urlscan.io logo urlscan.io
SecurityTrails logo

threatpost.com Open in urlscan Pro
35.173.160.135  Public Scan

Go To Rescan Add Verdict Report
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Submission: On April 04 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 113 IPs in 9 countries across 93 domains to perform 511 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com. The Cisco Umbrella rank of the primary domain is 147547.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on June 2nd 2021. Valid for: a year.
This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
34 35.173.160.135 14618 (AMAZON-AES)
15 65.9.66.117 16509 (AMAZON-02)
8 2a00:1450:400... 15169 (GOOGLE)
7 2606:4700:303... 13335 (CLOUDFLAR...)
14 2600:9000:205... 16509 (AMAZON-02)
10 2600:9000:214... 16509 (AMAZON-02)
8 2a00:1450:400... 15169 (GOOGLE)
1 185.85.15.23 200107 (KL-EXT)
6 65.9.62.173 16509 (AMAZON-02)
1 9 151.101.194.137 54113 (FASTLY)
5 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
15 142.250.181.226 15169 (GOOGLE)
8 151.101.2.137 54113 (FASTLY)
1 23.45.103.213 16625 (AKAMAI-AS)
1 46.105.202.126 16276 (OVH)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
2 54.36.109.183 16276 (OVH)
11 18.223.60.0 16509 (AMAZON-02)
4 2a00:1450:400... 15169 (GOOGLE)
6 2a00:1450:400... 15169 (GOOGLE)
3 5 2620:116:800d... 16509 (AMAZON-02)
1 199.232.136.157 54113 (FASTLY)
1 3 147.75.38.124 54825 (PACKET)
1 2606:4700::68... 13335 (CLOUDFLAR...)
4 104.85.251.43 16625 (AKAMAI-AS)
2 7 206.189.254.17 14061 (DIGITALOC...)
4 18.156.195.47 16509 (AMAZON-02)
4 13 185.33.221.87 29990 (ASN-APPNEX)
3 18.196.121.26 16509 (AMAZON-02)
1 19 35.244.159.8 15169 (GOOGLE)
4 2602:803:c004... 26667 (RUBICONPR...)
1 4 72.251.249.9 29791 (VOXEL-DOT...)
7 213.19.147.43 26120 (RHYTHMONE)
1 52.28.166.250 16509 (AMAZON-02)
9 54.154.244.32 16509 (AMAZON-02)
1 2600:9000:206... 16509 (AMAZON-02)
1 104.244.42.197 13414 (TWITTER)
3 2a00:1450:400... 15169 (GOOGLE)
24 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 52.28.203.152 16509 (AMAZON-02)
4 185.64.189.112 62713 (AS-PUBMATIC)
2 34.242.106.163 16509 (AMAZON-02)
1 64.140.160.2 18450 (WEBNX)
1 104.244.42.67 13414 (TWITTER)
1 54.154.15.255 16509 (AMAZON-02)
2 15.188.95.229 16509 (AMAZON-02)
1 1 54.75.68.230 16509 (AMAZON-02)
6 2a00:1450:400... 15169 (GOOGLE)
11 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 8 185.29.134.245 30419 (MEDIAMATH...)
1 2602:803:c004... 26667 (RUBICONPR...)
1 2 2a02:2638::1c 44788 (ASN-CRITE...)
2 178.250.2.146 44788 (ASN-CRITE...)
3 151.101.193.108 54113 (FASTLY)
4 11 72.247.225.98 16625 (AKAMAI-AS)
5 72.247.225.32 16625 (AKAMAI-AS)
3 5 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 2 172.217.16.134 15169 (GOOGLE)
2 138.201.63.164 24940 (HETZNER-AS)
2 23.58.217.190 16625 (AKAMAI-AS)
3 3 185.29.134.244 30419 (MEDIAMATH...)
4 13 37.157.6.252 198622 (ADFORM)
2 7 15.197.193.217 16509 (AMAZON-02)
6 20 142.250.186.66 15169 (GOOGLE)
1 5 144.76.91.199 24940 (HETZNER-AS)
3 6 13.248.245.213 16509 (AMAZON-02)
1 1 165.227.252.242 14061 (DIGITALOC...)
1 205.185.216.42 20446 (STACKPATH...)
1 2620:1ec:46::45 8068 (MICROSOFT...)
8 104.109.78.125 16625 (AKAMAI-AS)
2 35.186.253.211 15169 (GOOGLE)
2 3 2a05:d018:d29... 16509 (AMAZON-02)
3 3 18.194.22.119 16509 (AMAZON-02)
5 6 3.122.58.191 16509 (AMAZON-02)
2 2 54.246.18.24 16509 (AMAZON-02)
4 4 54.75.174.52 16509 (AMAZON-02)
1 1 185.64.190.80 62713 (AS-PUBMATIC)
2 5 185.86.137.131 201081 (SMARTADSE...)
1 2620:1ec:c11:... 8068 (MICROSOFT...)
4 7 209.54.180.3 16509 (AMAZON-02)
3 3 64.202.112.63 22075 (AS-OUTBRAIN)
3 88.99.219.174 24940 (HETZNER-AS)
1 15 18.202.206.42 16509 (AMAZON-02)
1 67.202.105.21 32748 (STEADFAST)
1 51.89.9.254 16276 (OVH)
3 185.86.137.108 201081 (SMARTADSE...)
1 1 72.251.249.13 29791 (VOXEL-DOT...)
3 4 213.19.147.45 26120 (RHYTHMONE)
1 1 193.0.160.128 54312 (ROCKETFUEL)
3 178.162.133.149 60781 (LEASEWEB-...)
3 3 18.156.0.31 16509 (AMAZON-02)
1 2600:1901:0:7... 15169 (GOOGLE)
12 2606:4700:20:... 13335 (CLOUDFLAR...)
2 3 18.195.155.181 16509 (AMAZON-02)
2 2 2.19.35.65 16625 (AKAMAI-AS)
1 178.162.133.148 60781 (LEASEWEB-...)
2 2 18.198.240.99 16509 (AMAZON-02)
2 2 54.225.98.71 14618 (AMAZON-AES)
1 2600:1f18:444... 14618 (AMAZON-AES)
3 3 69.173.144.165 26667 (RUBICONPR...)
2 3 52.95.126.160 16509 (AMAZON-02)
3 5 69.173.144.139 26667 (RUBICONPR...)
1 2a00:1288:80:... 203220 (YAHOO-DEB)
2 35.244.174.68 15169 (GOOGLE)
2 2 198.148.27.139 19189 (PULSEPOINT)
1 1 185.33.221.50 29990 (ASN-APPNEX)
2 2 3.122.214.5 16509 (AMAZON-02)
3 3 64.202.112.127 22075 (AS-OUTBRAIN)
1 54.83.246.18 14618 (AMAZON-AES)
1 1 52.21.142.155 14618 (AMAZON-AES)
1 1 52.203.60.58 14618 (AMAZON-AES)
1 193.122.130.38 31898 (ORACLE-BM...)
1 169.197.150.8 398989 (DEEPINTENT)
1 1 184.25.158.112 16625 (AKAMAI-AS)
2 2 52.49.221.146 16509 (AMAZON-02)
3 34.241.76.6 16509 (AMAZON-02)
1 2 151.101.2.49 54113 (FASTLY)
1 2 169.50.137.184 36351 (SOFTLAYER)
2 2 135.125.160.77 16276 (OVH)
1 1 202.241.208.53 4694 (IDCF IDC ...)
2 2 185.184.8.90 204995 (RTB-HOUSE...)
27 37.157.6.235 198622 (ADFORM)
1 1 192.82.242.209 62713 (AS-PUBMATIC)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2604:9e00:1:1... 27257 (WEBAIR-IN...)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 69.173.151.100 26667 (RUBICONPR...)
1 85.114.131.235 24961 (MYLOC-AS ...)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
2 2 84.200.5.215 31400 (ACCELERAT...)
1 78.46.85.162 24940 (HETZNER-AS)
1 2 23.67.134.223 16625 (AKAMAI-AS)
1 151.101.2.110 54113 (FASTLY)
511 113
34    35.173.160.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com
threatpost.com
kasperskycontenthub.com
15    65.9.66.117 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-117.fra56.r.cloudfront.net
tagan.adlightning.com
8    2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagservices.com
7    2606:4700:3031::6815:456d (United States)

ASN13335 (CLOUDFLARENET, US)
qd.admetricspro.com
14    2600:9000:2057:6400:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02, US)
assets.threatpost.com
10    2600:9000:214f:e600:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02, US)
media.threatpost.com
8    2a00:1450:4001:802::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    185.85.15.23 (Germany)

ASN200107 (KL-EXT, CH)
media.kaspersky.com
6    65.9.62.173 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-62-173.fra56.r.cloudfront.net
c.amazon-adsystem.com
9    151.101.194.137 (United States)

ASN54113 (FASTLY, US)
cd.connatix.com
cds.connatix.com
capi.connatix.com
img.connatix.com
5    2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
2    2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
15    142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net
securepubads.g.doubleclick.net
partner.googleadservices.com
8    151.101.2.137 (United States)

ASN54113 (FASTLY, US)
ins.connatix.com
vid.connatix.com
1    23.45.103.213 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-45-103-213.deploy.static.akamaitechnologies.com
secure.cdn.fastclick.net
1    46.105.202.126 (France)

ASN16276 (OVH, FR)
cdn.id5-sync.com
2    2606:4700:20::681a:8a9 (United States)

ASN13335 (CLOUDFLARENET, US)
script.4dex.io
2    54.36.109.183 (France)

ASN16276 (OVH, FR)
PTR: p08.id5-sync.com
id5-sync.com
11    18.223.60.0 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-223-60-0.us-east-2.compute.amazonaws.com
capi-tier-1-us-east-2.connatix.com
4    2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
imasdk.googleapis.com
6    2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
5    2620:116:800d:21:36a9:ecb:e518:b308 (United States)

ASN16509 (AMAZON-02, US)
secure.quantserve.com
pixel.quantserve.com
cms.quantserve.com
1    199.232.136.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
3    147.75.38.124 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)
prebid.a-mo.net
1    2606:4700::6812:372 (United States)

ASN13335 (CLOUDFLARENET, US)
mp.4dex.io
4    104.85.251.43 (Berlin, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-85-251-43.deploy.static.akamaitechnologies.com
htlb.casalemedia.com
7    206.189.254.17 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
e.serverbid.com
4    18.156.195.47 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
c2shb.ssp.yahoo.com
c2shb.pubgw.yahoo.com
13    185.33.221.87 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
ib.adnxs.com
3    18.196.121.26 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-121-26.eu-central-1.compute.amazonaws.com
btlr.sharethrough.com
19    35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com
teachingaids-d.openx.net
u.openx.net
eu-u.openx.net
us-u.openx.net
gift-connect-d.openx.net
4    2602:803:c004:200::140 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
fastlane.rubiconproject.com
4    72.251.249.9 (Amsterdam, Netherlands)

ASN29791 (VOXEL-DOT-NET, US)
ap.lijit.com
7    213.19.147.43 (Utrecht, Netherlands)

ASN26120 (RHYTHMONE, US)
tag.1rx.io
1    52.28.166.250 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-166-250.eu-central-1.compute.amazonaws.com
tlx.3lift.com
9    54.154.244.32 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-154-244-32.eu-west-1.compute.amazonaws.com
ads.servenobid.com
1    2600:9000:206f:f000:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
rules.quantcount.com
1    104.244.42.197 (United States)

ASN13414 (TWITTER, US)
t.co
3    2a00:1450:4001:827::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
s0.2mdn.net
24    2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
2    2a00:1450:400c:c07::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
5    2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.de
adservice.google.com
2    2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
2    2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    52.28.203.152 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
c2shb.pubgw.yahoo.com
4    185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
2    34.242.106.163 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-242-106-163.eu-west-1.compute.amazonaws.com
dpm.demdex.net
1    64.140.160.2 (Ogden, United States)

