access Training Pass

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=10072
Title: On-demand Courses

Search URL Search Domain Scan URL

URL: https://openlearning.juniper.net/
Title: Open Learning

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=EDU-JUN-LPATHS-HOME
Title: Learning Paths

Search URL Search Domain Scan URL

URL: https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=5798
Title: Getting Started

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/certification/
Title: Certification

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/certification/getting-started/
Title: Getting Started

Search URL Search Domain Scan URL

URL: https://cloud.contentraven.com/junosgenius/login
Title: Practice Tests

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/certification/exam_registration.page
Title: Exam Registration

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/training/certification/recertification/
Title: Recertification

Search URL Search Domain Scan URL

URL: https://www.certmetrics.com/juniper/login.aspx?ReturnUrl=%2fjuniper%2f
Title: Manage My Certs

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/try/
Title: Try Now Risk Free

Search URL Search Domain Scan URL

URL: https://iam-signin.juniper.net/home/junipernetworksinc_forumsjnetlithium_1/0oa1i80jjeoOXVFbx0h8/aln1i80l72sYQypO60h8?RelayState=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478
Title: Sign In

Search URL Search Domain Scan URL

URL: https://userregistration.juniper.net/entitlement/setupAccountInfo.do
Title: Register

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/legal-notices/j-net-terms/
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/legal-notices/j-net-guidelines/
Title: User Guidelines

Search URL Search Domain Scan URL

URL: https://www.juniper.net/customers/support/
Title: Support

Search URL Search Domain Scan URL

URL: http://www.facebook.com/sharer/sharer.php?u=https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Title:

Search URL Search Domain Scan URL

URL: http://twitter.com/share?url=https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478&text=Dota3:%20Is%20your%20Internet%20of%20Things%20device%20moonlighting?via=%3CUSERNAME%3E
Title:

Search URL Search Domain Scan URL

URL: https://plus.google.com/share?url=https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Title:

Search URL Search Domain Scan URL

URL: http://www.linkedin.com/shareArticle?url=https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478&title=Dota3:%20Is%20your%20Internet%20of%20Things%20device%20moonlighting?&summary=Dissecting%20the%20evolution%20of%20malware%20gives%20researchers%20insights%20into%20the%20knowledge%20of,%20and%20development%20processes%20used%20by,%20malware%20authors.%20Dota3,%20active%20in%20the%20wild,%20offers%20a%20unique%20opportunity%20to%20examine%20a%20strain%20of%20malware%20during%20what%20appears%20to%20be...
Title:

Search URL Search Domain Scan URL

URL: http://foo.net/zhyux22843/rss/message?board.id=threatresearch&message.id=473478
Title:

Search URL Search Domain Scan URL

URL: https://www.rfidjournal.com/articles/view?4986
Title: until around 1999

Search URL Search Domain Scan URL

URL: https://blog.avast.com/iot-devices-around-the-world
Title: Avast provided statistics

Search URL Search Domain Scan URL

URL: https://arstechnica.com/science/2020/01/a-deep-dive-into-the-apollo-guidance-computer-and-the-hack-that-saved-apollo-14/
Title: land Apollo astronauts on the moon

Search URL Search Domain Scan URL

URL: https://www.joesandbox.com/analysis/180632/0/html
Title: is available

Search URL Search Domain Scan URL

URL: https://www.hybrid-analysis.com/sample/0f754eab280e5ff0b65c46bdd1cc16e8aff944c834379df2632cd5f261afe3bb?environmentId=300
Title: reported

Search URL Search Domain Scan URL

URL: https://iam-signin.juniper.net/home/junipernetworksinc_forumsjnetlithium_1/0oa1i80jjeoOXVFbx0h8/aln1i80l72sYQypO60h8?redirectreason=permissiondenied&RelayState=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%23comment-on-this
Title: Comment

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/dm/day-one-million/
Title: Day One Million! Update your Library with our Day One Book Bundles!

Search URL Search Domain Scan URL

URL: https://khoros.com/powered-by-khoros

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/
Title: About Us

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/corporate-responsibility/
Title: Corporate Responsibility

Search URL Search Domain Scan URL

URL: https://investor.juniper.net/investor-relations/default.aspx
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://newsroom.juniper.net/
Title: Newsroom

Search URL Search Domain Scan URL

URL: https://events.juniper.net/
Title: Events

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/company/press-center/images/
Title: Image Library

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/partners/locator/
Title: Find a Partner

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/partners/sell-juniper/
Title: Become a Partner

Search URL Search Domain Scan URL

URL: https://partners.juniper.net/partnercenter/index.page
Title: Partner Login

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/forms/opt-in-knowledge-preferences/?utm_medium=website&utm_source=juniper&cid=subscriptionspage
Title: Sign up

Search URL Search Domain Scan URL

URL: https://www.facebook.com/JuniperNetworks/
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/JuniperNetworks/
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/junipernetworks
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/juniper-networks
Title:

Search URL Search Domain Scan URL

URL: https://www.instagram.com/junipernetworks/
Title:

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/feedback/
Title: Feedback

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/site-map/
Title: Site Map

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.juniper.net/us/en/legal-notices/
Title: Legal Notices

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

https://www.juniper.net/techpubs/assets/css/style/style.min.css HTTP 301
https://www.juniper.net/documentation/assets/css/style/style.min.css

Request Chain 46

https://cm.everesttech.net/cm/dd?d_uuid=13190393922453674322869507947391180174 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk5EhwAAAfBVhC3-

Request Chain 62

https://platform.twitter.com/oct.js HTTP 301
https://static.ads-twitter.com/oct.js

Request Chain 63

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3djuniper.net%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3djuniper.net%26pId%3d%24UID HTTP 302
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253djuniper.net%2526pId%253d%2524UID HTTP 302
https://attr.ml-api.io/?domain=juniper.net&pId=2889046330052751243

Request Chain 108

https://5922977.fls.doubleclick.net/activityi;src=5922977;type=pageview;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=916199057962.9031 HTTP 302
https://5922977.fls.doubleclick.net/activityi;dc_pre=CIe2m6nc3-cCFaHjuwgdWiQGsw;src=5922977;type=pageview;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=916199057962.9031

Request Chain 109

https://3872718.fls.doubleclick.net/activityi;src=3872718;type=gojpnet;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7781161242936.281 HTTP 302
https://3872718.fls.doubleclick.net/activityi;dc_pre=CKDCoKnc3-cCFaPjuwgduxoL8A;src=3872718;type=gojpnet;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7781161242936.281

Request Chain 113

https://s1229.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=1229&ref2=elqNone&tzo=-60&ms=137&optin=disabled HTTP 302
https://s1229.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1229&ref2=elqNone&tzo=-60&ms=137&optin=disabled&elqCookie=1 HTTP 302
https://tags.bluekai.com/site/37366?vid=cfa520996ea74eb792b6ee8da12a796c

Request Chain 116

https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
https://segments.company-target.com/log?vendor=choca&user_id=AAFdmE68nIkAAC2wZbYKVg HTTP 303
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAFdmE68nIkAAC2wZbYKVg&verifyHash=602189f75c4b08780dd1d04f96966c76b9045786

Request Chain 120

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-2343305-1&cid=1371404925.1582187655&jid=816593828&gjid=1671516261&_gid=491357842.1582187655&_u=YGDAgEAB~&z=99006382 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=1371404925.1582187655&jid=816593828&_v=j81&z=99006382 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=1371404925.1582187655&jid=816593828&_v=j81&z=99006382&slf_rd=1&random=959123788

Request Chain 154

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/?random=1582187656160&cv=9&fst=1582187656160&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dpage_view%3B_pclId%3Ds4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656%3B_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts%26_plkpKey%5C%3Djnpr_vId%26_plkpPrfl%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_pclPrint%5C%3Dtrue%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts%3B_plkpKey%3Djnpr_vId%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_pclPrint%3Da29d5f7b2fb83ed2db62c131cb65f013%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclIp%3Ddisabled&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/956680084/?random=1582187656160&cv=9&fst=1582185600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dpage_view%3B_pclId%3Ds4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656%3B_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts%26_plkpKey%5C%3Djnpr_vId%26_plkpPrfl%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_pclPrint%5C%3Dtrue%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts%3B_plkpKey%3Djnpr_vId%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_pclPrint%3Da29d5f7b2fb83ed2db62c131cb65f013%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclIp%3Ddisabled&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&is_vtc=1&random=4053247325&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/956680084/?random=1582187656160&cv=9&fst=1582185600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dpage_view%3B_pclId%3Ds4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656%3B_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts%26_plkpKey%5C%3Djnpr_vId%26_plkpPrfl%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_pclPrint%5C%3Dtrue%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts%3B_plkpKey%3Djnpr_vId%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_pclPrint%3Da29d5f7b2fb83ed2db62c131cb65f013%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclIp%3Ddisabled&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&is_vtc=1&random=4053247325&resp=GooglemKTybQhCsO&ipr=y

169 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set 473478 Show response
forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/ 239 KB
49 KB 827ms
334ms Document
text/html 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to

Full URL

https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

d28290639f9ff030dd3d2a375c2050643736a776080d26b272c927aa3c6e9a78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Host: forums.juniper.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

Date: Thu, 20 Feb 2020 08:34:13 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000;includeSubDomains
Set-Cookie: LiSESSIONID=A54DC49911A10913DC3DBAE2D7A7D568; Path=/; Secure; HttpOnly LithiumUserInfo=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ LithiumUserSecure=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ LithiumVisitor=~2CEunBIzs0XfdZpqB~vJ5_R3rllFZjBPDH_ejlRtExRM9gZU1L5_UnHnVIk8op26NLpZnt_FaCj_iqhWe0BgFi4r2MCSmTz9qAawXwcQ..; Expires=Sun, 17-Feb-2030 08:34:13 GMT; Path=/; HttpOnly
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, private
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 49579
Connection: close
Content-Type: text/html;charset=UTF-8

GET
H2 200 satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/ 220 KB
56 KB 131ms
49ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7c9a167fcb4f690dc41db9f58f3ee6a20d3bba39316f2b46c8031c6d8ca300f1

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:22 GMT
server: AkamaiNetStorage
etag: "0857b856340d83f6f1ce4a9b3c416da7:1582139302.127986"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Feb 2020 09:34:13 GMT

GET
H2 200 878544ee83.js Show response
use.fontawesome.com/ 9 KB
4 KB 23ms
21ms Script
text/javascript 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/878544ee83.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 79e16119ceda988947279eb9addd1869b4270af3967b69ec9e09713ae4b6572b

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Thu, 06 Jul 2017 20:04:23 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 4EEB3D29775EC169
etag: W/"734c7204bf19e6c6fe89c31ce2ed51a6"
x-cache: HIT
content-type: text/javascript
status: 200
cache-control: max-age=0, private, must-revalidate
x-amz-id-2: RK+c8kCKiBZO72rmJneiTFy0giGiSBnhU5xBzX/iY5Sc17QXKltB4dBx4L6PsIuKw4InOGTNne8=

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.1.4/ 82 KB
29 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 23 Jan 2020 18:37:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2382993
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29725
x-xss-protection: 0
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Jan 2021 18:37:40 GMT

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 118 KB
19 KB 13ms
11ms Stylesheet
text/css 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: /
Resource Hash: f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: style
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Wed, 12 Dec 2018 18:34:07 GMT
access-control-allow-origin: *
etag: "1544639647"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
status: 200
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 19740

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 36 KB
10 KB 14ms
13ms Script
text/javascript 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: /
Resource Hash: 53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Wed, 12 Dec 2018 18:33:51 GMT
access-control-allow-origin: *
etag: "1544639631"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
status: 200
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 9832

GET
H2 200 juniperresponsive.css
jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/ 2 MB
248 KB 94ms
21ms Stylesheet
text/css 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D55) /

Resource Hash

85d9f9ab745f8b1dd6c6dc27722498c9eaf0f1e864242b01c7f396a5fb3aa3dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Mon, 25 Nov 2019 08:21:03 GMT
server: ECS (lcy/1D55)
age: 475427
vary: Accept-Encoding
x-cache: HIT
content-type: text/css;charset=UTF-8
status: 200
cache-control: s-maxage=1408432
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 253467
expires: Fri, 19 Feb 2021 08:34:13 GMT

GET
H2 200 vtoolkit-extras.css
www.juniper.net/us/en/community/css/ 4 KB
2 KB 28ms
7ms Stylesheet
text/css 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/us/en/community/css/vtoolkit-extras.css

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

626ef4978a3758ced595afe37b89812432ef49fe3f967d2cd8e1321459b3a9b8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
status: 200
access-control-max-age: 1000
strict-transport-security: max-age=31536000
content-length: 1365
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 16 Sep 2014 23:06:53 GMT
server: Apache
date: Thu, 20 Feb 2020 08:34:13 GMT
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=151698
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 grunticon.loader.js Show response
www.juniper.net/assets/svg/ 804 B
1001 B 32ms
11ms Script
application/javascript 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/svg/grunticon.loader.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

b1110f2c7ae9f0a22977c4df6431fdfef92d1e8223f9734713e57aeb2ee96fcf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
status: 200
access-control-max-age: 1000
strict-transport-security: max-age=31536000
content-length: 514
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Mon, 02 Oct 2017 07:57:28 GMT
server: Apache
date: Thu, 20 Feb 2020 08:34:13 GMT
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=136481
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 lib.min.js Show response
www.juniper.net/assets/library/ 202 KB
65 KB 36ms
15ms Script
application/javascript 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/library/lib.min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

eec3860fdc0bff086a73a04051948c4e76ea29a6b61eaa870083739555b83f64

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
status: 200
access-control-max-age: 1000
strict-transport-security: max-age=31536000
content-length: 66076
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Mon, 02 Oct 2017 07:57:27 GMT
server: Apache
date: Thu, 20 Feb 2020 08:34:13 GMT
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=48343
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr.min.js Show response
www.juniper.net/assets/scripts/ 339 KB
103 KB 44ms
22ms Script
application/javascript 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.juniper.net/assets/scripts/jnpr.min.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43 /
Resource Hash: 2c9f1c57bc31c65cdb84a1c44c0c91fc88799512fd87c5bc6e52b21f69abd5d0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Fri, 09 Nov 2018 18:57:29 GMT
server: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43
access-control-allow-origin: *
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: application/javascript
status: 200
access-control-max-age: 1000
cache-control: public, max-age=138814
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
content-length: 104943
x-ua-compatible: IE=edge,chrome=1

GET
H2

200

style.min.css
www.juniper.net/documentation/assets/css/style/
Redirect Chain

https://www.juniper.net/techpubs/assets/css/style/style.min.css
https://www.juniper.net/documentation/assets/css/style/style.min.css

2 MB
404 KB

208ms
208ms

Stylesheet
text/css

2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/documentation/assets/css/style/style.min.css

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

79340c32d5422c3331db60c78f9854b0d9c0a9bd0f9c454b7398734c1b990658

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
status: 200
access-control-max-age: 1000
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Mon, 17 Oct 2016 23:30:57 GMT
server: Apache
date: Thu, 20 Feb 2020 08:34:14 GMT
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=259200, public
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

Redirect headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
status: 301
access-control-max-age: 1000
content-length: 275
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
server: Apache
location: https://www.juniper.net/documentation/assets/css/style/style.min.css
date: Thu, 20 Feb 2020 08:34:13 GMT
strict-transport-security: max-age=31536000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: text/html; charset=iso-8859-1
access-control-allow-origin: *
cache-control: max-age=5
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
expires: Thu, 20 Feb 2020 08:34:18 GMT

GET
H2 200 05cb80fc-3221-476f-983d-76dfa0b1370c.css
cloud.webtype.com/css/ 38 KB
9 KB 87ms
21ms Stylesheet
text/css 93.184.220.41
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cloud.webtype.com/css/05cb80fc-3221-476f-983d-76dfa0b1370c.css
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.41 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D37) /
Resource Hash: 3eadffc329fb1c32ee10e809962cb4114a71d92b0f30db0b9ba9bef6abc91015

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Wed, 31 Jan 2018 08:43:22 GMT
server: ECS (lcy/1D37)
age: 226514
etag: "870837579"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
status: 200
cache-control: max-age=604800
accept-ranges: bytes
access-control-allow-origin: *
content-length: 8995
expires: Thu, 27 Feb 2020 08:34:13 GMT

GET
H2 200 lia-scripts-head-min.js Show response
jnet.i.lithium.com/t5/scripts/EF7B13D9B64EB8BBD9C87DD3095E9284/ 12 KB
4 KB 149ms
77ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/EF7B13D9B64EB8BBD9C87DD3095E9284/lia-scripts-head-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D3F) /

Resource Hash

01eb8f5a91c70faa5681a3048eab75e78f30b4c4e0c04f8afbb46bfa98371ec0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:14:14 GMT
server: ECS (lcy/1D3F)
age: 4512
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=5538
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 4316
expires: Thu, 18 Feb 2021 17:10:58 GMT

GET
H2 200 lia-scripts-head-min.js Show response
jnet.i.lithium.com/t5/scripts/211F6EC4D6F385A1FE3DDCF161E416CD/ 4 KB
2 KB 401ms
331ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/211F6EC4D6F385A1FE3DDCF161E416CD/lia-scripts-head-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