ASN18450 (WEBNX, US)
PTR: threatintelligenceplatform.com
geo.ipify.org
1    104.244.42.67 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
1    54.154.15.255 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-154-15-255.eu-west-1.compute.amazonaws.com
kaspersky.demdex.net
2    15.188.95.229 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-188-95-229.eu-west-3.compute.amazonaws.com
kaspersky.d3.sc.omtrdc.net
1    54.75.68.230 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-75-68-230.eu-west-1.compute.amazonaws.com
cm.everesttech.net
6    2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.de
googleads.g.doubleclick.net
11    2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
1    2a02:26f0:3500:7::17d8:4dc8 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
8    185.29.134.245 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)
tags.mathtag.com
1    2602:803:c004:200::154 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
beacon-fra2.rubiconproject.com
2    2a02:2638::1c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
gum.criteo.com
2    178.250.2.146 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
mug.criteo.com
3    151.101.193.108 (United States)

ASN54113 (FASTLY, US)
acdn.adnxs.com
11    72.247.225.98 (Berlin, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-225-98.deploy.static.akamaitechnologies.com
js-sec.indexww.com
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
5    72.247.225.32 (Berlin, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-225-32.deploy.static.akamaitechnologies.com
ads.pubmatic.com
5    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
1    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px4.ads.linkedin.com
2    172.217.16.134 (United States)

ASN15169 (GOOGLE, US)
PTR: zrh04s06-in-f134.1e100.net
9582686.fls.doubleclick.net
2    138.201.63.164 (Reilingen, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.164.63.201.138.clients.your-server.de
hal9000.redintelligence.net
2    23.58.217.190 (Berlin, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-58-217-190.deploy.static.akamaitechnologies.com
pixel.mathtag.com
3    185.29.134.244 (United Kingdom)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
13    37.157.6.252 (Denmark)

ASN198622 (ADFORM, DK)
PTR: s1.adform.net
c1.adform.net
track.adform.net
7    15.197.193.217 (United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com
match.adsrvr.org
20    142.250.186.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net
cm.g.doubleclick.net
5    144.76.91.199 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.199.91.76.144.clients.your-server.de
hal900018.redintelligence.net
6    13.248.245.213 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com
eb2.3lift.com
1    165.227.252.242 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
sync.serverbid.com
1    205.185.216.42 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map2.hwcdn.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1    2620:1ec:46::45 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
public.servenobid.com
8    104.109.78.125 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-109-78-125.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
2    35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com
rtb.openx.net
3    2a05:d018:d29:3605:9f4c:83a8:7085:a009 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
pr-bh.ybp.yahoo.com
3    18.194.22.119 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-22-119.eu-central-1.compute.amazonaws.com
pm.w55c.net
6    3.122.58.191 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-122-58-191.eu-central-1.compute.amazonaws.com
x.bidswitch.net
2    54.246.18.24 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-246-18-24.eu-west-1.compute.amazonaws.com
r.scoota.co
4    54.75.174.52 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-75-174-52.eu-west-1.compute.amazonaws.com
match.prod.bidr.io
1    185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
5    185.86.137.131 (France)

ASN201081 (SMARTADSERVER, FR)
rtb-csync.smartadserver.com
1    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.bing.com
7    209.54.180.3 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
3    64.202.112.63 (Leesburg, United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com
b1sync.zemanta.com
3    88.99.219.174 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.174.219.99.88.clients.your-server.de
hal900029.redintelligence.net
15    18.202.206.42 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
g2.gumgum.com
rtb.gumgum.com
1    67.202.105.21 (United States)

ASN32748 (STEADFAST, US)
PTR: ip21.67-202-105.static.steadfastdns.net
pixel.33across.com
1    51.89.9.254 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip254.ip-51-89-9.eu
onetag-sys.com
3    185.86.137.108 (France)

ASN201081 (SMARTADSERVER, FR)
ssbsync.smartadserver.com
1    72.251.249.13 (Amsterdam, Netherlands)

ASN29791 (VOXEL-DOT-NET, US)
ce.lijit.com
4    213.19.147.45 (Utrecht, Netherlands)

ASN26120 (RHYTHMONE, US)
sync.1rx.io
1    193.0.160.128 (United States)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
3    178.162.133.149 (Rijswijk, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1-sync.go.sonobi.com
sync.go.sonobi.com
3    18.156.0.31 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com
ups.analytics.yahoo.com
1    2600:1901:0:76b9:: (Kansas City, United States)

ASN15169 (GOOGLE, US)
prod-rtb.ad4mat.net
12    2606:4700:20::681a:ad1 (United States)

ASN13335 (CLOUDFLARENET, US)
as.ad4m.at
ad4m.at
assets.ad4m.at
3    18.195.155.181 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
cs.emxdgt.com
2    2.19.35.65 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-35-65.deploy.static.akamaitechnologies.com
secure-assets.rubiconproject.com
1    178.162.133.148 (Rijswijk, Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1.go.sonobi.com
go.sonobi.com
2    18.198.240.99 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-198-240-99.eu-central-1.compute.amazonaws.com
pixel.advertising.com
2    54.225.98.71 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-225-98-71.compute-1.amazonaws.com
i.liadm.com
1    2600:1f18:444a:4602:2c20:3113:5c28:1366 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
i6.liadm.com
3    69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
token.rubiconproject.com
3    52.95.126.160 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
aax-eu.amazon-adsystem.com
5    69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
1    2a00:1288:80:807::1 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)
ads.yahoo.com
2    35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com
id.rlcdn.com
2    198.148.27.139 (New York, United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
1    185.33.221.50 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 728.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
secure.adnxs.com
2    3.122.214.5 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-122-214-5.eu-central-1.compute.amazonaws.com
ads.creative-serving.com
3    64.202.112.127 (Leesburg, United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com
sync.outbrain.com
1    54.83.246.18 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-83-246-18.compute-1.amazonaws.com
cs-server-s2s.yellowblue.io
1    52.21.142.155 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-142-155.compute-1.amazonaws.com
sync.srv.stackadapt.com
1    52.203.60.58 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-203-60-58.compute-1.amazonaws.com
sync.ipredictive.com
1    193.122.130.38 (Ashburn, United States)

ASN31898 (ORACLE-BMC-31898, US)
sync.technoratimedia.com
1    169.197.150.8 (United States)

ASN398989 (DEEPINTENT, US)
PTR: g.deepintent.com
match.deepintent.com
1    184.25.158.112 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-25-158-112.deploy.static.akamaitechnologies.com
stags.bluekai.com
2    52.49.221.146 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-221-146.eu-west-1.compute.amazonaws.com
ad.360yield.com
3    34.241.76.6 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-241-76-6.eu-west-1.compute.amazonaws.com
usersync.gumgum.com
2    151.101.2.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
2    169.50.137.184 (United States)

ASN36351 (SOFTLAYER, US)
PTR: b8.89.32a9.ip4.static.sl-reverse.com
um.simpli.fi
2    135.125.160.77 (France)

ASN16276 (OVH, FR)
PTR: ns3195934.ip-135-125-160.eu
gu.dyntrk.com
1    202.241.208.53 (Japan)

ASN4694 (IDCF IDC Frontier Inc., JP)
tg.socdm.com
2    185.184.8.90 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-90.rtbhouse.net
creativecdn.com
27    37.157.6.235 (Denmark)

ASN198622 (ADFORM, DK)
s1.adform.net
1    192.82.242.209 (United States)

ASN62713 (AS-PUBMATIC, US)
image6.pubmatic.com
2    2606:4700::6812:d05 (United States)

ASN13335 (CLOUDFLARENET, US)
a.tribalfusion.com
s.tribalfusion.com
1    2604:9e00:1:129::2:a01 (United States)

ASN27257 (WEBAIR-INTERNET, US)
rtb2-useast.torchad.com
1    2606:4700:20::ac43:444e (United States)

ASN13335 (CLOUDFLARENET, US)
static-de.ad4mat.net
1    69.173.151.100 (United States)

ASN26667 (RUBICONPROJECT, US)
pixel-us-east.rubiconproject.com
1    85.114.131.235 (Rheinfelden, Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: srv21039.dus4.fastwebserver.de
cdn.contentspread.net
2    2606:4700:20::681a:bd1 (United States)

ASN13335 (CLOUDFLARENET, US)
ad4m.at
2    84.200.5.215 (Germany)

ASN31400 (ACCELERATED-IT, DE)
www.telefonica-partner.de
www.lead-alliance.net
1    78.46.85.162 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: nonstopads1.sunbonet.de
partner.o2online.de
2    23.67.134.223 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-67-134-223.deploy.static.akamaitechnologies.com
www.awin1.com
1    151.101.2.110 (United States)