Apache /

Resource Hash

8febd8b0e9b817a31d401574d8f8aaeb5003d76c2c1afa9da932fa0990685b53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:13:41 GMT
server: Apache
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=172
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 1464
expires: Thu, 18 Feb 2021 08:28:03 GMT

GET
H2 200 0%2C1%2C366%2C367
jnet.i.lithium.com/t5/image/serverpage/image-id/20793iA4E55323EA3E0773/image-dimensions/150x150/image-coordinates/ 37 KB
37 KB 28ms
27ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20793iA4E55323EA3E0773/image-dimensions/150x150/image-coordinates/0%2C1%2C366%2C367?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D65) /

Resource Hash

272a2861dab52511f662603420b847ab73e6e13e75e8973c3091bdaa44c51706

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
last-modified: Sat, 15 Feb 2020 00:11:23 GMT
server: ECS (lcy/1D65)
age: 162
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="jesselands.png"; filename*=UTF-8''jesselands.png
accept-ranges: bytes
content-length: 37498
expires: Fri, 19 Feb 2021 08:34:13 GMT

GET
H2 200 684x486
jnet.i.lithium.com/t5/image/serverpage/image-id/20779i3539FA8C153F6E73/image-dimensions/ 533 KB
533 KB 31ms
31ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20779i3539FA8C153F6E73/image-dimensions/684x486?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D1C) /

Resource Hash

70c2868114f52cb3b41e70e017c88ee5f5495639db9d495574e8ced55e7b272f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
last-modified: Wed, 12 Feb 2020 13:27:51 GMT
server: ECS (lcy/1D1C)
age: 162
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="dota3.png"; filename*=UTF-8''dota3.png
accept-ranges: bytes
content-length: 545543
expires: Fri, 19 Feb 2021 08:34:13 GMT

GET
H2 200 503x331
jnet.i.lithium.com/t5/image/serverpage/image-id/20797iC53A9D84A3C97460/image-dimensions/ 115 KB
116 KB 21ms
21ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20797iC53A9D84A3C97460/image-dimensions/503x331?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D50) /

Resource Hash

ec895e944daf4d8226fe560ff1d95437497215d33885fe2d0db0e54ce3db6d96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Wed, 19 Feb 2020 13:08:54 GMT
server: ECS (lcy/1D50)
age: 163
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="Distribution.png"; filename*=UTF-8''Distribution.png
accept-ranges: bytes
content-length: 118086
expires: Fri, 19 Feb 2021 08:34:14 GMT

GET
H2 200 large
jnet.i.lithium.com/t5/image/serverpage/image-id/20782i42844564DAEF47B7/image-size/ 32 KB
32 KB 22ms
21ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20782i42844564DAEF47B7/image-size/large?v=1.0&px=999

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D45) /

Resource Hash

506339130f152becadfa3ab2fbdbab5261035e4f9c343440ec23bc178cdc164a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Wed, 12 Feb 2020 16:32:43 GMT
server: ECS (lcy/1D45)
age: 163
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="dota3-3.png"; filename*=UTF-8''dota3-3.png
accept-ranges: bytes
content-length: 32975
expires: Fri, 19 Feb 2021 08:34:14 GMT

GET
H2 200 large
jnet.i.lithium.com/t5/image/serverpage/image-id/20783i20520A6CAC9212AE/image-size/ 24 KB
24 KB 21ms
21ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20783i20520A6CAC9212AE/image-size/large?v=1.0&px=999

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D1F) /

Resource Hash

4c5ed401667661bca33d013a7bc790e2079bbe0300a1a1d5ad5e5780ae259a4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Wed, 12 Feb 2020 16:34:08 GMT
server: ECS (lcy/1D1F)
age: 163
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="dota3-4.png"; filename*=UTF-8''dota3-4.png
accept-ranges: bytes
content-length: 24746
expires: Fri, 19 Feb 2021 08:34:14 GMT

GET
H2 200 large
jnet.i.lithium.com/t5/image/serverpage/image-id/20784i599AEA1C8ECD5925/image-size/ 30 KB
30 KB 21ms
21ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20784i599AEA1C8ECD5925/image-size/large?v=1.0&px=999

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D6F) /

Resource Hash

e61de02b5fa3204c2ed29bd12fcdceaff8d33d4e9be52ff1a6c02a03a407baea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Wed, 12 Feb 2020 16:34:19 GMT
server: ECS (lcy/1D6F)
age: 163
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="dota3-5.png"; filename*=UTF-8''dota3-5.png
accept-ranges: bytes
content-length: 30545
expires: Fri, 19 Feb 2021 08:34:14 GMT

GET
H2 200 755x496
jnet.i.lithium.com/t5/image/serverpage/image-id/20796i80B748112082D58C/image-dimensions/ 246 KB
247 KB 21ms
21ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20796i80B748112082D58C/image-dimensions/755x496?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D1E) /

Resource Hash

4a3d7f509f217225975b98891f41fde0b216552b35f9a76460e86aaf52454733

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Wed, 19 Feb 2020 13:07:15 GMT
server: ECS (lcy/1D1E)
age: 163
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="Distribution.png"; filename*=UTF-8''Distribution.png
accept-ranges: bytes
content-length: 252266
expires: Fri, 19 Feb 2021 08:34:14 GMT

GET
H2 200 0%2C12%2C398%2C410
jnet.i.lithium.com/t5/image/serverpage/image-id/17505i1378C151B2E2CB8F/image-dimensions/40x40/image-coordinates/ 4 KB
5 KB 33ms
31ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/17505i1378C151B2E2CB8F/image-dimensions/40x40/image-coordinates/0%2C12%2C398%2C410?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D32) /

Resource Hash

30e3f5a97af46d8cb43bf62c9875a8eacfc02c00826ea47549d4e33d0e1aa446

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Fri, 05 Jan 2018 21:00:31 GMT
server: ECS (lcy/1D32)
age: 163
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="paulkimayong.png"; filename*=UTF-8''paulkimayong.png
accept-ranges: bytes
content-length: 4533
expires: Fri, 19 Feb 2021 08:34:14 GMT

GET
H2 200 avatar-17x17.gif
jnet.i.lithium.com/html/images/ 1 KB
1 KB 34ms
32ms Image
image/gif 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/html/images/avatar-17x17.gif

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D3A) /

Resource Hash

bacc031e0bfe9a4084bb166f88193dcdc3498aab6b1d14ebedbb75045afce823

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Tue, 19 Sep 2017 14:30:17 GMT
server: ECS (lcy/1D3A)
age: 222282
etag: W/"1089-1505831417000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/gif
status: 200
accept-ranges: bytes
content-length: 1089

GET
H2 200 0%2C64%2C512%2C576
jnet.i.lithium.com/t5/image/serverpage/image-id/17154i981F324E669B8EEF/image-dimensions/40x40/image-coordinates/ 788 B
1 KB 35ms
33ms Image
image/jpeg 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/17154i981F324E669B8EEF/image-dimensions/40x40/image-coordinates/0%2C64%2C512%2C576?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D61) /

Resource Hash

1d111313a277d37912be5ec29e0d77426d991feb85a04106694b72f66739885b

Security Headers

Name

Value

Content-Security-Policy

connect-src https: wss:; default-src https:; font-src https: data:; frame-ancestors https://forums.juniper.net http://forums.juniper.net http://junipernetworks.lookbookhq.com https://junipernetworks.lookbookhq.com https://jnet.i.lithium.com http://jnet.i.lithium.com; img-src https: data: blob:; media-src https: blob:; script-src 'unsafe-eval' 'unsafe-inline' http://junipernetworks.lookbookhq.com https://junipernetworks.lookbookhq.com https://assets.adobedtm.com https://use.fontawesome.com https://ajax.googleapis.com https://maxcdn.bootstrapcdn.com https://www.juniper.net https://jnet.i.lithium.com https://www.google.ca https://forums.juniper.net https://www.googletagmanager.com; style-src https: blob: 'unsafe-inline';

Strict-Transport-Security

max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

content-security-policy: connect-src https: wss:; default-src https:; font-src https: data:; frame-ancestors https://forums.juniper.net http://forums.juniper.net http://junipernetworks.lookbookhq.com https://junipernetworks.lookbookhq.com https://jnet.i.lithium.com http://jnet.i.lithium.com; img-src https: data: blob:; media-src https: blob:; script-src 'unsafe-eval' 'unsafe-inline' http://junipernetworks.lookbookhq.com https://junipernetworks.lookbookhq.com https://assets.adobedtm.com https://use.fontawesome.com https://ajax.googleapis.com https://maxcdn.bootstrapcdn.com https://www.juniper.net https://jnet.i.lithium.com https://www.google.ca https://forums.juniper.net https://www.googletagmanager.com; style-src https: blob: 'unsafe-inline';
last-modified: Mon, 16 Oct 2017 18:18:34 GMT
server: ECS (lcy/1D61)
age: 163
date: Thu, 20 Feb 2020 08:34:14 GMT
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/jpeg;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="Mounir.jpg"; filename*=UTF-8''Mounir.jpg
accept-ranges: bytes
content-length: 788
expires: Fri, 19 Feb 2021 08:34:14 GMT

GET
H2 200 2%2C0%2C368%2C366
jnet.i.lithium.com/t5/image/serverpage/image-id/20793iA4E55323EA3E0773/image-dimensions/40x40/image-coordinates/ 5 KB
5 KB 36ms
34ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/t5/image/serverpage/image-id/20793iA4E55323EA3E0773/image-dimensions/40x40/image-coordinates/2%2C0%2C368%2C366?v=1.0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D6D) /

Resource Hash

92dc916bc3b1001de758bc7fa95b57046ab5a80f1da16558fe8c8051d331f211

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Sat, 15 Feb 2020 00:11:23 GMT
server: ECS (lcy/1D6D)
age: 163
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png;charset=UTF-8
status: 200
cache-control: max-age=900
content-disposition: inline; filename="jesselands.png"; filename*=UTF-8''jesselands.png
accept-ranges: bytes
content-length: 4777
expires: Fri, 19 Feb 2021 08:34:14 GMT

GET
H2 200 powered_by_khoros.svg
jnet.i.lithium.com/skins/images/E0872AD914481B6897B132EA77B54EA2/responsive_peak/images/ 5 KB
2 KB 36ms
34ms Image
image/svg+xml 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/skins/images/E0872AD914481B6897B132EA77B54EA2/responsive_peak/images/powered_by_khoros.svg

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D2A) /

Resource Hash

44c53106498ced14c80aab52391120b380216ce24de07bb5a91e659fd3ba8aed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
last-modified: Fri, 14 Feb 2020 20:27:33 GMT
server: ECS (lcy/1D2A)
age: 56107
vary: Accept-Encoding
x-cache: HIT
content-type: image/svg+xml;charset=UTF-8
status: 200
cache-control: s-maxage=83898
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1759
expires: Fri, 19 Feb 2021 08:34:14 GMT

GET
H/1.1 200
OK global-nav.js Show response
forumstage.juniper.net/html/assets/ 218 KB
61 KB 668ms
174ms Script
text/javascript 208.74.205.254
LITHIUM

General

Check archive.org

Show headers Download Go to

Full URL

https://forumstage.juniper.net/html/assets/global-nav.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.205.254 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

sjc1-secure06.stage.lithium.com

Software

Apache /

Resource Hash

1451b7c400c9e305f589883bbe1b45139abc74e3c977a8b91fa353dda6a642cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 20 Feb 2020 08:34:14 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 Nov 2019 19:39:15 GMT
Server: Apache
ETag: W/"223725-1574451555000-gzip"
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,Access-Control-Allow-Credentials,Access-Control-Max-Age,Accept-Encoding
Strict-Transport-Security: max-age=31536000;includeSubDomains
Content-Type: text/javascript
Transfer-Encoding: chunked
Connection: close
Accept-Ranges: bytes

GET
H2 200 lia-scripts-angularjs-min.js Show response
jnet.i.lithium.com/t5/scripts/30B7B7689E52F3255F63CF558D0B2099/ 170 KB
59 KB 21ms
21ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/30B7B7689E52F3255F63CF558D0B2099/lia-scripts-angularjs-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D41) /

Resource Hash

18b4b83afed32c0ec228e62a5f1080fbad1ca25addd958a4fc8b30c281fcc031

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:13:46 GMT
server: ECS (lcy/1D41)
age: 647
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=1011
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 60491
expires: Thu, 18 Feb 2021 09:48:49 GMT

GET
H2 200 lia-scripts-angularjsModules-min.js Show response
jnet.i.lithium.com/t5/scripts/C44E419D0E33CF45E26475BACEAD7B0A/ 399 KB
107 KB 22ms
21ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/C44E419D0E33CF45E26475BACEAD7B0A/lia-scripts-angularjsModules-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D74) /

Resource Hash

ed3a677654473b8329f8d886993e734d6cef36c4273263b767be878c9ff8ff44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Fri, 14 Feb 2020 20:34:35 GMT
server: ECS (lcy/1D74)
age: 162
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=390
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 109772
expires: Sat, 13 Feb 2021 21:09:51 GMT

GET
H2 200 lia-scripts-common-min.js Show response
jnet.i.lithium.com/t5/scripts/BDB2760D2C0BCBF59775E7581D371A43/ 329 KB
89 KB 309ms
308ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/BDB2760D2C0BCBF59775E7581D371A43/lia-scripts-common-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

Apache /

Resource Hash

9c3e9a35283d074cbf4f873b077e78b5a8cbd9a8bb4caa5ccc09e0142962a65a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:16:17 GMT
server: Apache
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=24
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 91306
expires: Thu, 18 Feb 2021 08:18:21 GMT

GET
H2 200 lia-scripts-body-min.js Show response
jnet.i.lithium.com/t5/scripts/017CCF1E185FD02333D9F6BBEFAD643F/ 45 KB
12 KB 21ms
21ms Script
text/javascript 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/t5/scripts/017CCF1E185FD02333D9F6BBEFAD643F/lia-scripts-body-min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D41) /

Resource Hash

5b6b9462f29599d5332fa41d67010d03aa0aadb939144caad40e341bd3a2939a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 08:17:14 GMT
server: ECS (lcy/1D41)
age: 163
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: s-maxage=1167
strict-transport-security: max-age=31536000;includeSubDomains
accept-ranges: bytes
content-length: 12285
expires: Thu, 18 Feb 2021 09:57:12 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 374 B
1 KB 130ms
36ms XHR
application/json 52.49.234.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=D206123F524450F50A490D45%40AdobeOrg&d_nsid=0&ts=1582187653812

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.49.234.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-49-234-3.eu-west-1.compute.amazonaws.com

Software

Resource Hash

a7799f05a1e14db4672cacc4139187b2d37f2ad58c12aeef87dcb2e17ec208df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v061-0eeeb2e0a.edge-irl1.demdex.com 5.65.0.20200212140016 3ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: sZHpjKKoQ/0=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://forums.juniper.net
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 308
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/ 74 KB
27 KB 47ms
47ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 9912c03b52a7cb0fc11bde58e200010eca671219552929b31be4c2e26c0e10c3

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:23 GMT
server: AkamaiNetStorage
etag: "b8f6521187f987f1e079c5d7031aabec:1582139303.304738"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 27369
expires: Thu, 20 Feb 2020 09:34:13 GMT

GET
H2 200 satellite-57b12a8364746d4d41000291.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 3 KB
1 KB 42ms
42ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57b12a8364746d4d41000291.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e8a8cd48f7f93a8c8d708eda1f3f9c6ddd886c3f6c38eee67aeac98897b09510

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:42 GMT
server: AkamaiNetStorage
etag: "3b522f8dca2496b57a53408a29d518bb:1582139322.471537"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 984
expires: Thu, 20 Feb 2020 09:34:13 GMT

GET
H2 200 wRPiG49f.min.js Show response
scripts.demandbase.com/adobeanalytics/ 5 KB
2 KB 148ms
39ms Script
application/javascript 143.204.202.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.demandbase.com/adobeanalytics/wRPiG49f.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.92 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-92.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c30c04eb35d4ff5c75690016858f8678b3c5ee7c68ec4cd76b71573b50a23943

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 03:19:43 GMT
content-encoding: gzip
last-modified: Tue, 29 Oct 2019 22:00:33 GMT
server: AmazonS3
age: 18872
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: AzsFJIGyGDhT_pDrBVxBwyrIy6KuSZqJ
status: 200
x-amz-cf-pop: FRA53-C1
content-type: application/javascript
x-amz-cf-id: aScXeeiK_TsbKYZpcXmL_JaMWuZkKRpiz6DbA3kPWPAySoI0x8UYmA==
via: 1.1 f960fa0538fdb326fc338e984fa7ece9.cloudfront.net (CloudFront)

GET
H/1.1 200
OK ip.json Show response
api.demandbase.com/api/v2/ 1 KB
1 KB 410ms
81ms Script
application/javascript 13.35.253.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.demandbase.com/api/v2/ip.json?key=364bbfa27ca300ef9638e9d163c1fb03&callback=Dmdbase_CDC.callback
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-23.fra6.r.cloudfront.net
Software: nginx /
Resource Hash: d747a00f20356103c97532afe702f4b89a04a67d45474e6a157d82d649ddb692