ASN54113 (FASTLY, US)
a1.awin1.com
Apex Domain
Subdomains		 Transfer
56 threatpost.com
threatpost.com — Cisco Umbrella Rank: 147547
assets.threatpost.com — Cisco Umbrella Rank: 399303
media.threatpost.com — Cisco Umbrella Rank: 354086
864 KB
42 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 193
stats.g.doubleclick.net — Cisco Umbrella Rank: 95
googleads.g.doubleclick.net — Cisco Umbrella Rank: 43
9582686.fls.doubleclick.net — Cisco Umbrella Rank: 340449
cm.g.doubleclick.net — Cisco Umbrella Rank: 206
217 KB
40 adform.net
c1.adform.net — Cisco Umbrella Rank: 571
track.adform.net — Cisco Umbrella Rank: 3843
s1.adform.net — Cisco Umbrella Rank: 8738
397 KB
37 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 98
ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
tpc.googlesyndication.com — Cisco Umbrella Rank: 125
779 KB
28 connatix.com
cd.connatix.com — Cisco Umbrella Rank: 3428
cds.connatix.com — Cisco Umbrella Rank: 3539
capi.connatix.com — Cisco Umbrella Rank: 3917
ins.connatix.com — Cisco Umbrella Rank: 5944
capi-tier-1-us-east-2.connatix.com — Cisco Umbrella Rank: 4414
vid.connatix.com — Cisco Umbrella Rank: 4140
img.connatix.com — Cisco Umbrella Rank: 4251
2 MB
24 rubiconproject.com
fastlane.rubiconproject.com — Cisco Umbrella Rank: 450
beacon-fra2.rubiconproject.com — Cisco Umbrella Rank: 14174
eus.rubiconproject.com — Cisco Umbrella Rank: 551
secure-assets.rubiconproject.com — Cisco Umbrella Rank: 1110
token.rubiconproject.com — Cisco Umbrella Rank: 669
pixel.rubiconproject.com — Cisco Umbrella Rank: 348
pixel-us-east.rubiconproject.com — Cisco Umbrella Rank: 1170
52 KB
21 openx.net
teachingaids-d.openx.net — Cisco Umbrella Rank: 23504
u.openx.net — Cisco Umbrella Rank: 730
eu-u.openx.net — Cisco Umbrella Rank: 1942
us-u.openx.net — Cisco Umbrella Rank: 399
rtb.openx.net — Cisco Umbrella Rank: 1485
gift-connect-d.openx.net — Cisco Umbrella Rank: 13506
4 KB
18 gumgum.com
g2.gumgum.com — Cisco Umbrella Rank: 1523
rtb.gumgum.com — Cisco Umbrella Rank: 1242
usersync.gumgum.com — Cisco Umbrella Rank: 3241
5 KB
17 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 245
acdn.adnxs.com — Cisco Umbrella Rank: 560
secure.adnxs.com — Cisco Umbrella Rank: 436
68 KB
16 amazon-adsystem.com
c.amazon-adsystem.com — Cisco Umbrella Rank: 290
s.amazon-adsystem.com — Cisco Umbrella Rank: 278
aax-eu.amazon-adsystem.com — Cisco Umbrella Rank: 1196
48 KB
15 adlightning.com
tagan.adlightning.com — Cisco Umbrella Rank: 1406
350 KB
14 ad4m.at
as.ad4m.at — Cisco Umbrella Rank: 2661
ad4m.at — Cisco Umbrella Rank: 2238
assets.ad4m.at — Cisco Umbrella Rank: 37080
736 KB
13 mathtag.com
tags.mathtag.com — Cisco Umbrella Rank: 2574
pixel.mathtag.com — Cisco Umbrella Rank: 1197
sync.mathtag.com — Cisco Umbrella Rank: 438
8 KB
12 yahoo.com
c2shb.ssp.yahoo.com — Cisco Umbrella Rank: 795
c2shb.pubgw.yahoo.com — Cisco Umbrella Rank: 1133
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 370
ups.analytics.yahoo.com — Cisco Umbrella Rank: 287
ads.yahoo.com — Cisco Umbrella Rank: 1030
4 KB
12 casalemedia.com
htlb.casalemedia.com — Cisco Umbrella Rank: 470
ssum-sec.casalemedia.com — Cisco Umbrella Rank: 536
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 568
10 KB
12 google.com
www.google.com — Cisco Umbrella Rank: 7
adservice.google.com — Cisco Umbrella Rank: 76
4 KB
11 1rx.io
tag.1rx.io — Cisco Umbrella Rank: 1309
sync.1rx.io — Cisco Umbrella Rank: 534
2 KB
11 pubmatic.com
hbopenbid.pubmatic.com — Cisco Umbrella Rank: 446 Failed
ads.pubmatic.com — Cisco Umbrella Rank: 453
image2.pubmatic.com — Cisco Umbrella Rank: 882
image6.pubmatic.com — Cisco Umbrella Rank: 610
31 KB
10 redintelligence.net
hal9000.redintelligence.net — Cisco Umbrella Rank: 31903
hal900018.redintelligence.net — Cisco Umbrella Rank: 293208
hal900029.redintelligence.net — Cisco Umbrella Rank: 205092
14 KB
10 servenobid.com
ads.servenobid.com — Cisco Umbrella Rank: 2023
public.servenobid.com — Cisco Umbrella Rank: 4173
7 KB
8 smartadserver.com
rtb-csync.smartadserver.com — Cisco Umbrella Rank: 626
ssbsync.smartadserver.com — Cisco Umbrella Rank: 1219
3 KB
8 serverbid.com
e.serverbid.com — Cisco Umbrella Rank: 3180
sync.serverbid.com — Cisco Umbrella Rank: 5979
2 KB
8 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 169
281 KB
7 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 326
2 KB
7 3lift.com
tlx.3lift.com — Cisco Umbrella Rank: 566
eb2.3lift.com — Cisco Umbrella Rank: 325
3 KB
7 admetricspro.com
qd.admetricspro.com — Cisco Umbrella Rank: 24025
323 KB
6 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 285
3 KB
6 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 385
www.linkedin.com — Cisco Umbrella Rank: 595
px4.ads.linkedin.com — Cisco Umbrella Rank: 4868
4 KB
6 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 39
40 KB
5 google.de
adservice.google.de — Cisco Umbrella Rank: 8069
www.google.de — Cisco Umbrella Rank: 5640
2 KB
5 lijit.com
ap.lijit.com — Cisco Umbrella Rank: 602
ce.lijit.com — Cisco Umbrella Rank: 908
2 KB
5 quantserve.com
secure.quantserve.com — Cisco Umbrella Rank: 962
pixel.quantserve.com — Cisco Umbrella Rank: 418
cms.quantserve.com — Cisco Umbrella Rank: 1104
11 KB
5 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 70
388 KB
4 sonobi.com
sync.go.sonobi.com — Cisco Umbrella Rank: 1004
go.sonobi.com — Cisco Umbrella Rank: 761
2 KB
4 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 489
2 KB
4 criteo.com
gum.criteo.com — Cisco Umbrella Rank: 389
mug.criteo.com — Cisco Umbrella Rank: 2685
1 KB
4 googleapis.com
imasdk.googleapis.com — Cisco Umbrella Rank: 405
703 KB
3 awin1.com
www.awin1.com — Cisco Umbrella Rank: 15359
a1.awin1.com — Cisco Umbrella Rank: 58190
2 KB
3 outbrain.com
sync.outbrain.com — Cisco Umbrella Rank: 835
1 KB
3 liadm.com
i.liadm.com — Cisco Umbrella Rank: 531
i6.liadm.com — Cisco Umbrella Rank: 1596
1 KB
3 emxdgt.com
cs.emxdgt.com — Cisco Umbrella Rank: 884
428 B
3 zemanta.com
b1sync.zemanta.com — Cisco Umbrella Rank: 558
2 KB
3 w55c.net
pm.w55c.net — Cisco Umbrella Rank: 873
2 KB
3 indexww.com
js-sec.indexww.com — Cisco Umbrella Rank: 709
5 KB
3 everesttech.net
cm.everesttech.net — Cisco Umbrella Rank: 1018
sync-tm.everesttech.net — Cisco Umbrella Rank: 575
814 B
3 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 208
kaspersky.demdex.net — Cisco Umbrella Rank: 256293
5 KB
3 2mdn.net
s0.2mdn.net — Cisco Umbrella Rank: 257
108 KB
3 sharethrough.com
btlr.sharethrough.com — Cisco Umbrella Rank: 1085
337 B
3 a-mo.net
prebid.a-mo.net — Cisco Umbrella Rank: 1149
830 B
3 4dex.io
script.4dex.io — Cisco Umbrella Rank: 1906
mp.4dex.io — Cisco Umbrella Rank: 2659
24 KB
3 id5-sync.com
cdn.id5-sync.com — Cisco Umbrella Rank: 1658
id5-sync.com — Cisco Umbrella Rank: 607
12 KB
2 tribalfusion.com
a.tribalfusion.com — Cisco Umbrella Rank: 800
s.tribalfusion.com — Cisco Umbrella Rank: 2468
1 KB
2 creativecdn.com
creativecdn.com — Cisco Umbrella Rank: 650
695 B
2 dyntrk.com
gu.dyntrk.com — Cisco Umbrella Rank: 1250
850 B
2 simpli.fi
um.simpli.fi — Cisco Umbrella Rank: 809
842 B
2 360yield.com
ad.360yield.com — Cisco Umbrella Rank: 654
624 B
2 creative-serving.com
ads.creative-serving.com — Cisco Umbrella Rank: 3682
1 KB
2 contextweb.com
bh.contextweb.com — Cisco Umbrella Rank: 587
824 B
2 rlcdn.com
id.rlcdn.com — Cisco Umbrella Rank: 599
2 advertising.com
pixel.advertising.com — Cisco Umbrella Rank: 350
627 B
2 ad4mat.net
prod-rtb.ad4mat.net — Cisco Umbrella Rank: 106947
static-de.ad4mat.net — Cisco Umbrella Rank: 159676
4 KB
2 scoota.co
r.scoota.co — Cisco Umbrella Rank: 38423
1 KB
2 omtrdc.net
kaspersky.d3.sc.omtrdc.net — Cisco Umbrella Rank: 233441
560 B
2 gstatic.com
www.gstatic.com
285 KB
2 kasperskycontenthub.com
kasperskycontenthub.com — Cisco Umbrella Rank: 350744
1 KB
1 o2online.de
partner.o2online.de — Cisco Umbrella Rank: 63171
2 KB
1 lead-alliance.net
www.lead-alliance.net — Cisco Umbrella Rank: 56124
456 B
1 telefonica-partner.de
www.telefonica-partner.de — Cisco Umbrella Rank: 58265
287 B
1 contentspread.net
cdn.contentspread.net — Cisco Umbrella Rank: 52453
1 KB
1 torchad.com
rtb2-useast.torchad.com — Cisco Umbrella Rank: 20668
233 B
1 socdm.com
tg.socdm.com — Cisco Umbrella Rank: 1857
694 B
1 bluekai.com
stags.bluekai.com — Cisco Umbrella Rank: 469
1 KB
1 deepintent.com
match.deepintent.com — Cisco Umbrella Rank: 933
44 B
1 technoratimedia.com
sync.technoratimedia.com — Cisco Umbrella Rank: 1184
292 B
1 ipredictive.com
sync.ipredictive.com — Cisco Umbrella Rank: 1001
428 B
1 stackadapt.com
sync.srv.stackadapt.com — Cisco Umbrella Rank: 822
580 B
1 yellowblue.io
cs-server-s2s.yellowblue.io — Cisco Umbrella Rank: 3935
323 B
1 rfihub.com
p.rfihub.com — Cisco Umbrella Rank: 725
755 B
1 onetag-sys.com
onetag-sys.com — Cisco Umbrella Rank: 841
814 B
1 33across.com
pixel.33across.com — Cisco Umbrella Rank: 2431
1 bing.com
c.bing.com — Cisco Umbrella Rank: 230
594 B
1 digitaloceanspaces.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com — Cisco Umbrella Rank: 7077
5 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 938
3 KB
1 googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 782 Failed
227 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 518
459 B
1 ipify.org
geo.ipify.org — Cisco Umbrella Rank: 63408
676 B
1 t.co
t.co — Cisco Umbrella Rank: 463
337 B
1 quantcount.com
rules.quantcount.com — Cisco Umbrella Rank: 894
354 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 622
6 KB
1 fastclick.net
secure.cdn.fastclick.net — Cisco Umbrella Rank: 1664
17 KB
1 kaspersky.com
media.kaspersky.com — Cisco Umbrella Rank: 134181
48 KB
0 wbtrk.net Failed
um.wbtrk.net Failed
0 netmng.com Failed
google2waycm.netmng.com Failed
511 93
Domain Requested by
32 threatpost.com threatpost.com
27 s1.adform.net track.adform.net
s1.adform.net
threatpost.com
24 pagead2.googlesyndication.com srcdoc
tagan.adlightning.com
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
www.googletagservices.com
tpc.googlesyndication.com
googleads.g.doubleclick.net
ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
20 cm.g.doubleclick.net 6 redirects u.openx.net
eb2.3lift.com
ssbsync.smartadserver.com
ssum-sec.casalemedia.com
g2.gumgum.com
googleads.g.doubleclick.net
ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
15 tagan.adlightning.com threatpost.com
tagan.adlightning.com
ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
14 rtb.gumgum.com 1 redirects g2.gumgum.com
14 securepubads.g.doubleclick.net www.googletagservices.com
tagan.adlightning.com
securepubads.g.doubleclick.net
threatpost.com
ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
14 assets.threatpost.com threatpost.com
assets.threatpost.com
13 ib.adnxs.com 4 redirects qd.admetricspro.com
cds.connatix.com
acdn.adnxs.com
11 tpc.googlesyndication.com tagan.adlightning.com
ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
googleads.g.doubleclick.net
11 capi-tier-1-us-east-2.connatix.com cd.connatix.com
10 media.threatpost.com threatpost.com
9 track.adform.net hal900018.redintelligence.net
hal900029.redintelligence.net
s1.adform.net
9 ads.servenobid.com qd.admetricspro.com
public.servenobid.com
ssbsync.smartadserver.com
g2.gumgum.com
ssum-sec.casalemedia.com
8 eus.rubiconproject.com qd.admetricspro.com
eus.rubiconproject.com
threatpost.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
g2.gumgum.com
8 tags.mathtag.com 1 redirects tagan.adlightning.com
threatpost.com
ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
8 www.google.com threatpost.com
ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
tagan.adlightning.com
googleads.g.doubleclick.net
8 www.googletagservices.com threatpost.com
tagan.adlightning.com
ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
googleads.g.doubleclick.net
7 s.amazon-adsystem.com 4 redirects eb2.3lift.com
ssum-sec.casalemedia.com
7 match.adsrvr.org 2 redirects u.openx.net
eb2.3lift.com
ssum-sec.casalemedia.com
7 eu-u.openx.net u.openx.net
qd.admetricspro.com
eu-u.openx.net
7 tag.1rx.io qd.admetricspro.com
cds.connatix.com
7 e.serverbid.com 2 redirects qd.admetricspro.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
7 vid.connatix.com cd.connatix.com
cds.connatix.com
7 qd.admetricspro.com threatpost.com
qd.admetricspro.com
6 assets.ad4m.at as.ad4m.at
6 x.bidswitch.net 5 redirects eb2.3lift.com
6 eb2.3lift.com 3 redirects qd.admetricspro.com
eb2.3lift.com
6 us-u.openx.net 1 redirects u.openx.net
eu-u.openx.net
6 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
threatpost.com
6 c.amazon-adsystem.com qd.admetricspro.com
c.amazon-adsystem.com
5 pixel.rubiconproject.com 3 redirects g2.gumgum.com
5 rtb-csync.smartadserver.com 2 redirects eu-u.openx.net
ssbsync.smartadserver.com
5 hal900018.redintelligence.net 1 redirects threatpost.com
tagan.adlightning.com
hal900018.redintelligence.net
5 ads.pubmatic.com cds.connatix.com
qd.admetricspro.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
g2.gumgum.com
5 www.googletagmanager.com threatpost.com
www.googletagmanager.com
5 cds.connatix.com threatpost.com
cd.connatix.com
4 dsum-sec.casalemedia.com 1 redirects ssum-sec.casalemedia.com
4 ad4m.at as.ad4m.at
ad4m.at
4 as.ad4m.at googleads.g.doubleclick.net
as.ad4m.at
ad4m.at
4 sync.1rx.io 3 redirects public.servenobid.com
4 ssum-sec.casalemedia.com 3 redirects public.servenobid.com
4 match.prod.bidr.io 4 redirects
4 c1.adform.net 4 redirects
4 px.ads.linkedin.com 2 redirects eb2.3lift.com
4 googleads.g.doubleclick.net tagan.adlightning.com
googleads.g.doubleclick.net
4 adservice.google.com tagan.adlightning.com
9582686.fls.doubleclick.net
4 ap.lijit.com 1 redirects qd.admetricspro.com
public.servenobid.com
4 fastlane.rubiconproject.com qd.admetricspro.com
4 htlb.casalemedia.com qd.admetricspro.com
cds.connatix.com
4 hbopenbid.pubmatic.com qd.admetricspro.com
cds.connatix.com
4 imasdk.googleapis.com cd.connatix.com
imasdk.googleapis.com
3 usersync.gumgum.com g2.gumgum.com
3 sync.outbrain.com 3 redirects
3 aax-eu.amazon-adsystem.com 2 redirects
3 token.rubiconproject.com 3 redirects
3 cs.emxdgt.com 2 redirects serverbid-sync.nyc3.cdn.digitaloceanspaces.com
3 ups.analytics.yahoo.com 3 redirects
3 sync.go.sonobi.com public.servenobid.com
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
3 ssbsync.smartadserver.com public.servenobid.com
g2.gumgum.com
ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
3 hal900029.redintelligence.net tagan.adlightning.com
hal900029.redintelligence.net
3 b1sync.zemanta.com 3 redirects
3 pm.w55c.net 3 redirects
3 pr-bh.ybp.yahoo.com 2 redirects eu-u.openx.net
3 sync.mathtag.com 3 redirects
3 js-sec.indexww.com cds.connatix.com
qd.admetricspro.com
3 acdn.adnxs.com cds.connatix.com
qd.admetricspro.com
3 adservice.google.de tagan.adlightning.com
3 pixel.quantserve.com 2 redirects threatpost.com
3 s0.2mdn.net imasdk.googleapis.com
s1.adform.net
3 teachingaids-d.openx.net qd.admetricspro.com
cds.connatix.com
3 btlr.sharethrough.com qd.admetricspro.com
3 c2shb.ssp.yahoo.com qd.admetricspro.com
3 prebid.a-mo.net 1 redirects qd.admetricspro.com
cds.connatix.com
2 www.awin1.com 1 redirects as.ad4m.at
2 creativecdn.com 2 redirects
2 gu.dyntrk.com 2 redirects
2 um.simpli.fi 1 redirects ssum-sec.casalemedia.com
2 sync-tm.everesttech.net 1 redirects ssum-sec.casalemedia.com
2 ad.360yield.com 2 redirects
2 ads.creative-serving.com 2 redirects
2 bh.contextweb.com 2 redirects
2 id.rlcdn.com ssbsync.smartadserver.com
2 i.liadm.com 2 redirects
2 pixel.advertising.com 2 redirects
2 secure-assets.rubiconproject.com 2 redirects
2 r.scoota.co 2 redirects
2 rtb.openx.net eu-u.openx.net
googleads.g.doubleclick.net
2 pixel.mathtag.com tagan.adlightning.com
2 hal9000.redintelligence.net tagan.adlightning.com
2 9582686.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 u.openx.net cds.connatix.com
2 mug.criteo.com
2 gum.criteo.com 1 redirects
2 kaspersky.d3.sc.omtrdc.net media.kaspersky.com
2 dpm.demdex.net media.kaspersky.com
threatpost.com
2 c2shb.pubgw.yahoo.com cds.connatix.com
2 www.google.de threatpost.com
2 ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com securepubads.g.doubleclick.net
tagan.adlightning.com
2 stats.g.doubleclick.net www.google-analytics.com
2 img.connatix.com threatpost.com
2 id5-sync.com qd.admetricspro.com
cdn.id5-sync.com
2 script.4dex.io qd.admetricspro.com
script.4dex.io
2 www.gstatic.com www.google.com
2 kasperskycontenthub.com threatpost.com
1 a1.awin1.com as.ad4m.at
1 partner.o2online.de as.ad4m.at
1 www.lead-alliance.net 1 redirects
1 www.telefonica-partner.de 1 redirects
1 cdn.contentspread.net hal900018.redintelligence.net
1 pixel-us-east.rubiconproject.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 static-de.ad4mat.net as.ad4m.at
1 rtb2-useast.torchad.com ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
1 s.tribalfusion.com ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
1 a.tribalfusion.com 1 redirects
1 image6.pubmatic.com 1 redirects
1 cms.quantserve.com 1 redirects
1 tg.socdm.com 1 redirects
1 stags.bluekai.com 1 redirects
1 match.deepintent.com g2.gumgum.com
1 sync.technoratimedia.com g2.gumgum.com
1 sync.ipredictive.com 1 redirects
1 sync.srv.stackadapt.com 1 redirects
1 cs-server-s2s.yellowblue.io g2.gumgum.com
1 secure.adnxs.com 1 redirects
1 ads.yahoo.com
1 i6.liadm.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 gift-connect-d.openx.net serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 go.sonobi.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1 prod-rtb.ad4mat.net googleads.g.doubleclick.net
1 p.rfihub.com 1 redirects
1 ce.lijit.com 1 redirects
1 onetag-sys.com public.servenobid.com
1 pixel.33across.com public.servenobid.com
1 g2.gumgum.com public.servenobid.com
1 c.bing.com eb2.3lift.com
1 image2.pubmatic.com 1 redirects
1 public.servenobid.com qd.admetricspro.com
1 serverbid-sync.nyc3.cdn.digitaloceanspaces.com qd.admetricspro.com
1 sync.serverbid.com 1 redirects
1 px4.ads.linkedin.com
1 www.linkedin.com 1 redirects
1 beacon-fra2.rubiconproject.com tagan.adlightning.com
1 snap.licdn.com www.googletagmanager.com
1 partner.googleadservices.com tagan.adlightning.com
1 cm.everesttech.net 1 redirects
1 kaspersky.demdex.net tagan.adlightning.com
1 analytics.twitter.com tagan.adlightning.com
1 geo.ipify.org qd.admetricspro.com
1 t.co threatpost.com
1 rules.quantcount.com secure.quantserve.com
1 tlx.3lift.com qd.admetricspro.com
1 mp.4dex.io qd.admetricspro.com
1 static.ads-twitter.com www.googletagmanager.com
1 secure.quantserve.com www.googletagmanager.com
1 cdn.id5-sync.com tagan.adlightning.com
1 secure.cdn.fastclick.net tagan.adlightning.com
1 ins.connatix.com cd.connatix.com
1 capi.connatix.com cd.connatix.com
1 cd.connatix.com 1 redirects
1 media.kaspersky.com threatpost.com
0 um.wbtrk.net Failed ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
0 google2waycm.netmng.com Failed ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
511 163
Subject Issuer Validity Valid
threatpost.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-06-02 -
2022-07-03		 a year crt.sh
*.adlightning.com
Amazon		 2021-06-24 -
2022-07-23		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-08-11 -
2022-08-10		 a year crt.sh
assets.threatpost.com
Amazon		 2022-01-05 -
2023-02-03		 a year crt.sh
media.threatpost.com
Amazon		 2022-01-05 -
2023-02-03		 a year crt.sh
www.google.com
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
kasperskycontenthub.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-06-02 -
2022-07-03		 a year crt.sh
media.kaspersky.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-04-23 -
2022-04-28		 a year crt.sh
c.amazon-adsystem.com
Amazon		 2021-07-06 -
2022-06-27		 a year crt.sh
*.connatix.com
Go Daddy Secure Certificate Authority - G2		 2021-08-20 -
2022-09-21		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
secure.cdn.fastclick.net
DigiCert SHA2 Secure Server CA		 2022-01-15 -
2023-01-17		 a year crt.sh
cdn.id5-sync.com
R3		 2022-02-02 -
2022-05-03		 3 months crt.sh
*.id5-sync.com
R3		 2022-03-08 -
2022-06-06		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-22 -
2022-09-21		 a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-21 -
2022-07-26		 a year crt.sh
*.a-mo.net
R3		 2022-03-08 -
2022-06-06		 3 months crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018		 2021-12-12 -
2022-12-13		 a year crt.sh
e.serverbid.com
R3		 2022-01-17 -
2022-04-17		 3 months crt.sh
web.ssp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2022-03-08 -
2022-08-31		 6 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2022-02-11 -
2023-03-14		 a year crt.sh
*.sharethrough.com
Amazon		 2021-08-13 -
2022-09-11		 a year crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2021-07-08 -
2022-08-08		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-03-08 -
2023-04-04		 a year crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2021-03-11 -
2022-04-12		 a year crt.sh
*.1rx.io
Sectigo RSA Domain Validation Secure Server CA		 2021-06-01 -
2022-07-02		 a year crt.sh
*.3lift.com
Amazon		 2021-06-12 -
2022-07-11		 a year crt.sh
ads.servenobid.com
Amazon		 2021-06-28 -
2022-07-27		 a year crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh
*.doubleclick.net
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
*.google.de
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
*.google.com
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
www.google.de
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1		 2021-08-04 -
2022-09-04		 a year crt.sh
*.demdex.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-19 -
2022-11-19		 a year crt.sh
*.ipify.org
Sectigo RSA Domain Validation Secure Server CA		 2022-02-07 -
2023-03-10		 a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh
*.d3.sc.omtrdc.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-02-17 -
2023-03-07		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2022-03-01 -
2023-03-01		 a year crt.sh
*.mathtag.com
DigiCert SHA2 Secure Server CA		 2020-04-15 -
2022-04-22		 2 years crt.sh
*.criteo.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-02-04 -
2022-05-03		 3 months crt.sh
cdn.adnxs.com
GlobalSign Organization Validated CA - SHA256 - G4		 2021-05-10 -
2022-06-11		 a year crt.sh
redintelligence.net
R3		 2022-03-29 -
2022-06-27		 3 months crt.sh
pixel.mathtag.com
DigiCert SHA2 Secure Server CA		 2021-06-29 -
2022-07-07		 a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2021-03-18 -
2022-04-19		 a year crt.sh
*.nyc3.cdn.digitaloceanspaces.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-03-30 -
2022-04-30		 a year crt.sh
public.servenobid.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-02-17 -
2023-02-17		 a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2022-01-18 -
2022-07-13		 6 months crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA		 2022-03-28 -
2022-09-28		 6 months crt.sh
*.bidswitch.net
Sectigo RSA Domain Validation Secure Server CA		 2020-04-23 -
2022-05-04		 2 years crt.sh
www.bing.com
Microsoft RSA TLS CA 01		 2022-03-16 -
2022-09-16		 6 months crt.sh
*.gumgum.com
Amazon		 2021-06-05 -
2022-07-04		 a year crt.sh
*.33across.com
Sectigo RSA Domain Validation Secure Server CA		 2021-09-23 -
2022-09-30		 a year crt.sh
*.onetag-sys.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-01-10 -
2023-01-03		 a year crt.sh
*.smartadserver.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-01-25 -
2023-01-25		 a year crt.sh
*.go.sonobi.com
Go Daddy Secure Certificate Authority - G2		 2021-12-08 -
2023-01-09		 a year crt.sh
prod-rtb.ad4mat.net
GTS CA 1D4		 2022-02-19 -
2022-05-20		 3 months crt.sh
*.emxdgt.com
Go Daddy Secure Certificate Authority - G2		 2021-05-18 -
2022-06-19		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2022-02-03 -
2023-02-25		 a year crt.sh
track.adform.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-06 -
2022-10-07		 a year crt.sh
*.technoratimedia.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2021-09-17 -
2022-10-05		 a year crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2020-04-09 -
2022-06-08		 2 years crt.sh
*.everesttech.net
GlobalSign Atlas R3 DV TLS CA 2022 Q1		 2022-02-03 -
2023-03-07		 a year crt.sh
*.ad-server.k8s.ie.ggops.com
Amazon		 2022-02-15 -
2023-03-16		 a year crt.sh
*.torchad.com
AlphaSSL CA - SHA256 - G2		 2021-09-20 -
2022-10-22		 a year crt.sh
contentspread.net
R3		 2022-03-31 -
2022-06-29		 3 months crt.sh
www.awin1.com
DigiCert SHA2 Secure Server CA		 2021-06-11 -
2022-06-16		 a year crt.sh