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 20 Feb 2020 08:34:14 GMT
Identification-Source: CACHE
X-Amz-Cf-Pop: FRA6-C1
Transfer-Encoding: chunked
X-Cache: Miss from cloudfront
Connection: keep-alive
Request-ID: c05c13c1-2a4c-441a-8c95-b71350cacc83
Content-Encoding: gzip
Pragma: no-cache
Server: nginx
Vary: Accept-Encoding, Origin
Content-Type: application/javascript;charset=utf-8
Via: 1.1 62dc260e32d7b9197a4511447f6a264a.cloudfront.net (CloudFront)
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Api-Version: v2
X-Amz-Cf-Id: 3MM3DAzRZV0OwaIrVcjn4BUVAF3crE7zvYY2jGdLaHe1q_ZkminfCg==
Expires: Wed, 19 Feb 2020 08:34:14 GMT

GET
H2 200 satellite-5bd31e9364746d6b860045a0.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 883 B
679 B 44ms
44ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5bd31e9364746d6b860045a0.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 179f42988ae4cab77687b27656fc69ab3fa07efbcf6279ac1bef85ac0688e69d

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:37 GMT
server: AkamaiNetStorage
etag: "b3998ca07afe5ed1d91aa042d31218db:1582139317.320586"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 434
expires: Thu, 20 Feb 2020 09:34:13 GMT

GET
H2 200 satellite-57d9c57464746d4d3e010a86.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 2 KB
1001 B 42ms
42ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57d9c57464746d4d3e010a86.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7ee39e6b76207efc841a6882a2af5241490e1a2161c4e13790f78fb4dbfdde28

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 15:13:07 GMT
server: AkamaiNetStorage
etag: "458ad1cb95d004fd440d76d56ca277df:1582125187.473863"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 755
expires: Thu, 20 Feb 2020 09:34:13 GMT

GET
H2 200 satellite-58a48a3864746d025c00d79f.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 156 B
373 B 44ms
43ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-58a48a3864746d025c00d79f.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7da66ec546c027bfe5b9ca59aa2225cfaa5f0d68f96801f31186878c0fa853f8

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:37 GMT
server: AkamaiNetStorage
etag: "bbf4e24515459a70357a852ca14861ff:1582139317.03016"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 129
expires: Thu, 20 Feb 2020 09:34:13 GMT

GET
H2 200 satellite-5cb8c2a664746d2308000a38.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 628 B
672 B 49ms
47ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5cb8c2a664746d2308000a38.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c74679537a89890b260d93e19aad5f4cc95a230623a945ffcc3d981fc13a1adf

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:34 GMT
server: AkamaiNetStorage
etag: "d0c9f868e386e1a9e35ae77ce39994c4:1582139314.935187"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 427
expires: Thu, 20 Feb 2020 09:34:14 GMT

GET
H2 200 satellite-5ced369c64746d5ad2000705.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 802 B
663 B 50ms
49ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5ced369c64746d5ad2000705.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3e84bcc6469e170029339c0b60b522671ca5d4298578308ec882df95f7badd9c

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:35 GMT
server: AkamaiNetStorage
etag: "95e1885cf743f564cb30ce957416ea37:1582139315.859817"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 417
expires: Thu, 20 Feb 2020 09:34:14 GMT

GET
H2 200 satellite-5da0c41564746d1a08001540.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 421 B
515 B 50ms
49ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5da0c41564746d1a08001540.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e28195ef556c2e1f2d22ff939f487f10a32e608255bbd541be3eda5883b414c3

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
last-modified: Fri, 14 Feb 2020 12:36:54 GMT
server: AkamaiNetStorage
etag: "c6bf9762b7fcef23638a4087e99a0057:1581683814.317035"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 270
expires: Thu, 20 Feb 2020 09:34:14 GMT

GET
H2 200 878544ee83.css
use.fontawesome.com/ 1 KB
688 B 21ms
20ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/878544ee83.css
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/878544ee83.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 9e5b8d4ced66c172dc84f16051eee4bac1e0fc60781c1ea05d73072b3cc7ddf1

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Thu, 06 Jul 2017 20:04:23 GMT
server: NetDNA-cache/2.2
x-amz-request-id: 5EEFA4AA0077B418
etag: W/"44b78b10e53fb4ffb2d9c54f11d4eb0f"
x-cache: HIT
content-type: text/css
status: 200
cache-control: max-age=0, private, must-revalidate
x-amz-id-2: xL/7cF7VcxWH5vFL87yNYy+qxXw+W7x70k33NvSTvD4BT14+rFt09x6IIyKBnwXl/ZjxJ++pDAo=

GET
H2 200 css
fonts.googleapis.com/ 2 KB
564 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:300,400,700

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f7d6b1c8e88874fb2696fc3128ea91fc6f47915466ea9f566ab2c39fcebffbd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 08:34:13 GMT
server: ESF
date: Thu, 20 Feb 2020 08:34:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 20 Feb 2020 08:34:13 GMT

GET
H2 200 font-awesome-css.min.css
use.fontawesome.com/releases/v4.7.0/css/ 30 KB
8 KB 23ms
23ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v4.7.0/css/font-awesome-css.min.css
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5b9573e1023da775390e9284ec0eb1c606df9b468a28980055b4a6aa804f4350

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Thu, 20 Feb 2020 08:34:13 GMT
content-encoding: gzip
last-modified: Tue, 25 Oct 2016 17:21:58 GMT
server: NetDNA-cache/2.2
access-control-allow-origin: *
etag: W/"36082410df2ef7f83932219089dc1443"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
status: 200
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 id Show response
junipernetworks.d2.sc.omtrdc.net/ 2 B
320 B 929ms
251ms XHR
application/x-javascript 18.139.76.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://junipernetworks.d2.sc.omtrdc.net/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=D206123F524450F50A490D45%40AdobeOrg&mid=19933235249669886553329589763479381097&ts=1582187653957

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.139.76.45 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-139-76-45.ap-southeast-1.compute.amazonaws.com

Software

jag /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Thu, 20 Feb 2020 08:34:14 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-665bcdccf8-gtrb4
vary: Origin
x-c: master-1169.Ie4359b.M0-349
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://forums.juniper.net
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 2
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=Xk5EhwAAAfBVhC3-
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=13190393922453674322869507947391180174
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk5EhwAAAfBVhC3-

42 B
915 B

33ms
32ms

Image
image/gif

52.49.234.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk5EhwAAAfBVhC3-

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.49.234.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-49-234-3.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v061-0dc18f3a9.edge-irl1.demdex.com 5.65.0.20200212140016 1ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: 870HM8P7QtM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Thu, 20 Feb 2020 08:34:14 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xk5EhwAAAfBVhC3-
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 fontawesome-webfont.woff2
jnet.i.lithium.com/html/assets/fonts/ 55 KB
56 KB 84ms
21ms Font
application/octet-stream 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/html/assets/fonts/fontawesome-webfont.woff2?v=4.3.0

Requested by

Host: use.fontawesome.com
URL: https://use.fontawesome.com/878544ee83.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D4A) /

Resource Hash

aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Fri, 14 Feb 2020 20:27:39 GMT
server: ECS (lcy/1D4A)
age: 416795
etag: W/"56780-1581712059000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: application/octet-stream
status: 200
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56780

GET
H2 404 fontawesome.woff
jnet.i.lithium.com/skins/4081847/fonts/ 0
0 384ms
321ms Font
text/html 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/skins/4081847/fonts/fontawesome.woff

Requested by

Host: use.fontawesome.com
URL: https://use.fontawesome.com/878544ee83.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 20 Feb 2020 08:34:14 GMT
server: Apache
access-control-allow-origin: *
content-length: 866
strict-transport-security: max-age=31536000;includeSubDomains
content-type: text/html;charset=utf-8

GET
H2 404 fontawesome.ttf
jnet.i.lithium.com/skins/4081847/fonts/ 0
0 328ms
327ms Font
text/html 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/skins/4081847/fonts/fontawesome.ttf

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 20 Feb 2020 08:34:14 GMT
server: Apache
access-control-allow-origin: *
content-length: 866
strict-transport-security: max-age=31536000;includeSubDomains
content-type: text/html;charset=utf-8

GET
H/1.1 200
OK Cookie set dest5.html
junipernetworks.demdex.net/ Frame 84FC 0
0 172ms
38ms Document
text/html 52.212.4.209
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://junipernetworks.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.212.4.209 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-212-4-209.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: junipernetworks.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=13190393922453674322869507947391180174
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 19 Feb 2020 12:42:05 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=13190393922453674322869507947391180174;Path=/;Domain=.demdex.net;Expires=Tue, 18-Aug-2020 08:34:14 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: NyRIwtCXTrA=
Content-Length: 2785
Connection: keep-alive

GET
H/1.1 200
OK BBBthreatresearchportal.jpeg
forums.juniper.net/html/assets/ 105 KB
105 KB 495ms
168ms Image
image/jpeg 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forums.juniper.net/html/assets/BBBthreatresearchportal.jpeg

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

ad9e90d9b2ef8c8af06afa88f231a5cf0dff89eb5c47a948dfbde3c856c7db39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 20 Feb 2020 08:34:14 GMT
Last-Modified: Mon, 12 Mar 2018 23:05:28 GMT
Server: Apache
ETag: W/"107422-1520895928000"
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,Access-Control-Allow-Credentials,Access-Control-Max-Age
Content-Type: image/jpeg
Connection: close
Strict-Transport-Security: max-age=31536000;includeSubDomains
Accept-Ranges: bytes
Content-Length: 107422

GET
H/1.1 200
OK v.gif
pls.webtype.com/ 807 B
1 KB 508ms
115ms Image
image/gif 65.52.62.25
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pls.webtype.com/v.gif?ct=182296,182293,182299,182294,182298,182295,182297,182293,182294,182298,182295,182297,182299,182296,182299,182298,182293,182296,182295,182294,182297,182296,182297,182295,182294,182298,182293,182299&r=71911&p=68690&h=Hzc0I5MIWElYX3SnOIHSGw%3d%3d
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 65.52.62.25 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d

Request headers

Referer: https://cloud.webtype.com/css/05cb80fc-3221-476f-983d-76dfa0b1370c.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 20 Feb 2020 08:34:13 GMT
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: no-cache
Content-Length: 807
Expires: -1

GET
H2 200 Lato-Regular.woff2
jnet.i.lithium.com/html/assets/ 178 KB
179 KB 22ms
21ms Font
application/octet-stream 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/html/assets/Lato-Regular.woff2

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D4E) /

Resource Hash

983b0caf336e8542214fc17019a4fc5e0360864b92806ca14d55c1fc1c2c5a0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Tue, 25 Sep 2018 18:37:35 GMT
server: ECS (lcy/1D4E)
age: 225865
etag: W/"182708-1537900655000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: application/octet-stream
status: 200
accept-ranges: bytes
access-control-allow-origin: *
content-length: 182708

GET
H2 200 search.png
jnet.i.lithium.com/html/assets/ 1 KB
1 KB 22ms
21ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/html/assets/search.png

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D1F) /

Resource Hash

847ad7d2d327222488e06177809a66d0517d53362838b94dfd3f1961d209d8b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Tue, 19 Sep 2017 14:30:17 GMT
server: ECS (lcy/1D1F)
age: 224496
etag: W/"1135-1505831417000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 1135

GET
H/1.1 200
OK DayOneMillionBanner.png
forumstage.juniper.net/html/assets/ 970 KB
970 KB 491ms
168ms Image
image/png 208.74.205.254
LITHIUM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forumstage.juniper.net/html/assets/DayOneMillionBanner.png

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.205.254 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

sjc1-secure06.stage.lithium.com

Software

Apache /

Resource Hash

3928a8be3b073b7b4272b3863934222d52f00e782a0d157b9b7edfd7acf1bfbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 20 Feb 2020 08:34:14 GMT
Strict-Transport-Security: max-age=31536000;includeSubDomains
Last-Modified: Fri, 26 Apr 2019 21:22:32 GMT
Server: Apache
ETag: W/"992924-1556313752000"
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,Access-Control-Allow-Credentials,Access-Control-Max-Age
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 992924

GET
H2 200 AcceptedSolutionsBanner.png
jnet.i.lithium.com/html/assets/ 188 KB
188 KB 21ms
21ms Image
image/png 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jnet.i.lithium.com/html/assets/AcceptedSolutionsBanner.png

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D3D) /

Resource Hash

cac7a767eecdd70123f853d74d1fb29d15cb89dfd93215b57dce2606b4cd1c23

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Thu, 03 May 2018 22:11:29 GMT
server: ECS (lcy/1D3D)
age: 224738
etag: W/"192650-1525385489000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 192650

GET
H2 200 Lato-Bold.woff2
jnet.i.lithium.com/html/assets/ 181 KB
181 KB 28ms
27ms Font
application/octet-stream 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/html/assets/Lato-Bold.woff2

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D1B) /

Resource Hash

ae88fc0d7a961832f809527d30bd3983a6866d42f66a56ade23f543681594db6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Tue, 25 Sep 2018 18:21:34 GMT
server: ECS (lcy/1D1B)
age: 225862
etag: W/"184912-1537899694000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: application/octet-stream
status: 200
accept-ranges: bytes
access-control-allow-origin: *
content-length: 184912

GET
H2 200 FontAwesome.otf
jnet.i.lithium.com/html/assets/ 48 KB
48 KB 44ms
44ms Font
application/x-font-otf 93.184.220.97
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://jnet.i.lithium.com/html/assets/FontAwesome.otf

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.97 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (lcy/1D1D) /

Resource Hash

e5d717d2c24e52afc0e139b41d817580583acad2e3c9d725d1bd46f0f7e5cb1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://jnet.i.lithium.com/skins/4081847/3a15f4ae547f35604a6d65274a42ee62/juniperresponsive.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Tue, 19 Sep 2017 14:30:17 GMT
server: ECS (lcy/1D1D)
age: 222768
etag: W/"48748-1505831417000"
strict-transport-security: max-age=31536000;includeSubDomains
x-cache: HIT
content-type: application/x-font-otf
status: 200
accept-ranges: bytes
access-control-allow-origin: *
content-length: 48748

GET
H2 200 a0cedc3e-6840-426e-97b1-3c84003749db
cloud.webtype.com/webtype/ff2/3/ 55 KB
55 KB 88ms
22ms Font
application/octet-stream 93.184.220.41
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cloud.webtype.com/webtype/ff2/3/a0cedc3e-6840-426e-97b1-3c84003749db?ec_token=8f7c4c4997246fd7fa920371cd943b561cc1376e933e830d08e6b0683939639d404785f456ee32575101d725923746fca6e69ff51fcfe5b050225f7c73898261a8782877c56c75752b53bd7904d2031d391fe58f03b9699949fd97a6a2ff0e846b9b5f7b238ef0e3e218f881633f84a6df8f6e3c42389b1f2ede2dd7cf99517d94747b6b1931154fae658ce8ed6ce4ae462da9a2caf5829564405b9a4734ebc0468dd1924c31ed0fbbcc1f8f3738b30362a8434fa1f27b11671762c5ca8e3dc1215a83fb6889348f3eb94edaa393481a20d66c33d733092de1f6e0d3d8f7bdc0195d51e35058fd4bd2cd093b03b5bb12f6144c99d0aff4&ec_token=8f7c4c4997246fd7fa920376cc943b5654522473d8a897cacca97149c4e47f6f58194b50d81812299938889f52af0c1606db01f5be73b0deef52167fa79f12b243aff40a15ac84109f59783d30e511148a6dae4a711358f22b6206a2f996042606d5449df7366ee850657c2e998ae60e1825a00958d3ce1c5e7085a3d6eb82a8614189a4023ff9c5bdd7b05a25fe732e7b1b66d3387e3b492e8886adbde3cfee77939e8d1f63817ab735b2504ec31754c9241fa74730508eca7af76aeb3c0a684994a21e0356e79ee6b3bb4ab55048106ca56cd7bb487524c384b9adf60e1944e2450c73f7e1b30ae197ac26
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 93.184.220.41 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lcy/1D3D) /
Resource Hash: 4ded81a3d2fd6dd9c1240d80be198e98eb78db7dc4e3e525fd21ffc0c05efbcd

Request headers

Referer: https://cloud.webtype.com/css/05cb80fc-3221-476f-983d-76dfa0b1370c.css
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Fri, 23 Oct 2015 21:28:48 GMT
server: ECS (lcy/1D3D)
age: 223715
etag: "657538501"
x-cache: HIT
content-type: application/octet-stream
status: 200
cache-control: max-age=604800
accept-ranges: bytes
access-control-allow-origin: *
content-length: 56080
expires: Thu, 27 Feb 2020 08:34:14 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 126 KB
30 KB 6ms
5ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5cb8c2a664746d2308000a38.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: 6AVz/XBH1PgeUy2TWrNvMQZU/icIivLuUZTqy/MZkbhZrlEntpdGxESAerYHUUZYLqb5frzzuBbpI1yeVKrceQ==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:34:14 GMT, Thu, 20 Feb 2020 08:34:14 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 40ms
40ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5ced369c64746d5ad2000705.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
age: 1198
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-fra19148-FRA
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1582187655.556721,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2