This page contains 72 frames:

Primary Page: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Frame ID: 816A5AEE5600B999A217677FF85B38FC
Requests: 153 HTTP requests in this frame

Frame: https://cds.connatix.com/p/157363/connatix.player.dc.js
Frame ID: 89D9A4D3E4BE29507FDFC7CE04F815CD
Requests: 25 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.508.0_en.html
Frame ID: A8579251B900CAF823AC269F761A77AD
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.508.0_en.html
Frame ID: A5B8CCE7AC37B27E0DFD2AB62B0E43D0
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.508.0_en.html
Frame ID: 2F6EC291FFFC085F52E7DCD0603964B7
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: CE6DC2933D3E86619F394A24FD961EDF
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: FDBE4E43F9429C7E624DF8E941A12422
Requests: 1 HTTP requests in this frame

Frame: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Frame ID: D695E28A82599FBD2C8076195685976F
Requests: 21 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 8E627D655F1F54F3BC71EE37A0F27018
Requests: 1 HTTP requests in this frame

Frame: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 4B8956161BED60DDC2C7CA4B5222BFDC
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-39123b0-71ac0870.js
Frame ID: 7C8D76160E57E1C4A870E1CB49C4B120
Requests: 13 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-39123b0-71ac0870.js
Frame ID: 9389EFAC0A3FB3D98A6335E1895CA772
Requests: 9 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-39123b0-71ac0870.js
Frame ID: 272594FCBDC32EE6D802BBDD8EFB54E8
Requests: 9 HTTP requests in this frame

Frame: https://kaspersky.demdex.net/dest5.html?d_nsid=0
Frame ID: 9DCFC916E47BF72044DF4F56B5C971F1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20190131/zrt_lookup.html
Frame ID: 62F9FAEC6335E68C1285C79000BE1A5B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186312&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077259281&bpp=18&bdt=1587&idt=388&shv=r20220330&mjsv=m202203240101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=2&ga_vid=444449005.1649077256&ga_sid=1649077260&ga_hid=401462433&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=1655249595&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44761044&oid=2&pvsid=775667503959110&pem=251&tmod=193232701&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.wdjrp9w0hetu&fsb=1&dtd=639
Frame ID: B9ECEDD6E86C993720D3AF48908052A7
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-39123b0-71ac0870.js
Frame ID: BDC7DE9B2D0CF17909CA1FB6895A9D69
Requests: 15 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-39123b0-71ac0870.js
Frame ID: 901A6D37FF94E7E600F8BACAAC885D68
Requests: 15 HTTP requests in this frame

Frame: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 768E7B580DF54866355061E1B9168F6D
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220330/r20190131/zrt_lookup.html
Frame ID: 0A094A92E80F356DB0AFCA7DBE087A29
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: DDF3D6143256A736BF768C5D3F555DFE
Requests: 3 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Frame ID: 2CE92F0A55ED01A9F99EF8F9FC8F390B
Requests: 7 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 5A5E28CB87006101F701145C8F2DAAB0
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Frame ID: DED4010B01B288401DBF9DA44392EC6F
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 0B080B4B592D0CBEF24560FEE994783D
Requests: 3 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Frame ID: E24DC2BB1DEFAAB6FFD185F252288424
Requests: 7 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Frame ID: 2AC3E20D9F4C5014BB2DDC1E1A5FE13D
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 09917217B86806A332E9AC01B038AE2A
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: D5537CEF11239C90E0B586E82BCDABB5
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: DD0FFE0F2F28C627BC544682FA358C2A
Requests: 2 HTTP requests in this frame

Frame: https://9582686.fls.doubleclick.net/activityi;dc_pre=COWozMO7-vYCFdoHBgAdQtkOhA;src=9582686;type=globalc;cat=globa0;ord=2524034030170;gtm=2od3u0;auiddc=497573009.1649077262;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F;u6=;u7=88238087729275811294175148010201061015-444449005.1649077256;u9=_log4jshell-swarm-vmware-servers-miners-backdoors_179142_;~oref=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3
Frame ID: 286CF63B59F741C80527EFFE12FED2DB
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Frame ID: 9788C58DF39AEF3E039FA5DC9FF54F0B
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 6001E6218F140DC8102097AE0F3813C7
Requests: 3 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Frame ID: 1FBBD22DEFC20892C86F2A1CB2E4CF22
Requests: 7 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: FF711F46F64686D38CE5913B6914C13E
Requests: 11 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 36ED8A137480996FCF818CCA38CE8810
Requests: 8 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: 48251D3C2DC94AC2CFAA1BBB525DAEB2
Requests: 9 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 361C3B6074CB898E4B7C9582DFD91F5A
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon?informer=13394437
Frame ID: 657218121F68F96DC849583E79BFF83E
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: 4D7CF26B21F7CFD6DD8DCE0004D87F53
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
Frame ID: 486F993A8E88121DA9369CEE82302AEA
Requests: 9 HTTP requests in this frame

Frame: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Frame ID: E4F5942B49E52D30FD69D60F6FF23549
Requests: 16 HTTP requests in this frame

Frame: https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Frame ID: DF72E7151960A0D047CA255321188FD0
Requests: 1 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Frame ID: 9EF0DB5FE80CFFF8200602141F170C0E
Requests: 1 HTTP requests in this frame

Frame: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Frame ID: 22E354D40202ED48C78C8D2CD34A264C
Requests: 6 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Frame ID: 03A2D5C7782BB086450BE3D35AB5DBFF
Requests: 10 HTTP requests in this frame

Frame: https://hal900018.redintelligence.net/request_content.php?s=72207300145112504380392011919018&a=572c741f
Frame ID: 7DAE574CB7C548FAFCDB57F0F829A3D1
Requests: 12 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?&gdpr=0&geo=eu&co=de
Frame ID: 1E2834FF5C43B1735017C585AA4E9428
Requests: 2 HTTP requests in this frame

Frame: https://as.ad4m.at/ad/dr?ed=1ka67n0wb4ryt38nr6jvz03qh4rhkb2yv6a2kpefbj3qz421jddy5e0bqb0nwsdsfbkt5teajbbdjka9vab1v2150ampzz8vc900cy1dve9mqhd8p9xxedzaarm8rh1nvmj53x9hgy8w526s4pvfbb7w2m882rgnq1wv6jqwgm3e6052rhkwqvgd0y853s1pdnx5qdx9jga2ggcyvx8xny9wnb240x9sz33f8yje6cs99d6feb189haevj3w781awkpkcr10fbe835513x5eeva96hc9t4bhxz54d4yc6z4kkrk20v0nhtmbj94fyyprm45wmfdw2xwxqzs07mbx5wbqa27my3d6r2k2h1mesc7da6byq9489eqpt8yv6291zjb5s6t7wvk7tty35sp9kb5036fyeypfy7h25z6zn4rtphttzcp88&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%26client%3Dca-pub-7500593236707325%26adurl%3D
Frame ID: B211446EE694CA74058705E8C52AEC83
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: B3BA19147C0E24B0E25CD1A831963C9D
Requests: 7 HTTP requests in this frame

Frame: https://cs.emxdgt.com/um?ssp=pbs&redirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D44%26userId%3D%24UID
Frame ID: 32463509D32C2879F85F2BF57A05E718
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Frame ID: 24598CDAB6910A8B9CBF93D3A02EF80D
Requests: 3 HTTP requests in this frame

Frame: https://go.sonobi.com/uc.html?pubid=e55fb5d7c2
Frame ID: E8323EE664C1ADC74CFDBB801EB384FF
Requests: 1 HTTP requests in this frame

Frame: https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Frame ID: FFD119FED53495111CFA5A4655E93A7E
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156319&userIdMacro=PM_UID&predirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D4%26userId%3DPM_UID
Frame ID: 6B02E507F981AB96E2FCC40FE30DB01E
Requests: 1 HTTP requests in this frame

Frame: https://hal900029.redintelligence.net/request_content.php?s=58495700119238404380388011919029&a=b54eb72a
Frame ID: 8E36D81921728116091F87846BC04B6F
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 7EF68B1E780236C93C570946A83FF3B3
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: C33AE6C4E6BCEFE395F104EFEF3279AA
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: BC13C59CF5D7677E85DCFFD13DD1B2F7
Requests: 9 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=mmh&i=398a624a-ec0e-4b01-a32f-29671dd4853d&gdpr=0&gdpr_consent=
Frame ID: 581FDCE5E52004CAB0909D1F31076DD5
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=atm&i=YkrsDAAAAJKdVwQA&gdpr=0&gdpr_consent=
Frame ID: 1ECF12EA4D82310F766FC226EE4B749B
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV84ZmY5YTcxNi0zNzIzLTQzNzAtYTdkYy03MzU5ODZjMDc1Y2I=&gdpr=0&gdpr_consent=
Frame ID: 67249CB6512B59DADDD4B3B9CF18D37D
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Frame ID: 74E4D4E90E0B974E5ECF39AB63A84362
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=ttd&i=ba772fae-fb7e-433d-b9e8-18ab9acb3f0c&t=1651669264
Frame ID: 6D5E0BFC77152B8ECCC3002521986E1B
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=gumgum
Frame ID: A0224CE42D93E15A6EA9C0413A805746
Requests: 3 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=emx&uid=8615746979499682240brt21431649077264722786f1
Frame ID: 4EC710353AC1AA2D6DCA8B4327C88B4E
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=sus&i=YkrsEcCo5ugAAO1d15kAAAAA
Frame ID: 8E501C8494AD64A337B077FC605B8D8E
Requests: 1 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usersync?b=rth&i=aRT0vZg4C1cQyGAlw60s&pi=gumgum&tc=1
Frame ID: F834D573D8F99453281580AB4C90C7C7
Requests: 1 HTTP requests in this frame

Frame: https://ad4m.at/frame.html
Frame ID: E86C42523E3B5BC462F2A31325914F3F
Requests: 1 HTTP requests in this frame

Frame: https://s1.adform.net/Banners/Elements/Files/160090/10998795/10998795.js?ADFassetID=10998795&bv=258
Frame ID: 9CE85DAC3A3A8930A2A57354F2E8E056
Requests: 12 HTTP requests in this frame

Frame: https://s1.adform.net/Banners/Elements/Files/160090/10998790/10998790.js?ADFassetID=10998790&bv=258
Frame ID: DDDA5D86B193B2EE2839367C1498370B
Requests: 13 HTTP requests in this frame

Frame: https://as.ad4m.at/ad/rar?a=19458%2C183570%2C25177&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2Cz4pFRfEYaqR47upHBHMtqtedETJTwTrkSW%2CVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQ&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2C8QjCDfM8FR2wQtgHJHEtqC7gRtPTwT1MUk%2CmE6TefgGH9JPFmHZHZtQC2WKaDTwT41FA&c=300&d=250&e=ipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_&g=12bc4966941cd995447e84927e34b7d0%2F12633427948423530538&i=20774%2C9731%2C27543&j=14%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1649077265653&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jq0r83tf9ms6z5xgr6t9fcrw7zebynp0hvtmw1f48fzkmb7wexqm8dqsfdt5xb6v2k6y81s3qgbp4dtgkdyqng0x0y4hbav0j98qn9ey4fh0rpt3f5hr94q8nhkkxcc5722m7yfvjqbpahjxt462fgs7msz4nvzkgzjqrg8a3dgqar8md6h06yvvb37pdjzejbr6psf8da6h406ht69cq62ykx2fr8276w4hhtr9g8w6qgq32befh9kbzzn9e9ykwgbzcd9q7mdmh1j6thg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%2526client%253Dca-pub-7500593236707325%2526adurl%253D&y=1&z=0
Frame ID: 7A02D4C2A4F005954FCA2874DE036486
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Log4JShell Used to Swarm VMware Servers with Miners, Backdoors | Threatpost

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • tpc\.googlesyndication\.com/safeframe
Overall confidence: 100%
Detected patterns
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • googletagservices\.com/tag/js/gpt(?:_mobile)?\.js
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • /prebid\.js
  • adnxs\.com/[^"]*(?:prebid|/pb\.js)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • \.quantserve\.com/quant\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