200

oct.js Show response
static.ads-twitter.com/
Redirect Chain

https://platform.twitter.com/oct.js
https://static.ads-twitter.com/oct.js

5 KB
2 KB

42ms
39ms

Script
application/javascript

151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/oct.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
age: 1193
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-fra19148-FRA
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1582187655.684932,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

Redirect headers

date: Thu, 20 Feb 2020 08:34:14 GMT
location: https://static.ads-twitter.com/oct.js
vary
x-cache: HIT
tw-cdn: FT
status: 301
accept-ranges: bytes
content-length: 0
retry-after: 0
x-served-by: cache-fra19178-FRA

GET
H/1.1

200
OK

/
attr.ml-api.io/
Redirect Chain

https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3djuniper.net%26pId%3d%24UID
https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3djuniper.net%26pId%3d%24UID
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253djuniper.net%2526pId%253d%2524UID
https://attr.ml-api.io/?domain=juniper.net&pId=2889046330052751243

4 B
485 B

620ms
454ms

Image
image/jpeg

143.204.202.123
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://attr.ml-api.io/?domain=juniper.net&pId=2889046330052751243
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.123 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-123.fra53.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 20 Feb 2020 08:34:15 GMT
Via: 1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
x-amzn-RequestId: 0188bb3e-acff-441c-ab25-faddc7908395
X-Cache: Miss from cloudfront
Content-Type: image/jpeg
X-Amzn-Trace-Id: Root=1-5e4e4487-9a7ad71bbfccd3b8c569d0b7;Sampled=0
Connection: keep-alive
x-amz-apigw-id: IL-lMGbZIAMFhCw=
Content-Length: 4
X-Amz-Cf-Id: jPIxY8oliuAOUIudRmyLn0GvJIVOa5sYEkMVhn3_ryY-rUp70rkHfQ==

Redirect headers

Pragma: no-cache
Date: Thu, 20 Feb 2020 08:34:17 GMT
AN-X-Request-Uuid: 50d6763d-6995-43fa-903f-f421ce5203ad
Content-Type: text/html; charset=utf-8
Server: nginx/1.13.4
Location: https://attr.ml-api.io/?domain=juniper.net&pId=2889046330052751243
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 185.38.150.96; 185.38.150.96; 317.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.141:80
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 437764526963678 Show response
connect.facebook.net/signals/config/ 447 KB
112 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/437764526963678?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bef8b6a5f4399be5da990490ceee7525da2698723a003af12b7095f03a78a34f

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 114931
x-xss-protection: 0
pragma: public
x-fb-debug: G8Q9C71XsLTu9l76c7/3w1IFPqoD2pgBnL2Ilcpzp8735W4HSuIJilH2cq2scuG2NzkwMDzkdgvyLKsBc+fXVQ==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:34:14 GMT, Thu, 20 Feb 2020 08:34:14 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
119 B 142ms
141ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1lnh&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:14 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f92b85055e49495e84b6cdae183a919d
x-transaction: 0092e90100fa0f91
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
124 B 142ms
142ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1oeb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 115
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:14 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f92b85055e49495e84b6cdae183a919d
x-transaction: 003c6320006fac0c
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
120 B 143ms
142ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nvrg6&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:14 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f92b85055e49495e84b6cdae183a919d
x-transaction: 0063a8d8002bfdbe
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
171 B 129ms
129ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o29di&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 108
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:14 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f92b85055e49495e84b6cdae183a919d
x-transaction: 00a7b1f80080f743
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
125 B 134ms
133ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o2i9x&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 113
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:14 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f92b85055e49495e84b6cdae183a919d
x-transaction: 00ff5ddc00b95e77
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
251 B 7ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=437764526963678&ev=PageView&dl=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&rl=&if=false&ts=1582187654681&cd[jnpr_vId]=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&sw=1600&sh=1200&v=2.9.15&r=stable&ec=0&o=29&fbp=fb.1.1582187654680.1942104099&it=1582187654638&coo=false&rqm=GET

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT, Thu, 20 Feb 2020 08:34:14 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-24=":443"; ma=3600
content-length: 44
expires: Thu, 20 Feb 2020 08:34:14 GMT

GET
H2 200 jnpr-logo.svg Show response
www.juniper.net/assets/svg/ 3 KB
2 KB 27ms
7ms XHR
image/svg+xml 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.juniper.net/assets/svg/jnpr-logo.svg
Requested by: Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43 /
Resource Hash: 57f53d1b65316e7362b02a42d2a07319fcd3a8d75f2dc91d0094caf98181c741

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
last-modified: Fri, 02 Nov 2018 05:55:25 GMT
server: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43
status: 200
vary: Accept-Encoding
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: public, max-age=29368
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token
content-length: 1502
x-ua-compatible: IE=edge,chrome=1

GET
H2 200 jnpr-social-icon_jnet.svg Show response
www.juniper.net/assets/icons/social/ 976 B
1 KB 24ms
13ms XHR
image/svg+xml 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_jnet.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

6b8797e0cf30f8a00ff41912ebcc895055ffeb426b34f70c4933b9828b1ca720

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 563
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:34:14 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=137686
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_facebook.svg Show response
www.juniper.net/assets/icons/social/ 366 B
755 B 19ms
9ms XHR
image/svg+xml 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_facebook.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

7ff5a2ce1b7603d6e9f61f85587efe96cbed61d71ace91bcc6ca7d0bc07cc7ce

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 273
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:34:14 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=138542
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_twitter.svg Show response
www.juniper.net/assets/icons/social/ 582 B
856 B 20ms
10ms XHR
image/svg+xml 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_twitter.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

15c14a35beeabe632f718ce14189ade1b8b6760b977e1e8149b5e1211d3efde5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 374
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:34:14 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=204564
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_youtube.svg Show response
www.juniper.net/assets/icons/social/ 451 B
789 B 21ms
12ms XHR
image/svg+xml 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_youtube.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

c6846556479addb85175eb801d75cd64485ccec53b42fac54441fef1895c0408

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 307
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:34:14 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=141489
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_linkedin.svg Show response
www.juniper.net/assets/icons/social/ 724 B
926 B 12ms
8ms XHR
image/svg+xml 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_linkedin.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache /

Resource Hash

70349fe86be7c6dcd4062011d02d91185a4a45b60e2826f05985d67f8ae43bd3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 443
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Tue, 25 Sep 2018 21:30:52 GMT
server: Apache
date: Thu, 20 Feb 2020 08:34:14 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=137888
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 jnpr-social-icon_instgram.svg Show response
www.juniper.net/assets/icons/social/ 1 KB
1 KB 15ms
11ms XHR
image/svg+xml 2a02:26f0:6c00:180::720
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.juniper.net/assets/icons/social/jnpr-social-icon_instgram.svg

Requested by

Host: forumstage.juniper.net
URL: https://forumstage.juniper.net/html/assets/global-nav.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:180::720 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43 /

Resource Hash

e8d5b01af589f68a0f2da663d3efc472fabb22d9ede91a7ffcf74d21e6295506

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests; frame-ancestors *.juniper.net https://juniper.highspot.com https://junipernetworks.lookbookhq.com
content-encoding: gzip
vary: Accept-Encoding
status: 200
strict-transport-security: max-age=31536000
content-length: 569
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge,chrome=1
last-modified: Mon, 03 Dec 2018 20:00:23 GMT
server: Apache/2.4.33 (Unix) OpenSSL/1.0.2k-fips mod_jk/1.2.43
date: Thu, 20 Feb 2020 08:34:14 GMT
access-control-max-age: 1000
access-control-allow-methods: POST, GET, OPTIONS, PUT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=37218
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token

GET
H2 200 satellite-5c4d601564746d128d00351a.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 2 KB
1 KB 44ms
41ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5c4d601564746d128d00351a.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 8a3e8d4242f53959806c3ebf262affb1bd5a78e361acb2d5bf14be201ee56a3e

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:54 GMT
server: AkamaiNetStorage
etag: "ef3e8222ffd66f5f29d86b509a85a361:1582139334.431118"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 802
expires: Thu, 20 Feb 2020 09:34:14 GMT

GET
H2 200 satellite-5c86baad64746d44c9006139.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 2 KB
1 KB 44ms
41ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5c86baad64746d44c9006139.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5855809ae723b4a35f3120be99dccfc8403b3dd379fd86efeacdad8767ea6320

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:54 GMT
server: AkamaiNetStorage
etag: "64cd50749dbcff7576118000c8ee8376:1582139334.752199"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 831
expires: Thu, 20 Feb 2020 09:34:14 GMT

GET
H2 200 satellite-5a1c307e64746d671f007214.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 970 B
738 B 44ms
40ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5a1c307e64746d671f007214.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: db0031471b3f9181ff21d83674674ac3dd7c128531fae90bc274ad0e17c58c37

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 15:13:20 GMT
server: AkamaiNetStorage
etag: "e98792ce8e8b853475368de93200623c:1582125200.040193"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 493
expires: Thu, 20 Feb 2020 09:34:14 GMT

GET
H2 200 satellite-57ae0e9e64746d5a2c001384.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 756 B
610 B 45ms
41ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57ae0e9e64746d5a2c001384.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4c891889ca55d5cadf9e960d2e40f31f50ac0b6252417a9be7414ff2f26a3880

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:46 GMT
server: AkamaiNetStorage
etag: "32b2fa1768d41f11552b05c7f7bc9543:1582139326.73257"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 365
expires: Thu, 20 Feb 2020 09:34:14 GMT

GET
H2 200 satellite-57b12af264746d361f00027e.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 148 B
391 B 43ms
42ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57b12af264746d361f00027e.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: b8eea75e456823a6e0eebfa1e4f27b56395485fff2bbf27e0344f7bf4fa8e509

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:42 GMT
server: AkamaiNetStorage
etag: "a29c925184c82cbaaeea213863aa74d1:1582139322.029758"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 147
expires: Thu, 20 Feb 2020 09:34:14 GMT

GET
H2 200 s-code-contents-aa1e4404cdb04849f2f22e6dd3789ac4f10a9afd.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/ 35 KB
13 KB 43ms
41ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/s-code-contents-aa1e4404cdb04849f2f22e6dd3789ac4f10a9afd.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: e931faaef092c8d98a58ac536216378f58e2a17a4833bbe5f9a29e5bbed849f6

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 15:13:04 GMT
server: AkamaiNetStorage
etag: "0c13f2b0bfa3779da7f5bdb2ff4d1d29:1582125184.807562"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 13480
expires: Thu, 20 Feb 2020 09:34:14 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 247 KB
47 KB 16ms
15ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MHNPL3

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4cdde47aa921b0cc562b8cadb9366ea11d83bd0f27d3aa2e4ab8c22486f592d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 48480
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 20 Feb 2020 08:34:14 GMT

GET
H/1.1 200
OK ng-messages Show response
forums.juniper.net/jnet/api/2.0/ui/lang/ 2 KB
1 KB 480ms
164ms XHR
application/json 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to

Full URL

https://forums.juniper.net/jnet/api/2.0/ui/lang/ng-messages?board.id=threatresearch

Requested by

Host: jnet.i.lithium.com
URL: https://jnet.i.lithium.com/t5/scripts/30B7B7689E52F3255F63CF558D0B2099/lia-scripts-angularjs-min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

4dcc161d0ef98a2c9c1b776a90ab5c284032d8a333964620545bf1ceee13ac89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json
Accept: application/json, text/plain, */*
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Application-Version: 2.0.0
Sec-Fetch-Dest: empty
If-Modified-Since: Thu, 01 Jan 1970 00:00:00 GMT
Application-Identifier: DESKTOP

Response headers

Date: Thu, 20 Feb 2020 08:34:15 GMT
Content-Encoding: gzip
Server: Apache
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method,Access-Control-Allow-Credentials,Access-Control-Max-Age,Accept-Encoding
Content-Type: application/json;charset=UTF-8
Connection: close
Strict-Transport-Security: max-age=31536000;includeSubDomains
Content-Length: 842

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v16/ 14 KB
14 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Host: jnet.i.lithium.com
URL: https://jnet.i.lithium.com/t5/scripts/BDB2760D2C0BCBF59775E7581D371A43/lia-scripts-common-min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Lato:300,400,700
Origin: https://forums.juniper.net
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Jan 2020 18:51:41 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:45:55 GMT
server: sffe
age: 2382153
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 14044
x-xss-protection: 0
expires: Fri, 22 Jan 2021 18:51:41 GMT

GET
H/1.1 204
No Content 165804788886_1582187653501.gif
forums.juniper.net/beacon/ 0
568 B 513ms
164ms Image
image/gif 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forums.juniper.net/beacon/165804788886_1582187653501.gif

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Pragma: no-cache
Date: Thu, 20 Feb 2020 08:34:15 GMT
Last-Modified: Fri, 02 Nov 2007 00:36:01 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000;includeSubDomains
Content-Type: image/gif
Cache-Control: private, no-cache, no-cache="Set-Cookie", proxy-revalidate
Connection: close
Content-Length: 0
Expires: Thu, 22 Jan 1976 08:28:00 GMT

GET
H2 200 satellite-5955f42064746d6e6f0053bb.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 378 B
529 B 40ms
40ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5955f42064746d6e6f0053bb.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7b08b6c86fb4d51c3e96dd3f06ed35c02b7f0662404fb6b14b9b2b0425a9e28a

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:14 GMT
content-encoding: gzip
last-modified: Fri, 14 Feb 2020 12:36:56 GMT
server: AkamaiNetStorage
etag: "3b6d86978dcd31eae399835883bb4dfa:1581683816.749645"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 283
expires: Thu, 20 Feb 2020 09:34:14 GMT

GET
H2 200 satellite-5caeb27864746d4fde0010d0.html
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ Frame D7C8 0
0 40ms
40ms Document
text/html 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5caeb27864746d4fde0010d0.html
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash

Request headers

:method: GET
:authority: assets.adobedtm.com
:scheme: https
:path: /998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5caeb27864746d4fde0010d0.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
accept-ranges: bytes
content-type: text/html
etag: "99efb13f2ce40bcc3d8c60d4557d2185:1582139314.215093"
last-modified: Wed, 19 Feb 2020 19:08:34 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=3600
expires: Thu, 20 Feb 2020 09:34:14 GMT
date: Thu, 20 Feb 2020 08:34:14 GMT
content-length: 810
timing-allow-origin: *

GET
H2 200 satellite-5d487bc864746d25bd00073a.html
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ Frame A056 0
0 40ms
40ms Document
text/html 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5d487bc864746d25bd00073a.html
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash

Request headers

:method: GET
:authority: assets.adobedtm.com
:scheme: https
:path: /998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5d487bc864746d25bd00073a.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
accept-ranges: bytes
content-type: text/html
etag: "6f794f7bf8d2cbee9f48532e60fe0435:1582125186.77754"
last-modified: Wed, 19 Feb 2020 15:13:06 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=3600
expires: Thu, 20 Feb 2020 09:34:14 GMT
date: Thu, 20 Feb 2020 08:34:14 GMT
content-length: 654
timing-allow-origin: *

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
238 B 141ms
140ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1lnh&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 119
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:15 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 283bdf3b75a40c60d5ae6e80d8c84dd7
x-transaction: 006db6e50037cd64
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
238 B 140ms
139ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 118
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:15 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 283bdf3b75a40c60d5ae6e80d8c84dd7
x-transaction: 002078d800978a34
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
285 B 137ms
136ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nvrg6&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:15 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 283bdf3b75a40c60d5ae6e80d8c84dd7
x-transaction: 00291bb600875e36
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
234 B 140ms
139ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o29di&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 118
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:15 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 283bdf3b75a40c60d5ae6e80d8c84dd7
x-transaction: 0069723900318c7b
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
238 B 139ms
138ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o2i9x&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 117
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:15 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 283bdf3b75a40c60d5ae6e80d8c84dd7
x-transaction: 00ec39b8004bb466
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H/1.1 200
OK blogarticlepage.tagcloudtaplet:lazyrender Show response
forums.juniper.net/t5/blogs/ 20 B
563 B 459ms
173ms XHR
application/json 208.74.207.25
LITHIUM

General

Check archive.org

Show headers Download Go to

Full URL

https://forums.juniper.net/t5/blogs/blogarticlepage.tagcloudtaplet:lazyrender?t:ac=blog-id/threatresearch/article-id/72&t:cp=tagging/contributions/page

Requested by

Host: jnet.i.lithium.com
URL: https://jnet.i.lithium.com/t5/scripts/BDB2760D2C0BCBF59775E7581D371A43/lia-scripts-common-min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

208.74.207.25 , United States, ASN40402 (LITHIUM, US),

Reverse DNS

jnet.lithium.com

Software

Apache /

Resource Hash

7283dcbdf14b954c1e61e173cc8bdb244b2bf508b7f0211ac749857bf47acda3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
X-Requested-With: XMLHttpRequest
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date: Thu, 20 Feb 2020 08:34:15 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json;charset=UTF-8
Connection: close
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000;includeSubDomains
X-Robots-Tag: noindex, nofollow