511
Requests

84 %
HTTPS

26 %
IPv6

93
Domains

163
Subdomains

113
IPs

9
Countries

8148 kB
Transfer

17871 kB
Size

122
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 45
  • https://cd.connatix.com/connatix.player.js HTTP 302
  • https://cds.connatix.com/p/157363/connatix.player.dc.js
Request Chain 191
  • https://cm.everesttech.net/cm/dd?d_uuid=83717903610884437954011580615560476877 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YkrsDAAAAJKdVwQA
Request Chain 233
  • https://tags.mathtag.com/notify/img?exch=ruc&s_exch=ruc&id=5aW95q2jLzIzLyAvT1RZMlpUWTNPRFl0WW1Ka01DMHpZamM1TFRBd01EQXRNREF3TURBd01EQXdNREF3LzE2NjExNzg0ODcxMDA5NzU4OTIvMTA0MDYyOTUvMTExNDI0ODEvOS9rNXQyOTRaRGZ2TWtqazA5ZGdBNjFqM2hGclhnY0tnQ1owMHhfeC01T3N3LzEvOS8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMTY2MTE3ODQ4NzEwMDk3NTg5Mi9hbXMvMC8xMDAwMS8xMDEvOTk5LzIvMmEwMzoxYjIwOjY6ZjAwMDo6LzAuMDAwLzE2NDkwNzcyNTYvMTY0OTA4OTg1Ni85LzE5MjU0Lw/_pM5IRdt8Q9jfvHYkhWfNmK-Plg&nodeid=357&group=cdg&auctionid=1661178487100975892&shardkey=1661178487100975892&sid=11142481&cid=10406295&price=9EA28A1ECD524110&bp=a_cagefj&nfy_act=LD5wfn0&type=burl&client=c2s&src=imp&bfip=185.29.134.181 HTTP 302
  • https://tags.mathtag.com/ck-confirm?bid_id=1661178487100975892&node_id=357&exch_id=9
Request Chain 251
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fthreatpost.com%2F&domain=threatpost.com&cw=1&lsw=1 HTTP 302
  • https://mug.criteo.com/sid?cpp=RMdY4nxhZERuWEJKTkkvdjFxWnBEMlVJYU1PSmZzVmw0NWt2SVQ4UFFSV3pSZ3g4MmVGNDgyUGI3Y1h4bnpWS3hiSldyM1pUNlBNRGdWVUJCVVFJY2g0dEF5ZW1QVTcrUFd2Y3BUYjVNNjJtQm9aZXBSK1BFVFBYMTRzdGhUNnkwMnRCMmFIWnZrQ1VWOXM1b2Zlejk5NHcyUndiWHFjMzY0SzZBTFFxckVNbWIxbEVibnQ0cG83M1VGTDRqWnBBTnhhMkczU2xwTW53NWJNRjZZTVRHMFFad2ZxUlhNWi9JdDlJNG9KLzRTMmN1UmQwPXw&cppv=2
Request Chain 260
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1649077261614&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3 HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D39138%26time%3D1649077261614%26url%3Dhttps%253A%252F%252Fthreatpost.com%252Flog4jshell-swarm-vmware-servers-miners-backdoors%252F179142%252F%253Fes_id%253D967c5201a3%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1649077261614&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1649077261614&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&liSync=true&e_ipv6=AQJVs0f1R98uYwAAAX_0qhwJkgj1Rqfhz_UdH0TCbGn2u6cPUr6pl6efWV7viqEACwN0wMfV
Request Chain 264
  • https://9582686.fls.doubleclick.net/activityi;src=9582686;type=globalc;cat=globa0;ord=2524034030170;gtm=2od3u0;auiddc=497573009.1649077262;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F;u6=;u7=88238087729275811294175148010201061015-444449005.1649077256;u9=_log4jshell-swarm-vmware-servers-miners-backdoors_179142_;~oref=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3 HTTP 302
  • https://9582686.fls.doubleclick.net/activityi;dc_pre=COWozMO7-vYCFdoHBgAdQtkOhA;src=9582686;type=globalc;cat=globa0;ord=2524034030170;gtm=2od3u0;auiddc=497573009.1649077262;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F;u6=;u7=88238087729275811294175148010201061015-444449005.1649077256;u9=_log4jshell-swarm-vmware-servers-miners-backdoors_179142_;~oref=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3
Request Chain 269
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=398a624a-ec0e-4b01-a32f-29671dd4853d
Request Chain 270
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&&val=95XsMqTE6Grsnutk9pH1a_KXumrslOsw-MGHFROi
Request Chain 271
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8804791352649137698
Request Chain 274
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGDMuHtjrB9PflyXnCcgEpU&google_cver=1
Request Chain 275
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=398a624a-ec0e-4b01-a32f-29671dd4853d
Request Chain 276
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072956&&val=95XsMqTE6Grsnutk9pH1a_KXumrslOsw-MGHFROi
Request Chain 277
  • https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=3184545604644256536
Request Chain 280
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGDMuHtjrB9PflyXnCcgEpU&google_cver=1
Request Chain 289
  • https://hal900018.redintelligence.net/request.php?zone=13jyvo1ofguz&nw=20&renderingType=javascript&namespace=0d816687fc&subid=&uid=facdb5ac1437de61&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aruc&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3D1f328385c6725036ee24783edd71c25810098ea0_55%26mt_aid%3D1661178487100975892%26mt_id%3D10406295%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D9%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D0088624a-ec0e-4c01-8853-b63b47d1bc7e%26mt_cid%3D0088624a-ec0e-4c01-8853-b63b47d1bc7e%26mt_3pck%3Dhttps%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F1ae7566e-24ce-409a-945b-6cc4b4592ccf%2F%26redirect%3D&documentReferer=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ancestorOrigins=https%3A%2F%2Fthreatpost.com&random=7228620978956&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
  • https://hal900018.redintelligence.net/request.php?zone=13jyvo1ofguz&nw=20&renderingType=javascript&namespace=0d816687fc&subid=&uid=facdb5ac1437de61&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aruc&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3D1f328385c6725036ee24783edd71c25810098ea0_55%26mt_aid%3D1661178487100975892%26mt_id%3D10406295%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D9%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D0088624a-ec0e-4c01-8853-b63b47d1bc7e%26mt_cid%3D0088624a-ec0e-4c01-8853-b63b47d1bc7e%26mt_3pck%3Dhttps%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F1ae7566e-24ce-409a-945b-6cc4b4592ccf%2F%26redirect%3D&documentReferer=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ancestorOrigins=https%3A%2F%2Fthreatpost.com&random=7228620978956&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Request Chain 294
  • https://eb2.3lift.com/sync HTTP 302
  • https://eb2.3lift.com/sync?&ld=1
Request Chain 295
  • https://sync.serverbid.com/ss/2000891.html HTTP 302
  • https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Request Chain 310
  • https://pm.w55c.net/ping_match.gif?ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_ HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_ HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537072979&val=FuM1Z2B31NBmkn5
Request Chain 311
  • https://x.bidswitch.net/sync?ssp=openx HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=openx HTTP 302
  • https://r.scoota.co/sync?ssp=bidswitch&bidswitch_ssp_id=openx HTTP 302
  • https://r.scoota.co/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=openx HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=29&expires=30&user_id=fb5ace67-5a3b-4989-bdd1-e25324821773&ssp=openx HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072968&val=61911d27-645c-4628-a192-91958e64f135&gdpr=&gdpr_consent=
Request Chain 312
  • https://ib.adnxs.com/getuid?https://eu-u.openx.net/w/1.0/sd?id=537072399&val=$UID HTTP 302
  • https://eu-u.openx.net/w/1.0/sd?id=537072399&val=8615746979499682240
Request Chain 313
  • https://match.prod.bidr.io/cookie-sync/ox HTTP 303
  • https://match.prod.bidr.io/cookie-sync/ox?_bee_ppp=1 HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFERzFFN0VsZGdBQURjNEQzUlZhUQ&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1 HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AADG1E7EldgAADc4D3RVaQ&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dsas%252Cpp%252Cox%26bee_sync_current_partner%3Dpm%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2 HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AADG1E7EldgAADc4D3RVaQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID
Request Chain 316
  • https://eb2.3lift.com/ebda?sync=1&gdpr=1&cmp_cs= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMwMTY5MTgxMTIxNzIwMjk5MDczNw%3D%3D
Request Chain 318
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMwMTY5MTgxMTIxNzIwMjk5MDczNw%3D%3D
Request Chain 320
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/3301691811217202990737?gdpr=1&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-k9JTOtBE2oQAvkIrKpMJAySQslvgLoQCz3N_S5U2Zw--~A&dongle=0883
Request Chain 323
  • https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=3301691811217202990737 HTTP 302
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=3301691811217202990737&dcc=t
Request Chain 324
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Request Chain 335
  • https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D HTTP 302
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Request Chain 336
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID HTTP 302
  • https://ads.servenobid.com/sync?pid=312&uid=8615746979499682240
Request Chain 337
  • https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D HTTP 302
  • https://ads.servenobid.com/sync?pid=310&uid=ecc0e880e0d35add66c56dac
Request Chain 339
  • https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D HTTP 302
  • https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1649077264605
Request Chain 340
  • https://p.rfihub.com/cm?pub=44007&in=1 HTTP 302
  • https://ads.servenobid.com/sync?pid=324&uid=5133329520874020148
Request Chain 342
  • https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D HTTP 302
  • https://ads.servenobid.com/sync?pid=327&uid=98208ee0-12fe-4234-b79d-199a00d6b88b&gdpr=0&gdpr_consent=&us_privacy=1YN-
Request Chain 343
  • https://ups.analytics.yahoo.com/ups/58559/occ HTTP 302
  • https://ups.analytics.yahoo.com/ups/58559/occ?verify=true HTTP 302
  • https://ads.servenobid.com/sync?pid=337&uid=y-Nfn2Zb9E2uHDl8SDkvCzSG8ow.6IQzs9tu_AmIg-~A
Request Chain 357
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17632&endpoint=us-east HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Request Chain 361
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D28%26userId%3D%24UID HTTP 302
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=8615746979499682240
Request Chain 362
  • https://ssum-sec.casalemedia.com/usermatchredir?s=185073&cb=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D1%26userId%3D HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D1%26userId%3D&s=185073&C=1 HTTP 302
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=YkrsEIZYLJzLV1osrv.wvQAA%261143
Request Chain 363
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D24%26userId%3D%24UID HTTP 307
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=ecc0e880e0d35add66c56dac
Request Chain 365
  • https://pixel.advertising.com/ups/56621/occ HTTP 302
  • https://pixel.advertising.com/ups/56621/occ?verify=true HTTP 302
  • https://ups.analytics.yahoo.com/ups/56621/occ?apid=UP48fcb14d-b417-11ec-a461-02c4a1bc5354 HTTP 302
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP48fcb14d-b417-11ec-a461-02c4a1bc5354
Request Chain 366
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dco%26nuid%3D HTTP 302
  • https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-a488ff72-6761-4746-a867-7bd37bcdf906
Request Chain 367
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fi.liadm.com%2Fs%2F56939%3Fbidder_id%3D203802%26bidder_uuid%3D HTTP 302
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-a488ff72-6761-4746-a867-7bd37bcdf906 HTTP 303
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-a488ff72-6761-4746-a867-7bd37bcdf906&_li_chk=true&previous_uuid=04daad812d0e4038bceb3e87f0910835 HTTP 303
  • https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-a488ff72-6761-4746-a867-7bd37bcdf906
Request Chain 374
  • https://token.rubiconproject.com/token?pid=36584 HTTP 302
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L1KQ0QWX-26-D7D2
Request Chain 375
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id= HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t HTTP 302
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=bPINqrwcT4SrJWi7sN-aiA&rk=usync-other HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=bPINqrwcT4SrJWi7sN-aiA
Request Chain 376
  • https://token.rubiconproject.com/token?pid=26594 HTTP 302
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L1KQ0QWX-26-D7D2&sigv=1&esig=2~3809cf217766b5f1fab158b7eaa37569d17c31eb
Request Chain 377
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id= HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t HTTP 302
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=kVHNNGQPTey_hyNZH5MkoQ&rk=usync-na HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=kVHNNGQPTey_hyNZH5MkoQ
Request Chain 379
  • https://token.rubiconproject.com/token?pid=25470 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLUTBRV1gtMjYtRDdEMg==
Request Chain 380
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEG93iS7TIacJ3dQ7998l0uU&google_cver=1
Request Chain 384
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=Mjg1NTIzMDA5NjE2ODMyNDM4Mg==&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEOZbWEus1qSphqHPpDd-vOY&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 385
  • https://bh.contextweb.com/bh/rtset?pid=560288&ev=1&rurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D92%26partneruserid%3D%25%25VGUID%25%25&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=obIgMiDSrxAT&ev=1&pid=560288&gdpr_consent=&gdpr=0
Request Chain 387
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=Mjg1NTIzMDA5NjE2ODMyNDM4Mg==&gdpr=0&gdpr_consent=
Request Chain 389
  • https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID HTTP 302
  • https://rtb.gumgum.com/usersync?b=apn&i=8615746979499682240
Request Chain 390
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_8ff9a716-3723-4370-a7dc-735986c075cb&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=61911d27-645c-4628-a192-91958e64f135 HTTP 302
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=61911d27-645c-4628-a192-91958e64f135 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=a9c2a05d-cd6a-466d-8fe6-3078b59f77fc&ssp=gumgum2&expires=30&user_group=5&bsw_param=61911d27-645c-4628-a192-91958e64f135 HTTP 302
  • https://rtb.gumgum.com/usersync?b=bsw&i=61911d27-645c-4628-a192-91958e64f135
Request Chain 391
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D HTTP 302
  • https://rtb.gumgum.com/usersync?b=obn&i=ENC%28A5B42hCKl2lsEYFHLaxhvsUxT0q_Gnf3fCiaEbiwGCQ6O4KKp5cQGbjxHHKtNphE%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26platformUid%3D%7Bplatform_uid%7D%26obuid%3DENC%28A5B42hCKl2lsEYFHLaxhvsUxT0q_Gnf3fCiaEbiwGCQ6O4KKp5cQGbjxHHKtNphE%29 HTTP 302
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_8ff9a716-3723-4370-a7dc-735986c075cb&obuid=ENC(A5B42hCKl2lsEYFHLaxhvsUxT0q_Gnf3fCiaEbiwGCQ6O4KKp5cQGbjxHHKtNphE) HTTP 302
  • https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51 HTTP 302
  • https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&redirect=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Drise%26uid%3D%5BpartnerId%5D%26obUid%3DA5B42hCKl2lsEYFHLaxhvsUxT0q_Gnf3fCiaEbiwGCQ6O4KKp5cQGbjxHHKtNphE%26gdpr%3D%24GDPR_APPLIES%26gdpr_consent%3D%24CONSNT_STRING
Request Chain 392
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
  • https://rtb.gumgum.com/usersync?b=opx&i=e8f46ef1-f059-4689-948b-ded9ed26d6ee
Request Chain 393
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=sta&i=0-45af342e-9fe6-49dd-6feb-3c8fcb722e07$ip$185.213.155.169
Request Chain 394
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=oth&i=y-f0n8YzxE2pcvcZZLwVON3HyD64S.HODYWH5o~A
Request Chain 395
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dvnt%26i%3D HTTP 302
  • https://rtb.gumgum.com/usersync?b=vnt&i=49647300-b417-11ec-aad8-9f94043e2d80
Request Chain 398
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=e_8ff9a716-3723-4370-a7dc-735986c075cb&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://stags.bluekai.com/site/23178?id=Jv2xJehK4WL00F5G5QTI&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2STWGJ4EUZLIJM2FOTBQGBDDKRZVKFKESJTVONPXA4TJOZQWG6J5GEWS2LI&gdpr=0&us_privacy=1--- HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2STWGJ4EUZLIJM2FOTBQGBDDKRZVKFKESJTVONPXA4TJOZQWG6J5GEWS2LI HTTP 302
  • https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=Jv2xJehK4WL00F5G5QTI&us_privacy=1---
Request Chain 399
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://usersync.gumgum.com/usersync?b=idi&i=d8cdf6db-a4ab-4ccf-b7a5-19b64a63bbf6
Request Chain 400
  • https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.1rx.io/usersync2/floor6?zcc=1&cb=1649077265298 HTTP 302
  • https://rtb.gumgum.com/usersync?b=rhy&i=OPTOUT
Request Chain 401
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25 HTTP 302
  • https://rtb.gumgum.com/usersync?b=pln&i=2IKe9qZajXLw&ev=1&pid=558355
Request Chain 409
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&dcc=t
Request Chain 411
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YkrsEIZYLJzLV1osrv.wvQAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEI8m9HK0cgvzxifD2svdZpw&google_cver=1&gdpr=1&google_hm=2
Request Chain 414
  • https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_&gdpr=1 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=FuM1Z2B31NBmkn5&gdpr=1
Request Chain 415
  • https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID&gdpr=1 HTTP 302
  • https://um.simpli.fi/no_match_opted_out
Request Chain 416
  • https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1 HTTP 302
  • https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1&prevuid=&knw=0 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
Request Chain 419
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d HTTP 302
  • https://rtb.gumgum.com/usersync?b=mmh&i=398a624a-ec0e-4b01-a32f-29671dd4853d&gdpr=0&gdpr_consent=
Request Chain 420
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=atm&i=YkrsDAAAAJKdVwQA&gdpr=0&gdpr_consent=
Request Chain 423
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/usersync?b=ttd&i=ba772fae-fb7e-433d-b9e8-18ab9acb3f0c&t=1651669264
Request Chain 424
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=gumgum
Request Chain 425
  • https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID&gdpr=0&gdpr_consent= HTTP 302
  • https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24EMXUID HTTP 302
  • https://cs.emxdgt.com/umcheck?apnxid=8615746979499682240&redirect=https://usersync.gumgum.com/usersync?b=emx&i=$EMXUID HTTP 302
  • https://usersync.gumgum.com/usersync?b=emx&uid=8615746979499682240brt21431649077264722786f1
Request Chain 426
  • https://tg.socdm.com/aux/idsync?proto=gumgum HTTP 302
  • https://rtb.gumgum.com/usersync?b=sus&i=YkrsEcCo5ugAAO1d15kAAAAA
Request Chain 427
  • https://creativecdn.com/cm-notify?pi=gumgum HTTP 302
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1 HTTP 302
  • https://rtb.gumgum.com/usersync?b=rth&i=aRT0vZg4C1cQyGAlw60s&pi=gumgum&tc=1
Request Chain 431
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEC_KcHrgv3gVHkzW3Wqm35Q&google_cver=1&google_push=AYg5qPJAO3jX-4xeMtOnWTJGygTLHQiAcJ146rgFNr1xUz2BJWASixZG0cyyCWWexWmjhjTHHyMJsNNvIdgDVKBFqJoZG5n5-Euj HTTP 302
  • https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPJAO3jX-4xeMtOnWTJGygTLHQiAcJ146rgFNr1xUz2BJWASixZG0cyyCWWexWmjhjTHHyMJsNNvIdgDVKBFqJoZG5n5-Euj&google_hm=lbGvMEqid3PYBj1vA7ajxw
Request Chain 433
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEEc3pbR1J8s_asvE6ltdfsg&google_cver=1&google_push=AYg5qPKE8k0jGq8B-xJJIC4Lfn09QteX_BXro8-zfovSXnFabS_iv1dhZHz0TPUnxOsaHXjggB13rOeID7iK-UYYz8cAhrnomtv1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=fBxLFmr7TM6HbB7dWPRe9Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKE8k0jGq8B-xJJIC4Lfn09QteX_BXro8-zfovSXnFabS_iv1dhZHz0TPUnxOsaHXjggB13rOeID7iK-UYYz8cAhrnomtv1
Request Chain 434
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKZdeoA-Qo7ycYgD9dfW-WQ&google_cver=1&google_push=AYg5qPKlKho_YAsoVqQtFnbLTZEQCuq3WdDMwFGqmcsMdOvKN0y58e7Kd7fVi2f3C85BXctHslmGf1KwOk7tOqoeBLts5dvuTqag HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLUTBRV1gtMjYtRDdEMg==&google_push=AYg5qPKlKho_YAsoVqQtFnbLTZEQCuq3WdDMwFGqmcsMdOvKN0y58e7Kd7fVi2f3C85BXctHslmGf1KwOk7tOqoeBLts5dvuTqag
Request Chain 435
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at
Request Chain 438
  • https://a.tribalfusion.com/i.match?p=b6&u=CAESEE3mM9EIVCs6NZXDC280Uf0&google_cver=1&google_push=AYg5qPJt6-2ryRUQ0B4ZKSNnigLYZMJD7IW5ZNf1gYH-TQgb_GxZFgltuHXJMFDPY7Wk1P8eDU6ZyanJLyxwScIujbeukUBi0mF6&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPJt6-2ryRUQ0B4ZKSNnigLYZMJD7IW5ZNf1gYH-TQgb_GxZFgltuHXJMFDPY7Wk1P8eDU6ZyanJLyxwScIujbeukUBi0mF6%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEE3mM9EIVCs6NZXDC280Uf0&google_cver=1&google_push=AYg5qPJt6-2ryRUQ0B4ZKSNnigLYZMJD7IW5ZNf1gYH-TQgb_GxZFgltuHXJMFDPY7Wk1P8eDU6ZyanJLyxwScIujbeukUBi0mF6&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPJt6-2ryRUQ0B4ZKSNnigLYZMJD7IW5ZNf1gYH-TQgb_GxZFgltuHXJMFDPY7Wk1P8eDU6ZyanJLyxwScIujbeukUBi0mF6%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Request Chain 440
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng
Request Chain 441
  • https://match.360yield.com/match/ebda?google_gid=CAESEL46OezEDJUMdEAamrM5Aro&google_cver=1&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V
Request Chain 479
  • https://www.telefonica-partner.de/tpv.php?t=117679V1226132702M&subid=oneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_asuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://www.lead-alliance.net/tpv.php?t=117679V1226132702M&subid=oneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_asuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022040415010566683329143X117679V1226132702MSoneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_asuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022040415010566683329143X117679V1226132702MSoneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_asuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
Request Chain 485
  • https://www.awin1.com/cshow.php?s=2243164&v=9162&q=346070&r=414235&pv=1&pref3=oneidVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQoneid__asuidipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_asuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0 HTTP 302
  • https://a1.awin1.com/onepixel.gif