GET
DATA 200
OK truncated
/ 667 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: edd8db5c29b96b7a290a5e266d426dca85541b7cd7a62b180e5ec89dc635f05f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H/1.1 200
OK elqCfg.min.js Show response
img.en25.com/i/ 6 KB
3 KB 157ms
53ms Script
application/x-javascript 104.103.106.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://img.en25.com/i/elqCfg.min.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.103.106.126 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-103-106-126.deploy.static.akamaitechnologies.com

Software

Resource Hash

6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 22 Jan 2020 17:21:27 GMT
ETag: "164336148d1d51:0"
Vary: Accept-Encoding
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: no-cache, no-store
Date: Thu, 20 Feb 2020 08:34:15 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 2115
Expires: Thu, 20 Feb 2020 08:34:15 GMT

GET
H2 200 json Show response
junipernetworks.tt.omtrdc.net/m2/junipernetworks/mbox/ 537 B
798 B 171ms
66ms XHR
application/json 66.117.29.3
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://junipernetworks.tt.omtrdc.net/m2/junipernetworks/mbox/json?mbox=target-global-mbox&mboxSession=01e00dfae1d040b29700789c8b80ebf0&mboxPC=&mboxPage=6bcdac57b3c64b3f9cbaaf7d92009924&mboxRid=66e3548b5da2462fa10030c5902c410e&mboxVersion=1.6.2&mboxCount=1&mboxTime=1582191254439&mboxHost=forums.juniper.net&mboxURL=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&mboxReferrer=&browserHeight=1200&browserWidth=1585&browserTimeOffset=60&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&at_property=731b0e75-98c0-3152-d94c-88331af4fd48&mboxMCSDID=31AD2C19CB1BCC53-7F3C11DBEB610724&vst.trk=junipernetworks.d2.sc.omtrdc.net&vst.trks=junipernetworks.d2.sc.omtrdc.net&mboxMCGVID=19933235249669886553329589763479381097&mboxAAMB=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&mboxMCGLH=6
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/mbox-contents-ba151bac91f2b7214d881fb194e167b525fadece.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 66.117.29.3 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: /
Resource Hash: fbb2fccf8cb800177d508c8dfc51812cebb0bc17d4f89509f04d0c7c3e13bc0f

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:34:14 GMT
status: 200
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://forums.juniper.net
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 537
x-request-id: 66e3548b5da2462fa10030c5902c410e

GET
H2 200 adsct
t.co/i/ 43 B
119 B 140ms
139ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1lnh&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/oct.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:15 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f92b85055e49495e84b6cdae183a919d
x-transaction: 005472c600715c06
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
119 B 140ms
139ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1oeb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/oct.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:15 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f92b85055e49495e84b6cdae183a919d
x-transaction: 00c9bada00de8d97
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
170 B 131ms
130ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nvrg6&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/oct.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 107
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:15 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f92b85055e49495e84b6cdae183a919d
x-transaction: 00c655ee00371403
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
124 B 144ms
144ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o29di&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/oct.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 120
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:15 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f92b85055e49495e84b6cdae183a919d
x-transaction: 0043e78a00553d1a
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
125 B 141ms
141ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o2i9x&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/oct.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 117
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:15 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f92b85055e49495e84b6cdae183a919d
x-transaction: 00c6495b002553a5
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 pntheon.min.js Show response
secure.rmulus.com/ 9 KB
9 KB 136ms
42ms Script
application/javascript 143.204.202.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&_pqStr=enabled&jnpr_vID=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5a1c307e64746d671f007214.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.79 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-79.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8c785b78817298c70c27829e6903d75fac181ed591e3260c4b1fec35f0cd03c0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:30:10 GMT
via: 1.1 7549433a09d06354ea864d169b689e51.cloudfront.net (CloudFront)
last-modified: Mon, 20 Jan 2020 23:16:42 GMT
server: AmazonS3
age: 246
etag: "0e3d80db82062b64ac3e71d661e18282"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-length: 9338
x-amz-cf-id: 7mkVhm_fE3FsMtF7t9qX3kL2U9bKTlgw0NIAi9_XGxXXaR921mMepQ==

GET
H2 200 pntheon.min.js Show response
secure.rmulus.com/ 9 KB
9 KB 51ms
51ms Script
application/javascript 143.204.202.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5c4d601564746d128d00351a.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.79 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-79.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8c785b78817298c70c27829e6903d75fac181ed591e3260c4b1fec35f0cd03c0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:30:10 GMT
via: 1.1 7549433a09d06354ea864d169b689e51.cloudfront.net (CloudFront)
last-modified: Mon, 20 Jan 2020 23:16:42 GMT
server: AmazonS3
age: 246
etag: "0e3d80db82062b64ac3e71d661e18282"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-length: 9338
x-amz-cf-id: io3OBwkGC5qOH-kph5bpbwRnlY3fVtIE6yc9gEicgrUqUAH5GTyp5Q==

GET
H2 200 pntheon.min.js Show response
secure.rmulus.com/ 9 KB
9 KB 46ms
45ms Script
application/javascript 143.204.202.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pqStr=enabled&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=active&_pclIp=active&_pqStr=active&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5c86baad64746d44c9006139.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.79 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-79.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8c785b78817298c70c27829e6903d75fac181ed591e3260c4b1fec35f0cd03c0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:30:10 GMT
via: 1.1 7549433a09d06354ea864d169b689e51.cloudfront.net (CloudFront)
last-modified: Mon, 20 Jan 2020 23:16:42 GMT
server: AmazonS3
age: 246
etag: "0e3d80db82062b64ac3e71d661e18282"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-length: 9338
x-amz-cf-id: xDEftzaQwahGOhkh1-RGZ3etNY_i4pqbOvrh-CrLX6L9GQeUc2Eg9w==

GET
H2

200

activityi;dc_pre=CIe2m6nc3-cCFaHjuwgdWiQGsw;src=5922977;type=pageview;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is...
5922977.fls.doubleclick.net/ Frame 9BC1
Redirect Chain

https://5922977.fls.doubleclick.net/activityi;src=5922977;type=pageview;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-...
https://5922977.fls.doubleclick.net/activityi;dc_pre=CIe2m6nc3-cCFaHjuwgdWiQGsw;src=5922977;type=pageview;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.n...

0
0

47ms
46ms

Document
text/html

172.217.22.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5922977.fls.doubleclick.net/activityi;dc_pre=CIe2m6nc3-cCFaHjuwgdWiQGsw;src=5922977;type=pageview;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=916199057962.9031?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57b12a8364746d4d41000291.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s16-in-f38.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5922977.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CIe2m6nc3-cCFaHjuwgdWiQGsw;src=5922977;type=pageview;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=916199057962.9031?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkjvx980nYRVr25DcxK2YBc6tQ3w18I8B9ylzx9_9tINVq0MSabf-Y9xsCy
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 20 Feb 2020 08:34:15 GMT
expires: Thu, 20 Feb 2020 08:34:15 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 452
x-xss-protection: 0
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 20 Feb 2020 08:34:15 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5922977.fls.doubleclick.net/activityi;dc_pre=CIe2m6nc3-cCFaHjuwgdWiQGsw;src=5922977;type=pageview;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=916199057962.9031?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: IDE=AHWqTUkjvx980nYRVr25DcxK2YBc6tQ3w18I8B9ylzx9_9tINVq0MSabf-Y9xsCy; expires=Tue, 16-Mar-2021 08:34:15 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2

200

activityi;dc_pre=CKDCoKnc3-cCFaPjuwgduxoL8A;src=3872718;type=gojpnet;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-...
3872718.fls.doubleclick.net/ Frame 940B
Redirect Chain

https://3872718.fls.doubleclick.net/activityi;src=3872718;type=gojpnet;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-I...
https://3872718.fls.doubleclick.net/activityi;dc_pre=CKDCoKnc3-cCFaPjuwgduxoL8A;src=3872718;type=gojpnet;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.ne...

0
0

49ms
49ms

Document
text/html

172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3872718.fls.doubleclick.net/activityi;dc_pre=CKDCoKnc3-cCFaPjuwgduxoL8A;src=3872718;type=gojpnet;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7781161242936.281?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57b12a8364746d4d41000291.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f134.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 3872718.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CKDCoKnc3-cCFaPjuwgduxoL8A;src=3872718;type=gojpnet;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7781161242936.281?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkV_SWf9iBor0svv8aZfuIaFtTRBlZSr1vnF6j3OjZc8T0oAqmAey2qphUa
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 20 Feb 2020 08:34:15 GMT
expires: Thu, 20 Feb 2020 08:34:15 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 452
x-xss-protection: 0
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 20 Feb 2020 08:34:15 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://3872718.fls.doubleclick.net/activityi;dc_pre=CKDCoKnc3-cCFaPjuwgduxoL8A;src=3872718;type=gojpnet;cat=pagev0;u1=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654;u2=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478;u5=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7781161242936.281?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: IDE=AHWqTUkV_SWf9iBor0svv8aZfuIaFtTRBlZSr1vnF6j3OjZc8T0oAqmAey2qphUa; expires=Tue, 16-Mar-2021 08:34:15 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 s84548170138886
junipernetworks.d2.sc.omtrdc.net/b/ss/jnprod/1/JS-2.12.0-D7QN/ 43 B
244 B 253ms
253ms Image
image/gif 18.139.76.45
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://junipernetworks.d2.sc.omtrdc.net/b/ss/jnprod/1/JS-2.12.0-D7QN/s84548170138886?AQB=1&ndh=1&pf=1&t=20%2F1%2F2020%209%3A34%3A15%204%20-60&sdid=31AD2C19CB1BCC53-7F3C11DBEB610724&D=D%3D&mid=19933235249669886553329589763479381097&aamlh=6&ce=UTF-8&pageName=forums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&g=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=forums.juniper.net&v5=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&v15=D%3DpageName&v30=78691338&v31=Not%20In%20List&v32=Not%20In%20List&v33=Not%20In%20List&v34=Hytera%20Communications%20UK%20Company%20Ltd&v35=Hytera%20Communications&v36=Wholesale%20Trade&v37=Office%20Equipment%20%26%20Electronics&v38=%245M%20-%20%2410M&v39=Small&v40=Hyt%20Telecommunication%20Co.%205%20Ne&v41=London&v42=LND&v43=EC4A%203TW&v44=United%20Kingdom&v45=SMB&v46=Wholesale%20Trade&v84=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=D206123F524450F50A490D45%40AdobeOrg&AQE=1

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.139.76.45 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-139-76-45.ap-southeast-1.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
x-content-type-options: nosniff
x-c: master-1169.Ie4359b.M0-349
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 21 Feb 2020 08:34:15 GMT
server: jag
xserver: anedge-665bcdccf8-qwfzk
etag: 3397722117265260544-4614757835422336667
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 19 Feb 2020 08:34:15 GMT

GET
H2 200 wRPiG49f.min.js Show response
scripts.demandbase.com/ 58 KB
16 KB 48ms
48ms Script
application/javascript 143.204.202.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://scripts.demandbase.com/wRPiG49f.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5955f42064746d6e6f0053bb.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.92 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-92.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0d815b2e925f887c1210ae79918c2daed72f94cafb870f4fedffcfac47a341b4

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-amz-version-id: rBjPpaaLgRwfk.HwhBorpW7VSW9pfD6m
content-encoding: gzip
last-modified: Thu, 16 Jan 2020 17:41:57 GMT
server: AmazonS3
age: 2866
date: Thu, 20 Feb 2020 07:46:30 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
status: 200
cache-control: public, max-age=3600
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: -JcG1gnizStN84BluDYNM0JarFwDQWBUNX2j2GlsVscHSDFqdfZrjg==
via: 1.1 f960fa0538fdb326fc338e984fa7ece9.cloudfront.net (CloudFront)

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 43
date: Thu, 20 Feb 2020 08:33:32 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 18174
expires: Thu, 20 Feb 2020 10:33:32 GMT

GET
H/1.1

200
OK

37366
tags.bluekai.com/site/
Redirect Chain

https://s1229.t.eloqua.com/visitor/v200/svrGP?pps=3&siteid=1229&ref2=elqNone&tzo=-60&ms=137&optin=disabled
https://s1229.t.eloqua.com/visitor/v200/svrGP.aspx?pps=3&siteid=1229&ref2=elqNone&tzo=-60&ms=137&optin=disabled&elqCookie=1
https://tags.bluekai.com/site/37366?vid=cfa520996ea74eb792b6ee8da12a796c

62 B
745 B

282ms
196ms

Image
image/gif

23.45.237.36
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/37366?vid=cfa520996ea74eb792b6ee8da12a796c
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.45.237.36 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-45-237-36.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 20 Feb 2020 08:34:16 GMT
Connection: keep-alive
Content-Type: image/gif
Content-Length: 62
BK-Server: 9b71
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000;
X-Content-Type-Options: nosniff
Date: Thu, 20 Feb 2020 08:34:16 GMT
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Location: //tags.bluekai.com/site/37366?vid=cfa520996ea74eb792b6ee8da12a796c
Cache-Control: private,no-cache, no-store
Content-Type: text/html; charset=utf-8
Content-Length: 183
Expires: -1

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 1 KB
1 KB 177ms
97ms XHR
application/json 143.204.202.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&page_title=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&key=b04729caf27be3d1f33d91242883c6cd22de73c9&src=tag
Requested by: Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/wRPiG49f.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.20 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-20.fra53.r.cloudfront.net
Software: nginx /
Resource Hash: ecc66f2f44d4ac576f7cf85e32a8f15ca304e5054f04adf29728c57383568880

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
identification-source: CACHE
vary: Accept-Encoding, Origin
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
status: 200
request-id: a3532d85-50e8-415c-ac5a-017e9c9599d9
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://forums.juniper.net
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 b073c20359d711b751afd124dda34076.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: f0y5tKAPHGAZnT7k8UA34EKJL28HHe50mmyBtcyp0Uoaw31vceBRZw==
expires: Wed, 19 Feb 2020 08:34:15 GMT

GET
H2 200 ip.json Show response
api.company-target.com/api/v2/ 1 KB
1 KB 200ms
120ms XHR
application/json 143.204.202.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&page_title=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&key=2f583737f4267c258cb4cda0abb7f0add09816ce&src=tag
Requested by: Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/wRPiG49f.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.20 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-20.fra53.r.cloudfront.net
Software: nginx /
Resource Hash: ecc66f2f44d4ac576f7cf85e32a8f15ca304e5054f04adf29728c57383568880

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
identification-source: CACHE
vary: Accept-Encoding, Origin
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
status: 200
request-id: e3e92fb0-4b73-4945-84d8-31e079e34b76
content-encoding: gzip
pragma: no-cache
access-control-allow-origin: https://forums.juniper.net
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/json;charset=utf-8
via: 1.1 b073c20359d711b751afd124dda34076.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
api-version: v2
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: v_aFXWypYytfh9Yonclyr4UomaTLP5zKq2FjRfl2sXHGBSxcJ8PlOw==
expires: Wed, 19 Feb 2020 08:34:15 GMT

GET
H/1.1

200
OK

validateCookie
segments.company-target.com/
Redirect Chain

https://match.prod.bidr.io/cookie-sync/demandbase
https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
https://segments.company-target.com/log?vendor=choca&user_id=AAFdmE68nIkAAC2wZbYKVg
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAFdmE68nIkAAC2wZbYKVg&verifyHash=602189f75c4b08780dd1d04f96966c76b9045786

26 B
409 B

127ms
127ms

Image
image/gif

143.204.202.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://segments.company-target.com/validateCookie?vendor=choca&user_id=AAFdmE68nIkAAC2wZbYKVg&verifyHash=602189f75c4b08780dd1d04f96966c76b9045786
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.106 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-106.fra53.r.cloudfront.net
Software: /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 20 Feb 2020 08:34:15 GMT
Via: 1.1 e0064d0a2437e206ed082e1fa1cdae61.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Vary: Origin
X-Cache: Miss from cloudfront
Content-Type: image/gif
Transfer-Encoding: chunked
Connection: keep-alive
trace-id: 5d7a0378553a2846
X-Amz-Cf-Id: kEuLIuHz1Ffff-g_q1QzhhFJDnsEzwfQy_3COnmQPWLmrQN8Tj1d5w==

Redirect headers

Date: Thu, 20 Feb 2020 08:34:15 GMT
Via: 1.1 e0064d0a2437e206ed082e1fa1cdae61.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
Vary: Origin
X-Cache: Miss from cloudfront
Location: /validateCookie?vendor=choca&user_id=AAFdmE68nIkAAC2wZbYKVg&verifyHash=602189f75c4b08780dd1d04f96966c76b9045786
Connection: keep-alive
trace-id: 3e67626c2a453f77
Content-Length: 0
X-Amz-Cf-Id: EIZ6tdVelk3LMORB4xMbR918C4a1MJFJqYQc2UDtXEcO0zR9CvOrrw==

GET
H2 200 collect
www.google-analytics.com/ 35 B
103 B 7ms
5ms Image
image/gif 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j81&a=337586098&t=pageview&_s=1&dl=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&ul=en-us&de=UTF-8&dt=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YGDAgEAB~&jid=1524081591&gjid=52543900&cid=1371404925.1582187655&tid=UA-2343305-4&_gid=491357842.1582187655&z=142410793

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sat, 01 Feb 2020 03:38:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1659357
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
stats.g.doubleclick.net/r/ 35 B
102 B 16ms
15ms Image
image/gif 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-2343305-4&cid=1371404925.1582187655&jid=1524081591&gjid=52543900&_gid=491357842.1582187655&_u=YGDAgEAB~&z=1638553456

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
date: Thu, 20 Feb 2020 08:34:15 GMT
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
97 B 7ms
6ms Image
image/gif 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j81&a=337586098&t=pageview&_s=1&dl=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&ul=en-us&de=UTF-8&dt=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YGDAgEAB~&jid=816593828&gjid=1671516261&cid=1371404925.1582187655&tid=UA-2343305-1&_gid=491357842.1582187655&cd5=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&cd19=gtm%20%2B%20dtm&z=983298420

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sat, 01 Feb 2020 03:38:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1659357
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j81&tid=UA-2343305-1&cid=1371404925.1582187655&jid=816593828&gjid=1671516261&_gid=491357842.1582187655&_u=YGDAgEAB~&z=99006382
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=1371404925.1582187655&jid=816593828&_v=j81&z=99006382
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=1371404925.1582187655&jid=816593828&_v=j81&z=99006382&slf_rd=1&random=959123788

42 B
109 B

16ms
16ms

Image
image/gif

2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=1371404925.1582187655&jid=816593828&_v=j81&z=99006382&slf_rd=1&random=959123788

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:34:15 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:34:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-2343305-1&cid=1371404925.1582187655&jid=816593828&_v=j81&z=99006382&slf_rd=1&random=959123788
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
secure.rmulus.com/ Frame 2599 0
0 45ms
45ms Document
text/html 143.204.202.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.rmulus.com/?_pevId=CS1uhb4IHD7uKuApJc5uYRIeuVvdvGCc-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=enabled&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dpgvw%26_pdataSource%3Dweb%26_pqStr%3Denabled%26jnpr_vID%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&jnpr_vID=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pidSource=secure.rmulus.com&_pidName=rmulusId&_pclIp=disabled&_plkpPrfl=disabled
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&_pqStr=enabled&jnpr_vID=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.79 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-79.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

:method: GET
:authority: secure.rmulus.com
:scheme: https
:path: /?_pevId=CS1uhb4IHD7uKuApJc5uYRIeuVvdvGCc-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=enabled&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dpgvw%26_pdataSource%3Dweb%26_pqStr%3Denabled%26jnpr_vID%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&jnpr_vID=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pidSource=secure.rmulus.com&_pidName=rmulusId&_pclIp=disabled&_plkpPrfl=disabled
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
content-type: text/html
content-length: 11311
last-modified: Mon, 20 Jan 2020 22:54:47 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 20 Feb 2020 08:19:37 GMT
etag: "b54bfc44e96bae45f2b930edddba58f9"
cache-control: max-age=3600
x-cache: Hit from cloudfront
via: 1.1 7549433a09d06354ea864d169b689e51.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: vzx4F2H0LviNOyqYqq_mwIpdX0-2tW1PyORhIMC2BXKzCFHOcyjCsQ==
age: 879

GET
H/1.1 200
OK jnpr Show response
lookups.rmulus.com/pntheon/ip/ 421 B
610 B 511ms
206ms XHR
text/html 52.72.180.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lookups.rmulus.com/pntheon/ip/jnpr
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&_pqStr=enabled&jnpr_vID=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.180.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-180-134.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 0bd71fe3e4394b7f3049009a604cb4c403d146589b21fe234d656e1268c1b820

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 20 Feb 2020 08:34:15 GMT
Server: Apache
Connection: keep-alive
Content-Length: 421
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK profiler Show response
lookups.rmulus.com/pntheon/profiles/ 25 B
205 B 412ms
109ms XHR
application/json 52.72.180.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lookups.rmulus.com/pntheon/profiles/profiler?_pclientId=jnpr&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vid&_plkpPrfl=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&_pqStr=enabled&jnpr_vID=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.180.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-180-134.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 851bd834d24a84c0f4780789e868a65f9db8d9655a7a0cac039dbf3b65ad873f

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 20 Feb 2020 08:34:15 GMT
Server: Apache
Connection: keep-alive
Content-Length: 25
Content-Type: application/json

GET
H2 200 collect
www.google-analytics.com/ 35 B
97 B 6ms
6ms Image
image/gif 2a00:1450:4001:80b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j81&a=337586098&t=event&ni=1&_s=2&dl=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&ul=en-us&de=UTF-8&dt=Dota3%3A%20Is%20your%20Internet%20of%20Things%20device%20moonlight...%20-%20J-Net%20Community&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aGDAgEAB~&jid=&gjid=&cid=1371404925.1582187655&tid=UA-2343305-1&_gid=491357842.1582187655&cd5=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&cd19=gtm%20%2B%20dtm&cd6=Hytera%20Communications%20UK%20Company%20Ltd&cd7=(Non-AccountWatch%20Visitor)&cd8=Wholesale%20Trade&cd9=SMB&cd10=(Non-AccountWatch%20Visitor)&cd11=78691338&cd12=%245M%20-%20%2410M&cd13=Small&cd14=(Non-AccountWatch%20Visitor)&cd15=LND&cd16=Wholesale%20Trade&cd17=Office%20Equipment%20%26%20Electronics&cd18=United%20Kingdom&z=137680377

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sat, 01 Feb 2020 03:38:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 1659357
content-type: image/gif
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
access-control-allow-origin: *
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
research.juniper.net/ Frame 1984 11 KB
11 KB 153ms
42ms Document
text/html 13.35.253.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&_pqStr=enabled&jnpr_vID=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.69 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-69.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: db82939943dfa4e2ddd5cb40b4eef2237e4ff65a12c248db91352b36dbbca8a3

Request headers

:method: GET
:authority: research.juniper.net
:scheme: https
:path: /?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: check=true; jnpr_vID=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654; AMCVS_D206123F524450F50A490D45%40AdobeOrg=1; _fbp=fb.1.1582187654680.1942104099; dmdbase_cdc=DBSET; s_cc=true; _gcl_au=1.1.1828893587.1582187655; mbox=session#01e00dfae1d040b29700789c8b80ebf0#1582189516|PC#01e00dfae1d040b29700789c8b80ebf0.26_0#1645432456; mboxEdgeCluster=26; _ga=GA1.2.1371404925.1582187655; _gid=GA1.2.491357842.1582187655; _gat_b=1; _gat_jn=1; AMCV_D206123F524450F50A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18313%7CMCMID%7C19933235249669886553329589763479381097%7CMCAAMLH-1582792453%7C6%7CMCAAMB-1582792453%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1582194853s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18320%7CvVersion%7C3.1.2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
content-type: text/html
content-length: 11311
last-modified: Mon, 20 Jan 2020 22:54:47 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 20 Feb 2020 07:48:28 GMT
etag: "b54bfc44e96bae45f2b930edddba58f9"
cache-control: max-age=3600
x-cache: Hit from cloudfront
via: 1.1 d357d5d597708d2b41e0fea397aa2620.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: JRZUTPoehlp-n_n7D5jxoJsMeL_oLdXRWKxXVKi8QvsQzdE3A7Opug==
age: 2748

GET
H/1.1 200
OK profiler Show response
lookups.rmulus.com/pntheon/profiles/ 25 B
205 B 109ms
108ms XHR
application/json 52.72.180.134
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://lookups.rmulus.com/pntheon/profiles/profiler?_pclientId=jnpr&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pmatchedip&_plkpPrfl=185.38.150.96
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&_pqStr=enabled&jnpr_vID=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.72.180.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-180-134.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 851bd834d24a84c0f4780789e868a65f9db8d9655a7a0cac039dbf3b65ad873f

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Origin: https://forums.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 20 Feb 2020 08:34:15 GMT
Server: Apache
Connection: keep-alive
Content-Length: 25
Content-Type: application/json

GET
H2 200 _pclPrint.min.js Show response
research.juniper.net/ Frame 1984 38 KB
39 KB 45ms
44ms Script
application/javascript 13.35.253.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/_pclPrint.min.js
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.69 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-69.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c5aff3477022f781ee765989cdf6abbdd986f331064c59f5655fab8c6f9796c7

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:26:35 GMT
via: 1.1 d357d5d597708d2b41e0fea397aa2620.cloudfront.net (CloudFront)
last-modified: Tue, 23 Jul 2019 21:53:49 GMT
server: AmazonS3
age: 461
etag: "2b2becfbac440238e8ca3a6f7a3b2c50"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 39179
x-amz-cf-id: CuhVgWW1AFUctsNCXUALZeJMw_k2V6lmlHSzFOFIUw2eaeLZHvTV9w==

GET
H2 200 / Show response
research.juniper.net/ Frame D848 11 KB
11 KB 42ms
41ms Document
text/html 13.35.253.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
Requested by: Host: secure.rmulus.com
URL: https://secure.rmulus.com/pntheon.min.js?_pclientId=jnpr&_peventName=pgvw&_pdataSource=web&_pqStr=enabled&jnpr_vID=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.69 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-69.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: db82939943dfa4e2ddd5cb40b4eef2237e4ff65a12c248db91352b36dbbca8a3

Request headers

:method: GET
:authority: research.juniper.net
:scheme: https
:path: /?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: check=true; jnpr_vID=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654; AMCVS_D206123F524450F50A490D45%40AdobeOrg=1; _fbp=fb.1.1582187654680.1942104099; dmdbase_cdc=DBSET; s_cc=true; _gcl_au=1.1.1828893587.1582187655; mbox=session#01e00dfae1d040b29700789c8b80ebf0#1582189516|PC#01e00dfae1d040b29700789c8b80ebf0.26_0#1645432456; mboxEdgeCluster=26; _ga=GA1.2.1371404925.1582187655; _gid=GA1.2.491357842.1582187655; _gat_b=1; _gat_jn=1; AMCV_D206123F524450F50A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18313%7CMCMID%7C19933235249669886553329589763479381097%7CMCAAMLH-1582792453%7C6%7CMCAAMB-1582792453%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1582194853s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18320%7CvVersion%7C3.1.2; rmulusId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Response headers

status: 200
content-type: text/html
content-length: 11311
last-modified: Mon, 20 Jan 2020 22:54:47 GMT
accept-ranges: bytes
server: AmazonS3
date: Thu, 20 Feb 2020 08:33:29 GMT
etag: "b54bfc44e96bae45f2b930edddba58f9"
cache-control: max-age=3600
x-cache: Hit from cloudfront
via: 1.1 d357d5d597708d2b41e0fea397aa2620.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: cTzUST3W95tRF2WDthQpglQVqbnLQU-Cfjxd3Rjr-24CLpbFDuNsZw==
age: 923

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame D848 74 KB
28 KB 17ms
16ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-956680084

Requested by

Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3f62ff9e57b4243edeb728b981a1380a3bbf12d8c18c092fa93cac93a72e5a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28494
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 20 Feb 2020 08:34:15 GMT

GET
H2 200 insight.min.js Show response
research.juniper.net/ Frame D848 15 KB
15 KB 44ms
43ms Script
application/javascript 13.35.253.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/insight.min.js
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.69 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-69.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0f533082d6b784c7f939ad3fbcafc2faa6a88d96f0b076f7a0e28b431995bff

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:26:14 GMT
via: 1.1 d357d5d597708d2b41e0fea397aa2620.cloudfront.net (CloudFront)
last-modified: Fri, 26 Jul 2019 18:43:20 GMT
server: AmazonS3
age: 482
etag: "5b837d1dc3da4d22567332e2fe693e12"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 15282
x-amz-cf-id: Ds-x5qPS1nSxjRbUq_vf59NzXVvB7qR9wMLohz9cK8LuHzSsiBV7DA==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame D848 126 KB
30 KB 6ms
5ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: 6AVz/XBH1PgeUy2TWrNvMQZU/icIivLuUZTqy/MZkbhZrlEntpdGxESAerYHUUZYLqb5frzzuBbpI1yeVKrceQ==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:34:15 GMT, Thu, 20 Feb 2020 08:34:15 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ Frame D848 5 KB
2 KB 39ms
38ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:15 GMT
content-encoding: gzip
age: 1200
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-fra19148-FRA
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1582187656.961904,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 /
collect.rmulus.com/ Frame D848 43 B
368 B 40ms
39ms Image
image/gif 143.204.202.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://collect.rmulus.com/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656&cachebuster=68026673
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.47 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-47.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 19 Feb 2020 19:31:41 GMT
via: 1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront)
last-modified: Mon, 16 Jan 2017 04:49:32 GMT
server: AmazonS3
age: 46955
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
x-cache: Hit from cloudfront
content-type: image/gif
status: 200
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-length: 43
x-amz-cf-id: qKabBSI6EABeFZCRxT1cpih9bWRoJQ1UUw23bXHnJSWS9qN_L0LpZA==

GET
H2 200 340159566928684 Show response
connect.facebook.net/signals/config/ Frame D848 447 KB
112 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/340159566928684?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1498e3b254909c3f097fc78de60171d0be0c367e534e0af35c21c359ef6801e7

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 114918
x-xss-protection: 0
pragma: public
x-fb-debug: 2Env0ydQabxp7CevbtKyYzZSpuCblVtEmagd1RCDDOufBHK86DTuDmqvQzmRteuDaXFefqFolizrSbR4dnN9yw==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:34:15 GMT, Thu, 20 Feb 2020 08:34:15 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame D848 26 KB
10 KB 45ms
44ms Script
text/javascript 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-956680084

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

e613df9aa843851d019cc12e6184972311e2229c14299d2f6c80f4aadf2d844a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9931
x-xss-protection: 0
server: cafe
etag: 9478280665056484852
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 20 Feb 2020 08:34:16 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame 1984 74 KB
28 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-956680084

Requested by

Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3f62ff9e57b4243edeb728b981a1380a3bbf12d8c18c092fa93cac93a72e5a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:16 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28494
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 20 Feb 2020 08:34:16 GMT

GET
H2 200 insight.min.js Show response
research.juniper.net/ Frame 1984 15 KB
15 KB 44ms
43ms Script
application/javascript 13.35.253.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://research.juniper.net/insight.min.js
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.253.69 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-69.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0f533082d6b784c7f939ad3fbcafc2faa6a88d96f0b076f7a0e28b431995bff

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:26:14 GMT
via: 1.1 d357d5d597708d2b41e0fea397aa2620.cloudfront.net (CloudFront)
last-modified: Fri, 26 Jul 2019 18:43:20 GMT
server: AmazonS3
age: 483
etag: "5b837d1dc3da4d22567332e2fe693e12"
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 15282
x-amz-cf-id: GtDKlselJFk6g_AEjQGvtLdY96pYAlkMv-HZ6cj79xmNwAOpN601wg==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 1984 126 KB
30 KB 6ms
5ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: 6AVz/XBH1PgeUy2TWrNvMQZU/icIivLuUZTqy/MZkbhZrlEntpdGxESAerYHUUZYLqb5frzzuBbpI1yeVKrceQ==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:34:16 GMT, Thu, 20 Feb 2020 08:34:16 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ Frame 1984 5 KB
2 KB 39ms
39ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:16 GMT
content-encoding: gzip
age: 1200
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-fra19148-FRA
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1582187656.030081,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 /
collect.rmulus.com/ Frame 1984 43 B
366 B 39ms
39ms Image
image/gif 143.204.202.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://collect.rmulus.com/?_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656&_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=a29d5f7b2fb83ed2db62c131cb65f013&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled&cachebuster=1528205
Requested by: Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.202.47 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-202-47.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Wed, 19 Feb 2020 19:31:41 GMT
via: 1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront)
last-modified: Mon, 16 Jan 2017 04:49:32 GMT
server: AmazonS3
age: 46956
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
x-cache: Hit from cloudfront
content-type: image/gif
status: 200
x-amz-cf-pop: FRA53-C1
accept-ranges: bytes
content-length: 43
x-amz-cf-id: lf6SUXiJhNHAM725iyY8EAsMrup5ug-Mji2e06eelNderU_xFgC0ww==

GET
H2 200 adsct
t.co/i/ Frame D848 43 B
166 B 138ms
138ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1oeb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=1&tw_document_referrer=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:16 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f92b85055e49495e84b6cdae183a919d
x-transaction: 00bfa7fc00c87fc2
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/ Frame D848 3 KB
1 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/?random=1582187656099&cv=9&fst=1582187656099&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DDut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b00947275411cb14f41839133eeef7b1f831236fd29b9ab0b14fd666fb119e22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:34:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1318
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/ Frame D848 7 KB
2 KB 85ms
84ms Script
text/javascript 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/?random=1582187656101&cv=9&fst=1582187656101&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dpage_view%3B_pevId%3DDut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%5C%3D_pclIp._pmatchedIP%26_plkpPrfl%5C%3Dactive%26_pclIp%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts_ip%3B_plkpKey%3D_pclIp._pmatchedIP%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pcityName%3DThornton%20Heath%3B_pcompanyName%3DHydra%20Communications%20Ltd%3B_pcontinentCode%3DEU%3B_pcontinentName%3DEurope%3B_pcountryISOCode%3DGB%3B_pcountryName%3DUnited%20Kingdom%3B_platitude%3D51.3863%3B_plongitude%3D-0.0996%3B_pmatchedIP%3D185.38.150.96%3B_ppostalCode%3DCR7%3B_pstateISOCode%3DENG%3B_pstateName%3DEngland%3B_ptimeZone%3DEurope%2FLondon%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclId%3Ds4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DDut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4ab00dedcf2dfc4807fa41bb0e6dac322bff250803c5843daa2f3ec65a414426

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:34:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1864
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
px.ads.linkedin.com/collect/ Frame 1984 0
97 B 124ms
124ms Script
application/javascript 2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/collect/?time=1582187656103&pid=4751&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_pclPrint%253Dtrue%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%26_pclIp%3Ddisabled&fmt=js&s=1
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:16 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: ROtTWkoP9RWgudFXxSoAAA==

GET
H2 200 340159566928684 Show response
connect.facebook.net/signals/config/ Frame 1984 447 KB
112 KB 7ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/340159566928684?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1498e3b254909c3f097fc78de60171d0be0c367e534e0af35c21c359ef6801e7

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 114918
x-xss-protection: 0
pragma: public
x-fb-debug: 2Env0ydQabxp7CevbtKyYzZSpuCblVtEmagd1RCDDOufBHK86DTuDmqvQzmRteuDaXFefqFolizrSbR4dnN9yw==
x-fb-trip-id: 420120009
date: Thu, 20 Feb 2020 08:34:16 GMT, Thu, 20 Feb 2020 08:34:16 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ Frame 1984 31 B
160 B 142ms
141ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1oeb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=1&tw_document_referrer=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_pclPrint%253Dtrue%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%26_pclIp%3Ddisabled

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 119
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:16 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 283bdf3b75a40c60d5ae6e80d8c84dd7
x-transaction: 009fb696009798c2
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ Frame 1984 43 B
124 B 131ms
131ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 20 Feb 2020 08:34:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 109
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:16 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: f92b85055e49495e84b6cdae183a919d
x-transaction: 00f3f36e0018e281
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame 1984 26 KB
10 KB 44ms
43ms Script
text/javascript 172.217.22.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-956680084

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f66.1e100.net

Software

cafe /

Resource Hash

e613df9aa843851d019cc12e6184972311e2229c14299d2f6c80f4aadf2d844a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9931
x-xss-protection: 0
server: cafe
etag: 9478280665056484852
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 20 Feb 2020 08:34:16 GMT

POST
H2 200 /
www.facebook.com/tr/ Frame D848 0
101 B 6ms
6ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
Origin: https://research.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryPcy0rolxBtWhMu2n

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
access-control-allow-origin: https://research.juniper.net
date: Thu, 20 Feb 2020 08:34:16 GMT
content-type: text/plain
status: 200
access-control-allow-credentials: true
alt-svc: h3-24=":443"; ma=3600
content-length: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/956680084/ Frame D848 42 B
122 B 21ms
20ms Image
image/gif 2a00:1450:4001:820::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/956680084/?random=1582187656099&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DDut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=4071337076&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:34:16 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/956680084/ Frame D848 42 B
110 B 20ms
20ms Image
image/gif 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/956680084/?random=1582187656099&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DDut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=4071337076&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:34:16 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 /
www.facebook.com/tr/ Frame 1984 0
30 B 6ms
6ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
Origin: https://research.juniper.net
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryqVD6fRTzWn5Qo1O5

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
access-control-allow-origin: https://research.juniper.net
date: Thu, 20 Feb 2020 08:34:16 GMT
content-type: text/plain
status: 200
access-control-allow-credentials: true
alt-svc: h3-24=":443"; ma=3600
content-length: 0

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/ Frame 1984 3 KB
1 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:81f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/?random=1582187656160&cv=9&fst=1582187656160&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d6c0add51aaab8d3a46989106b3dedc902f41fd63cb466af8160f169d43faf4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:34:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1311
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/956680084/ Frame 1984
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956680084/?random=1582187656160&cv=9&fst=1582187656160&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/956680084/?random=1582187656160&cv=9&fst=1582185600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/956680084/?random=1582187656160&cv=9&fst=1582185600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
110 B

22ms
22ms

Image
image/gif

2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/956680084/?random=1582187656160&cv=9&fst=1582185600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dpage_view%3B_pclId%3Ds4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656%3B_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts%26_plkpKey%5C%3Djnpr_vId%26_plkpPrfl%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_pclPrint%5C%3Dtrue%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts%3B_plkpKey%3Djnpr_vId%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_pclPrint%3Da29d5f7b2fb83ed2db62c131cb65f013%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclIp%3Ddisabled&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&is_vtc=1&random=4053247325&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:34:16 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:34:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/956680084/?random=1582187656160&cv=9&fst=1582185600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dpage_view%3B_pclId%3Ds4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656%3B_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts%26_plkpKey%5C%3Djnpr_vId%26_plkpPrfl%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_pclPrint%5C%3Dtrue%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts%3B_plkpKey%3Djnpr_vId%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_pclPrint%3Da29d5f7b2fb83ed2db62c131cb65f013%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclIp%3Ddisabled&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&is_vtc=1&random=4053247325&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/956680084/ Frame 1984 42 B
122 B 25ms
24ms Image
image/gif 2a00:1450:4001:820::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/956680084/?random=1582187656160&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=3472427531&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:34:16 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/956680084/ Frame 1984 42 B
110 B 21ms
20ms Image
image/gif 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/956680084/?random=1582187656160&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DcuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts%2526_plkpKey%253Djnpr_vId%2526_plkpPrfl%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juni&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=3472427531&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: forums.juniper.net
URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=cuFKMwuTKoJ2ygPOg119Vxt6jlpRtpgl-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts%26_plkpKey%3Djnpr_vId%26_plkpPrfl%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_pclPrint%3Dtrue%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts&_plkpKey=jnpr_vId&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pidName=rmulusId&_pidSource=research.juniper.net&_pclPrint=true&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclIp=disabled
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:34:16 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/956680084/ Frame D848 42 B
122 B 22ms
22ms Image
image/gif 2a00:1450:4001:820::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/956680084/?random=1582187656101&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dpage_view%3B_pevId%3DDut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%5C%3D_pclIp._pmatchedIP%26_plkpPrfl%5C%3Dactive%26_pclIp%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts_ip%3B_plkpKey%3D_pclIp._pmatchedIP%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pcityName%3DThornton%20Heath%3B_pcompanyName%3DHydra%20Communications%20Ltd%3B_pcontinentCode%3DEU%3B_pcontinentName%3DEurope%3B_pcountryISOCode%3DGB%3B_pcountryName%3DUnited%20Kingdom%3B_platitude%3D51.3863%3B_plongitude%3D-0.0996%3B_pmatchedIP%3D185.38.150.96%3B_ppostalCode%3DCR7%3B_pstateISOCode%3DENG%3B_pstateName%3DEngland%3B_ptimeZone%3DEurope%2FLondon%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclId%3Ds4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DDut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=3813222034&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:34:16 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/956680084/ Frame D848 42 B
110 B 22ms
22ms Image
image/gif 2a00:1450:4001:81d::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/956680084/?random=1582187656101&cv=9&fst=1582185600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dpage_view%3B_pevId%3DDut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655%3B_pdLoc%3Dhttps%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478%3B_pdHash%3DUnavailable%3B_pqStr%3Dactive%3B_psqStr%3D%3F_pclientId%5C%3Djnpr%26_peventName%5C%3Dlkps%26_pdataSource%5C%3Dweb%26_pqStr%5C%3Denabled%26_pgetId%5C%3Dtrue%26_plkpTblId%5C%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%5C%3D_pclIp._pmatchedIP%26_plkpPrfl%5C%3Dactive%26_pclIp%5C%3Dactive%26_pqStr%5C%3Dactive%26_pidName%5C%3DrmulusId%26_pidSource%5C%3Dresearch.juniper.net%26_ptwAids%5C%3Do1oeb%26_pfbAids%5C%3D340159566928684%26_pliPids%5C%3D4751%26_pawAids%5C%3DAW-956680084%26jnpr_vId%5C%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclientId%3Djnpr%3B_peventName%3Dlkps%3B_pdataSource%3Dweb%3B_pgetId%3Dtrue%3B_plkpTblId%3Djnpr_audiences_targetaccounts_ip%3B_plkpKey%3D_pclIp._pmatchedIP%3B_plkpPrfl%3D%7B%22not%20found%22%3A%22not%20found%22%7D%3B_pcityName%3DThornton%20Heath%3B_pcompanyName%3DHydra%20Communications%20Ltd%3B_pcontinentCode%3DEU%3B_pcontinentName%3DEurope%3B_pcountryISOCode%3DGB%3B_pcountryName%3DUnited%20Kingdom%3B_platitude%3D51.3863%3B_plongitude%3D-0.0996%3B_pmatchedIP%3D185.38.150.96%3B_ppostalCode%3DCR7%3B_pstateISOCode%3DENG%3B_pstateName%3DEngland%3B_ptimeZone%3DEurope%2FLondon%3B_pidName%3DrmulusId%3B_pidSource%3Dresearch.juniper.net%3B_ptwAids%3Do1oeb%3B_pfbAids%3D340159566928684%3B_pliPids%3D4751%3B_pawAids%3DAW-956680084%3Bjnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%3B_pclId%3Ds4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656&frm=2&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DDut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253Drmulus&ref=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&async=1&fmt=3&is_vtc=1&random=3813222034&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 20 Feb 2020 08:34:16 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
px.ads.linkedin.com/collect/ Frame D848 0
40 B 125ms
124ms Script
application/javascript 2a05:f500:10:101::b93f:9105
LINKEDIN

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/collect/?time=1582187656211&pid=4751&url=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DDut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pcityName%3DThornton%2520Heath%26_pcompanyName%3DHydra%2520Communications%2520Ltd%26_pcontinentCode%3DEU%26_pcontinentName%3DEurope%26_pcountryISOCode%3DGB%26_pcountryName%3DUnited%2520Kingdom%26_platitude%3D51.3863%26_plongitude%3D-0.0996%26_pmatchedIP%3D185.38.150.96%26_ppostalCode%3DCR7%26_pstateISOCode%3DENG%26_pstateName%3DEngland%26_ptimeZone%3DEurope%252FLondon%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%26_pclId%3Ds4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656&fmt=js&s=1
Requested by: Host: research.juniper.net
URL: https://research.juniper.net/insight.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:16 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-efr5
content-type: application/javascript
content-length: 0
x-li-uuid: RYrBYEoP9RWgudFXxSoAAA==

GET
H2 200 adsct Show response
analytics.twitter.com/i/ Frame D848 31 B
113 B 142ms
142ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=o1oeb&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=1&tw_document_referrer=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fresearch.juniper.net%2F%3F_pevId%3DDut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655%26_pdLoc%3Dhttps%253A%252F%252Fforums.juniper.net%252Ft5%252FThreat-Research%252FDota3-Is-your-Internet-of-Things-device-moonlighting%252Fba-p%252F473478%26_pdHash%3DUnavailable%26_pqStr%3Dactive%26_psqStr%3D%253F_pclientId%253Djnpr%2526_peventName%253Dlkps%2526_pdataSource%253Dweb%2526_pqStr%253Denabled%2526_pgetId%253Dtrue%2526_plkpTblId%253Djnpr_audiences_targetaccounts_ip%2526_plkpKey%253D_pclIp._pmatchedIP%2526_plkpPrfl%253Dactive%2526_pclIp%253Dactive%2526_pqStr%253Dactive%2526_pidName%253DrmulusId%2526_pidSource%253Dresearch.juniper.net%2526_ptwAids%253Do1oeb%2526_pfbAids%253D340159566928684%2526_pliPids%253D4751%2526_pawAids%253DAW-956680084%2526jnpr_vId%253DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%26_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3D%257B%2522not%2520found%2522%253A%2522not%2520found%2522%257D%26_pcityName%3DThornton%2520Heath%26_pcompanyName%3DHydra%2520Communications%2520Ltd%26_pcontinentCode%3DEU%26_pcontinentName%3DEurope%26_pcountryISOCode%3DGB%26_pcountryName%3DUnited%2520Kingdom%26_platitude%3D51.3863%26_plongitude%3D-0.0996%26_pmatchedIP%3D185.38.150.96%26_ppostalCode%3DCR7%26_pstateISOCode%3DENG%26_pstateName%3DEngland%26_ptimeZone%3DEurope%252FLondon%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654%26_pclId%3Ds4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://research.juniper.net/?_pevId=Dut4hdg3iIaTg6XCmeQtqmXxyTjkcAGH-1582187655&_pdLoc=https%3A%2F%2Fforums.juniper.net%2Ft5%2FThreat-Research%2FDota3-Is-your-Internet-of-Things-device-moonlighting%2Fba-p%2F473478&_pdHash=Unavailable&_pqStr=active&_psqStr=%3F_pclientId%3Djnpr%26_peventName%3Dlkps%26_pdataSource%3Dweb%26_pqStr%3Denabled%26_pgetId%3Dtrue%26_plkpTblId%3Djnpr_audiences_targetaccounts_ip%26_plkpKey%3D_pclIp._pmatchedIP%26_plkpPrfl%3Dactive%26_pclIp%3Dactive%26_pqStr%3Dactive%26_pidName%3DrmulusId%26_pidSource%3Dresearch.juniper.net%26_ptwAids%3Do1oeb%26_pfbAids%3D340159566928684%26_pliPids%3D4751%26_pawAids%3DAW-956680084%26jnpr_vId%3DYwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclientId=jnpr&_peventName=lkps&_pdataSource=web&_pgetId=true&_plkpTblId=jnpr_audiences_targetaccounts_ip&_plkpKey=_pclIp._pmatchedIP&_plkpPrfl=%7B%22not%20found%22%3A%22not%20found%22%7D&_pcityName=Thornton%20Heath&_pcompanyName=Hydra%20Communications%20Ltd&_pcontinentCode=EU&_pcontinentName=Europe&_pcountryISOCode=GB&_pcountryName=United%20Kingdom&_platitude=51.3863&_plongitude=-0.0996&_pmatchedIP=185.38.150.96&_ppostalCode=CR7&_pstateISOCode=ENG&_pstateName=England&_ptimeZone=Europe%2FLondon&_pidName=rmulusId&_pidSource=research.juniper.net&_ptwAids=o1oeb&_pfbAids=340159566928684&_pliPids=4751&_pawAids=AW-956680084&jnpr_vId=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654&_pclId=s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 119
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:16 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 283bdf3b75a40c60d5ae6e80d8c84dd7
x-transaction: 000504a9006988b5
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 satellite-57e2f6c764746d7a990154e8.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 1 KB
676 B 43ms
42ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-57e2f6c764746d7a990154e8.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 0b30b39cc04a7922ed34d3d567d814c6ea9c8cea7e4ba2302b5d45272c13a483

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:17 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:48 GMT
server: AkamaiNetStorage
etag: "143f04ca053bbbb67e7e7db60384c44e:1582139328.582401"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 431
expires: Thu, 20 Feb 2020 09:34:17 GMT

GET
H2 200 satellite-586d49e464746d11fd002f2c.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 414 B
526 B 41ms
40ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-586d49e464746d11fd002f2c.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: f0ebf94842d7584c1c3c4925765c776bc6acc5345d1c01bdb846b416bad07877

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:17 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:48 GMT
server: AkamaiNetStorage
etag: "73f8288b3e1da89f3ff0360bfca03245:1582139328.788734"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 281
expires: Thu, 20 Feb 2020 09:34:17 GMT

GET
H2 200 satellite-5630f65f64746d185c002af5.js Show response
assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/ 503 B
579 B 40ms
40ms Script
application/x-javascript 23.210.248.45
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/scripts/satellite-5630f65f64746d185c002af5.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/998b2d6d4944658536fe36266a249b07e626b86d/satelliteLib-6d05b7c7a99e1cbbdcac4fcfe7005e6bee80a0e9.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.45 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-45.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 1fee2fb3eb1831930f4e325e6f05dc0d322ce37f53cc7da4cd2cdde999ed0b1d

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:17 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 19:08:36 GMT
server: AkamaiNetStorage
etag: "902ab4d82e29bb124a4127654ea7be62:1582139316.38057"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 335
expires: Thu, 20 Feb 2020 09:34:17 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
168 B 147ms
146ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/oct.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 121
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:17 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 283bdf3b75a40c60d5ae6e80d8c84dd7
x-transaction: 00bf5d630093a485
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
163 B 134ms
133ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/oct.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:17 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 283bdf3b75a40c60d5ae6e80d8c84dd7
x-transaction: 00bd35f20010d096
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
117 B 143ms
142ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/oct.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 120
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:17 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 283bdf3b75a40c60d5ae6e80d8c84dd7
x-transaction: 00eeb27900655c00
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
113 B 140ms
139ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/oct.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 117
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:17 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 283bdf3b75a40c60d5ae6e80d8c84dd7
x-transaction: 0035dddb00315723
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
136 B 148ms
147ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/oct.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 20 Feb 2020 08:34:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 120
pragma: no-cache
last-modified: Thu, 20 Feb 2020 08:34:17 GMT
server: tsa_f
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 283bdf3b75a40c60d5ae6e80d8c84dd7
x-transaction: 00cab06f002b3495
expires: Tue, 31 Mar 1981 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

123 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

21 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-19 16:51:23	Name: IDE Value: AHWqTUkV_SWf9iBor0svv8aZfuIaFtTRBlZSr1vnF6j3OjZc8T0oAqmAey2qphUa
.demdex.net/	1970-01-19 11:48:59	Name: demdex Value: 13190393922453674322869507947391180174
.juniper.net/	1970-01-20 01:00:59	Name: rmulusId Value: s4da5MM3tTesf5XkUv2b27N1erlwTcKG-1582187656
forums.juniper.net/	1970-01-22 23:05:47	Name: VISITOR_BEACON Value: ~2rTgrojcmqYIkX6YW~p1KcXm93LKwv7RnTHTrVL57GtgHaiNBWiA8pmCR8XyyYbVimbI5uMnacuWiQcafi4nxIwTmtJW5TLfdjVS-m0g..
.juniper.net/	1970-01-20 01:02:26	Name: AMCV_D206123F524450F50A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C18313%7CMCMID%7C19933235249669886553329589763479381097%7CMCAAMLH-1582792453%7C6%7CMCAAMB-1582792453%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1582194853s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18320%7CvVersion%7C3.1.2
.rmulus.com/	1970-01-20 01:00:59	Name: rmulusId Value: kcMrDHyyxzhos7nLg7gAgv4KK1mxp3kx-1582187655
forums.juniper.net/	1970-01-22 23:05:47	Name: LithiumVisitor Value: ~2g5VaA14ZMnsWPzr1~QLWOuQVXSaCNh1H3okEfdLsGnvbDMwMUf2jV4kaXPXRw_DPqDdpikdVCX6mOYIpH_jw9csPdMDW3wsMZdyCLTA..
.juniper.net/	1970-01-19 07:29:49	Name: mboxEdgeCluster Value: 26
.juniper.net/	1970-01-19 07:31:14	Name: _gid Value: GA1.2.491357842.1582187655
.juniper.net/	1970-01-19 07:29:49	Name: dmdbase_cdc Value: DBSET
forums.juniper.net/	1969-12-31 23:59:59	Name: LiSESSIONID Value: A54DC49911A10913DC3DBAE2D7A7D568
.juniper.net/	1970-01-19 09:39:23	Name: _fbp Value: fb.1.1582187654680.1942104099
.juniper.net/	1970-01-19 09:39:23	Name: _gcl_au Value: 1.1.1828893587.1582187655
.juniper.net/	1970-01-20 01:00:59	Name: _ga Value: GA1.2.1371404925.1582187655
.juniper.net/	1970-01-20 01:03:52	Name: mbox Value: session#01e00dfae1d040b29700789c8b80ebf0#1582189516\|PC#01e00dfae1d040b29700789c8b80ebf0.26_0#1645432456
.juniper.net/	1970-01-20 01:00:59	Name: jnpr_vID Value: YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654
.juniper.net/	1969-12-31 23:59:59	Name: check Value: true
.juniper.net/	1969-12-31 23:59:59	Name: s_cc Value: true
.juniper.net/	1970-01-19 07:29:47	Name: _gat_jn Value: 1
.juniper.net/	1970-01-19 07:29:47	Name: _gat_b Value: 1
.juniper.net/	1969-12-31 23:59:59	Name: AMCVS_D206123F524450F50A490D45%40AdobeOrg Value: 1

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478(Line 5646) Message: Mobile Width. Width is lessthan or equalto 480!
console-api	log	URL: https://forumstage.juniper.net/html/assets/global-nav.js(Line 78) Message: check=true; jnpr_vID=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654; AMCVS_D206123F524450F50A490D45%40AdobeOrg=1; AMCV_D206123F524450F50A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18313%7CMCMID%7C19933235249669886553329589763479381097%7CMCAAMLH-1582792453%7C6%7CMCAAMB-1582792453%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1582194853s%7CNONE%7CvVersion%7C3.1.2; mbox=session#01e00dfae1d040b29700789c8b80ebf0#1582189515; _fbp=fb.1.1582187654680.1942104099
console-api	log	URL: https://forumstage.juniper.net/html/assets/global-nav.js(Line 78) Message: check=true; jnpr_vID=YwFpqGnQUMtTXrs1kBvk1j16vcyy1ZMu-1582187654; AMCVS_D206123F524450F50A490D45%40AdobeOrg=1; AMCV_D206123F524450F50A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18313%7CMCMID%7C19933235249669886553329589763479381097%7CMCAAMLH-1582792453%7C6%7CMCAAMB-1582792453%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1582194853s%7CNONE%7CvVersion%7C3.1.2; mbox=session#01e00dfae1d040b29700789c8b80ebf0#1582189515; _fbp=fb.1.1582187654680.1942104099
console-api	log	URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478(Line 3242) Message: This is secondary nav bar;
console-api	log	URL: https://forums.juniper.net/t5/Threat-Research/Dota3-Is-your-Internet-of-Things-device-moonlighting/ba-p/473478(Line 170) Message: on load

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000;includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3872718.fls.doubleclick.net
5922977.fls.doubleclick.net
ajax.googleapis.com
analytics.twitter.com
api.company-target.com
api.demandbase.com
assets.adobedtm.com
attr.ml-api.io
cloud.webtype.com
cm.everesttech.net
collect.rmulus.com
connect.facebook.net
dpm.demdex.net
fonts.googleapis.com
fonts.gstatic.com
forums.juniper.net
forumstage.juniper.net
googleads.g.doubleclick.net
img.en25.com
jnet.i.lithium.com
junipernetworks.d2.sc.omtrdc.net
junipernetworks.demdex.net
junipernetworks.tt.omtrdc.net
lookups.rmulus.com
match.prod.bidr.io
maxcdn.bootstrapcdn.com
platform.twitter.com
pls.webtype.com
px.ads.linkedin.com
research.juniper.net
s.ml-attr.com
s1229.t.eloqua.com
scripts.demandbase.com
secure.adnxs.com
secure.rmulus.com
segments.company-target.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tags.bluekai.com
use.fontawesome.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.juniper.net
104.103.106.126
104.244.42.195
104.244.42.5
13.35.253.23
13.35.253.69
143.204.202.106
143.204.202.123
143.204.202.20
143.204.202.47
143.204.202.79
143.204.202.92
151.101.12.157
172.217.16.134
172.217.22.38
172.217.22.66
18.139.76.45
185.33.223.203
2001:4de0:ac19::1:b:3a
208.74.205.254
208.74.207.25
209.167.231.17
23.111.9.35
23.210.248.45
23.45.237.36
2a00:1450:4001:80b::2008
2a00:1450:4001:80b::200e
2a00:1450:4001:819::2003
2a00:1450:4001:81d::2003
2a00:1450:4001:81e::200a
2a00:1450:4001:81f::2002
2a00:1450:4001:820::2004
2a00:1450:400c:c00::9b
2a02:26f0:6c00:180::720
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:10:101::b93f:9105
52.212.4.209
52.49.193.31
52.49.234.3
52.72.180.134
65.52.62.25
66.117.28.86
66.117.29.3
68.67.153.60
93.184.220.41
93.184.220.97
01eb8f5a91c70faa5681a3048eab75e78f30b4c4e0c04f8afbb46bfa98371ec0
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0b30b39cc04a7922ed34d3d567d814c6ea9c8cea7e4ba2302b5d45272c13a483
0bd71fe3e4394b7f3049009a604cb4c403d146589b21fe234d656e1268c1b820
0d815b2e925f887c1210ae79918c2daed72f94cafb870f4fedffcfac47a341b4
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1451b7c400c9e305f589883bbe1b45139abc74e3c977a8b91fa353dda6a642cb
1498e3b254909c3f097fc78de60171d0be0c367e534e0af35c21c359ef6801e7
15c14a35beeabe632f718ce14189ade1b8b6760b977e1e8149b5e1211d3efde5
179f42988ae4cab77687b27656fc69ab3fa07efbcf6279ac1bef85ac0688e69d
18b4b83afed32c0ec228e62a5f1080fbad1ca25addd958a4fc8b30c281fcc031
1d111313a277d37912be5ec29e0d77426d991feb85a04106694b72f66739885b
1fee2fb3eb1831930f4e325e6f05dc0d322ce37f53cc7da4cd2cdde999ed0b1d
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
272a2861dab52511f662603420b847ab73e6e13e75e8973c3091bdaa44c51706
2c9f1c57bc31c65cdb84a1c44c0c91fc88799512fd87c5bc6e52b21f69abd5d0
30e3f5a97af46d8cb43bf62c9875a8eacfc02c00826ea47549d4e33d0e1aa446
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
3928a8be3b073b7b4272b3863934222d52f00e782a0d157b9b7edfd7acf1bfbd
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d
3e84bcc6469e170029339c0b60b522671ca5d4298578308ec882df95f7badd9c
3eadffc329fb1c32ee10e809962cb4114a71d92b0f30db0b9ba9bef6abc91015
3f62ff9e57b4243edeb728b981a1380a3bbf12d8c18c092fa93cac93a72e5a6a
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44c53106498ced14c80aab52391120b380216ce24de07bb5a91e659fd3ba8aed
4a3d7f509f217225975b98891f41fde0b216552b35f9a76460e86aaf52454733
4ab00dedcf2dfc4807fa41bb0e6dac322bff250803c5843daa2f3ec65a414426
4c5ed401667661bca33d013a7bc790e2079bbe0300a1a1d5ad5e5780ae259a4b
4c891889ca55d5cadf9e960d2e40f31f50ac0b6252417a9be7414ff2f26a3880
4cdde47aa921b0cc562b8cadb9366ea11d83bd0f27d3aa2e4ab8c22486f592d2
4dcc161d0ef98a2c9c1b776a90ab5c284032d8a333964620545bf1ceee13ac89
4ded81a3d2fd6dd9c1240d80be198e98eb78db7dc4e3e525fd21ffc0c05efbcd
506339130f152becadfa3ab2fbdbab5261035e4f9c343440ec23bc178cdc164a
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
57f53d1b65316e7362b02a42d2a07319fcd3a8d75f2dc91d0094caf98181c741
5855809ae723b4a35f3120be99dccfc8403b3dd379fd86efeacdad8767ea6320
5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685
5b6b9462f29599d5332fa41d67010d03aa0aadb939144caad40e341bd3a2939a
5b9573e1023da775390e9284ec0eb1c606df9b468a28980055b4a6aa804f4350
626ef4978a3758ced595afe37b89812432ef49fe3f967d2cd8e1321459b3a9b8
6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae
6b8797e0cf30f8a00ff41912ebcc895055ffeb426b34f70c4933b9828b1ca720
70349fe86be7c6dcd4062011d02d91185a4a45b60e2826f05985d67f8ae43bd3
70c2868114f52cb3b41e70e017c88ee5f5495639db9d495574e8ced55e7b272f
7283dcbdf14b954c1e61e173cc8bdb244b2bf508b7f0211ac749857bf47acda3
79340c32d5422c3331db60c78f9854b0d9c0a9bd0f9c454b7398734c1b990658
79e16119ceda988947279eb9addd1869b4270af3967b69ec9e09713ae4b6572b
7b08b6c86fb4d51c3e96dd3f06ed35c02b7f0662404fb6b14b9b2b0425a9e28a
7c9a167fcb4f690dc41db9f58f3ee6a20d3bba39316f2b46c8031c6d8ca300f1
7da66ec546c027bfe5b9ca59aa2225cfaa5f0d68f96801f31186878c0fa853f8
7ee39e6b76207efc841a6882a2af5241490e1a2161c4e13790f78fb4dbfdde28
7ff5a2ce1b7603d6e9f61f85587efe96cbed61d71ace91bcc6ca7d0bc07cc7ce
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
847ad7d2d327222488e06177809a66d0517d53362838b94dfd3f1961d209d8b1
851bd834d24a84c0f4780789e868a65f9db8d9655a7a0cac039dbf3b65ad873f
85d9f9ab745f8b1dd6c6dc27722498c9eaf0f1e864242b01c7f396a5fb3aa3dc
8a3e8d4242f53959806c3ebf262affb1bd5a78e361acb2d5bf14be201ee56a3e
8c785b78817298c70c27829e6903d75fac181ed591e3260c4b1fec35f0cd03c0
8febd8b0e9b817a31d401574d8f8aaeb5003d76c2c1afa9da932fa0990685b53
92dc916bc3b1001de758bc7fa95b57046ab5a80f1da16558fe8c8051d331f211
983b0caf336e8542214fc17019a4fc5e0360864b92806ca14d55c1fc1c2c5a0f
9912c03b52a7cb0fc11bde58e200010eca671219552929b31be4c2e26c0e10c3
9c3e9a35283d074cbf4f873b077e78b5a8cbd9a8bb4caa5ccc09e0142962a65a
9e5b8d4ced66c172dc84f16051eee4bac1e0fc60781c1ea05d73072b3cc7ddf1
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a7799f05a1e14db4672cacc4139187b2d37f2ad58c12aeef87dcb2e17ec208df
aadc3580d2b64ff5a7e6f1425587db4e8b033efcbf8f5c332ca52a5ed580c87c
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad9e90d9b2ef8c8af06afa88f231a5cf0dff89eb5c47a948dfbde3c856c7db39
ae88fc0d7a961832f809527d30bd3983a6866d42f66a56ade23f543681594db6
b00947275411cb14f41839133eeef7b1f831236fd29b9ab0b14fd666fb119e22
b1110f2c7ae9f0a22977c4df6431fdfef92d1e8223f9734713e57aeb2ee96fcf
b8eea75e456823a6e0eebfa1e4f27b56395485fff2bbf27e0344f7bf4fa8e509
bacc031e0bfe9a4084bb166f88193dcdc3498aab6b1d14ebedbb75045afce823
bef8b6a5f4399be5da990490ceee7525da2698723a003af12b7095f03a78a34f
c0f533082d6b784c7f939ad3fbcafc2faa6a88d96f0b076f7a0e28b431995bff
c30c04eb35d4ff5c75690016858f8678b3c5ee7c68ec4cd76b71573b50a23943
c5aff3477022f781ee765989cdf6abbdd986f331064c59f5655fab8c6f9796c7
c6846556479addb85175eb801d75cd64485ccec53b42fac54441fef1895c0408
c74679537a89890b260d93e19aad5f4cc95a230623a945ffcc3d981fc13a1adf
cac7a767eecdd70123f853d74d1fb29d15cb89dfd93215b57dce2606b4cd1c23
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d28290639f9ff030dd3d2a375c2050643736a776080d26b272c927aa3c6e9a78
d6c0add51aaab8d3a46989106b3dedc902f41fd63cb466af8160f169d43faf4a
d747a00f20356103c97532afe702f4b89a04a67d45474e6a157d82d649ddb692
db0031471b3f9181ff21d83674674ac3dd7c128531fae90bc274ad0e17c58c37
db82939943dfa4e2ddd5cb40b4eef2237e4ff65a12c248db91352b36dbbca8a3
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e28195ef556c2e1f2d22ff939f487f10a32e608255bbd541be3eda5883b414c3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5d717d2c24e52afc0e139b41d817580583acad2e3c9d725d1bd46f0f7e5cb1b
e613df9aa843851d019cc12e6184972311e2229c14299d2f6c80f4aadf2d844a
e61de02b5fa3204c2ed29bd12fcdceaff8d33d4e9be52ff1a6c02a03a407baea
e8a8cd48f7f93a8c8d708eda1f3f9c6ddd886c3f6c38eee67aeac98897b09510
e8d5b01af589f68a0f2da663d3efc472fabb22d9ede91a7ffcf74d21e6295506
e931faaef092c8d98a58ac536216378f58e2a17a4833bbe5f9a29e5bbed849f6
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ec895e944daf4d8226fe560ff1d95437497215d33885fe2d0db0e54ce3db6d96
ecc66f2f44d4ac576f7cf85e32a8f15ca304e5054f04adf29728c57383568880
ed3a677654473b8329f8d886993e734d6cef36c4273263b767be878c9ff8ff44
edd8db5c29b96b7a290a5e266d426dca85541b7cd7a62b180e5ec89dc635f05f
eec3860fdc0bff086a73a04051948c4e76ea29a6b61eaa870083739555b83f64
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0ebf94842d7584c1c3c4925765c776bc6acc5345d1c01bdb846b416bad07877
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
f7d6b1c8e88874fb2696fc3128ea91fc6f47915466ea9f566ab2c39fcebffbd6
fbb2fccf8cb800177d508c8dfc51812cebb0bc17d4f89509f04d0c7c3e13bc0f

forums.juniper.net Open in urlscan Pro 208.74.207.25 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

169 Requests

100 %HTTPS

28 %IPv6

33 Domains

48 Subdomains

42 IPs

8 Countries

4971 kBTransfer

12267 kBSize

21 Cookies

115 Outgoing links

Redirected requests

169 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

forums.juniper.net Open in urlscan Pro
208.74.207.25 Public Scan

Screenshot
Live screenshot

Full Image

169
Requests

100 %
HTTPS

28 %
IPv6

33
Domains

48
Subdomains

42
IPs

8
Countries

4971 kB
Transfer

12267 kB
Size

21
Cookies

169 HTTP transactions
1 data transactions