511 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/ 		98 KB
27 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1fd859612ea46aa57354d7b20da20979c096d2467b6a3ca9a2ba17e431023e9c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Connection
close
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Mon, 04 Apr 2022 13:00:53 GMT
Link
<https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/wp-json/wp/v2/posts/179142>; rel="alternate"; type="application/json" <https://threatpost.com/?p=179142>; rel=shortlink
Server
nginx
Strict-Transport-Security
max-age=31536000; includeSubDomains
Transfer-Encoding
chunked
X-Content-Type-Options
nosniff
X-Debug-Auth
off
X-Frame-Options
SAMEORIGIN
X-Request-Host
threatpost.com
X-XSS-Protection
1; mode=block
x-cache-hit
HIT
museosans-900italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-900italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
8edaef698e025c37ba9e8d632a895d7252c62251df3f095d5cff17b6f3304854

Request headers

Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:00:53 GMT
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
"624ab72d-3ca8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
15528
museosans-900-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-900-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4823c011e4b4cb4b7f35ced3ab09d57215ee243676d9bfcc24d10ec77d3db398

Request headers

Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:00:53 GMT
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
"624ab72d-5124"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20772
museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:00:53 GMT
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
"624ab72d-3dcc"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
15820
museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:00:53 GMT
Last-Modified
Mon, 04 Apr 2022 09:15:26 GMT
Server
nginx
ETag
"624ab72e-51a4"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20900
museosans-500italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
17aee1fe3d7d16e647b97f568230c2ff36c1855ce35ce930c26aec5d2c58eaf4

Request headers

Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:00:53 GMT
Last-Modified
Mon, 04 Apr 2022 09:15:28 GMT
Server
nginx
ETag
"624ab730-5c74"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
23668
museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:00:53 GMT
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
"624ab72d-5194"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20884
museosans-300italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189

Request headers

Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:00:54 GMT
Last-Modified
Mon, 04 Apr 2022 09:15:26 GMT
Server
nginx
ETag
"624ab72e-5bac"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
23468
museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:00:54 GMT
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
"624ab72d-51b8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20920
museosans-100italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100italic-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
038fc4d49a9191d416d49841f371b6e0b06bb40f719124099d40fe8f393b9e2c

Request headers

Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:00:54 GMT
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
"624ab72d-5b34"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
23348
museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:00:54 GMT
Last-Modified
Mon, 04 Apr 2022 09:15:28 GMT
Server
nginx
ETag
"624ab730-50c8"
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
20680
op.js
tagan.adlightning.com/math-aids-threatpost/ 		44 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4d94a0f51bade076fa154e469f12563fcee377fd94d79ca6d080d231e0e8b1d1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-amz-version-id
HkG2Wiu3pjH4_E8Lal0CHGT1z3YrEXeV
content-encoding
gzip
etag
"c4d48c8dc1b5ae975f43aaa90c2be257"
age
460
x-cache
Hit from cloudfront
content-length
18353
x-amz-meta-git_commit
7b120a5
last-modified
Sat, 02 Apr 2022 00:32:20 GMT
server
AmazonS3
date
Mon, 04 Apr 2022 13:00:55 GMT
content-type
application/javascript
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=3600
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
x-amz-cf-id
olDNHr_tzvuBkYc4f-8UAxLpoveqPcTFTPTtZrGzmXPWsV69V7fBkQ==
gpt.js
www.googletagservices.com/tag/js/ 		83 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
abfb1f15c2cb3df79d00d5c685c6840b8f5c91ecebb41650eacb4611aeff6071
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28206
x-xss-protection
0
server
sffe
etag
"1177 / 678 of 1000 / last-modified: 1649070350"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Mon, 04 Apr 2022 13:00:55 GMT
ros-layout.js
qd.admetricspro.com/js/threatpost/ 		26 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:456d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2a647d79b31b4b19f30c795aac862bcf5b424731c732e239775127b8ac4aae0a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:53 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 09 Mar 2022 04:05:55 GMT
server
cloudflare
etag
W/"67e2-5d9c136d2119a-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4fJGAycTubnVPmk6LgM92tceI6wQN%2Bf3unV%2FKJV0rVJqPGhQiDp6kbt6q%2FYAnJHf38KH882z%2FaXVXpep1DDLPe6mgh3KFw4Elc6bZccykrNlhjBOmZYd2ozP4FJMRnkKEJVp%2BJkgZULwmmZKgEJLVuAo"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6f6a3ac3fd449a05-FRA
expires
Mon, 04 Apr 2022 13:09:07 GMT
cmp.js
qd.admetricspro.com/js/threatpost/ 		310 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:456d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
519815bc4a3dd9a571cb56f57c7c6abfbda2b4e2de8c4b884a7535a1705438f2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Tue, 01 Jun 2021 14:47:10 GMT
server
cloudflare
etag
W/"4d957-5c3b56abf6028-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yfdXQD2XekkvEr9UnzbIoYpvrn0xqyKSX5Edwwl6Gm8qPmVn0QN5s1CBDx%2FtpRe%2BCcf%2FlJckdRBaVJn4G44qsCyvjksfWjL%2FA03YaTh0jwkqx3zPPCUNJFzlcEULv%2FZs9jMSsB5QuD043tHzLr4aNulH"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6f6a3acb4a859a05-FRA
expires
Mon, 04 Apr 2022 13:08:13 GMT
uspcmp.js
qd.admetricspro.com/js/threatpost/ 		148 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/uspcmp.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:456d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Sat, 08 Aug 2020 22:40:07 GMT
server
cloudflare
etag
W/"24e50-5ac65673cef1c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v3fMiasnA7OzpIkOvxdPRHdav2NFuX44JC0dvppDFO0O2PDJbRY%2Bt9SYq555jgrWn%2BjnoYoNq2TfY6R7YgRCfxzethnMYX7zttSrX93nqOXgtm3G3lwju%2FGgzcxjruSvhTMemMLZvUswptkuf8yHGwgN"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6f6a3acb4a879a05-FRA
expires
Mon, 04 Apr 2022 13:08:18 GMT
targeting.js
qd.admetricspro.com/js/threatpost/ 		393 B
550 B 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:456d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03cc687f0c8a2d1694e509b91fcd6c62c0fbdbdbdb850b8007b8052f649c7f77

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 04 Aug 2021 21:50:12 GMT
server
cloudflare
etag
W/"189-5c8c2c96f96c7-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hXEGOaxvQrE%2BsaU7utgnT%2FJMLuFKakuoSENjWUJk5xXivuT9vHBtSTESa4BoiIOzauitbvpJZu1%2BuG48hMFOX8y6TFaX9ZbhT2pVgxGxBGoBVrODpfzWmMFEN8e6pkyIEZSMsDyiUDQkPhyH4QqP9XKL"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6f6a3acb4a899a05-FRA
expires
Mon, 04 Apr 2022 13:08:18 GMT
prebid.js
qd.admetricspro.com/js/threatpost/ 		430 KB
124 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:456d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8c03fd4dea0f2c83fa05b10dfd913bfcff51d05e0c6e84b7f340b857fdda517

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 14 Oct 2021 15:35:01 GMT
server
cloudflare
etag
W/"6b738-5ce51d26ef74c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A4UpRL%2FGwqY7ZKSv1yZl3Wy5kuWOXfknULwRWH3yC17c%2B5nVrcFnZsZUXqyUOC5h09neFPl6CGVLXjbeLcCqrIOgjyrfXXI75SANY7ufycsymYITLlSxbzJ6SV1duTZWKWJSt1DRC5unnYPQBp0ZPQBk"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6f6a3acb4a8c9a05-FRA
expires
Mon, 04 Apr 2022 13:08:51 GMT
engine.js
qd.admetricspro.com/js/threatpost/ 		35 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/threatpost/engine.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:456d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e6377776a1104aed9b11142115b22dcaad3cf78ae76d255e454b04b7189af32

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:53 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Mon, 24 Jan 2022 02:31:38 GMT
server
cloudflare
etag
W/"8cae-5d64ac49b9c1c-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U0%2F5ooR%2FIHl4%2F%2BcDBBuwc6VbMCwEheKPCLc7bzzwpuTh4DqzWqwEA66UgDiK4aOEECoHbbcSDA1dRTJbb83UNTLPedTv91fYk%2B%2FH38j4%2FWnP3RMgRGC1QjoLgNeUnY9cxmNfHyEFZOzc9eoe1pWmcHoZ"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
cf-ray
6f6a3ac3fd479a05-FRA
expires
Mon, 04 Apr 2022 13:09:14 GMT
/
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 		294 KB
42 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
62cbf085d014439b719c84c3d2f3222fde66e299c2da1b41dfc4dbb315db0456
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:54 GMT
content-encoding
gzip
x-amz-cf-pop
FRA6-C1
x-cache
Miss from cloudfront
content-length
42696
x-cache-hit
HIT
last-modified
Mon, 04 Apr 2022 09:15:28 GMT
server
nginx
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css; charset=utf-8
via
1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-debug-auth
off
x-request-host
assets.threatpost.com
x-amz-cf-id
XiYe2D6usP9mpmKczB4B2QVec8YfwhQjYcTSVzB8K6VmvFwhNd46Rg==
expires
Tue, 05 Apr 2022 09:17:58 GMT
jquery-1.12.4-wp.js
threatpost.com/wp-content/plugins/kaspersky-enable-jquery-migrate-helper/js/jquery/ 		95 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/kaspersky-enable-jquery-migrate-helper/js/jquery/jquery-1.12.4-wp.js?ver=1.12.4-wp
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:54 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
W/"624ab72d-17a56"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:54 GMT
alert_text.js
threatpost.com/wp-content/plugins/kaspersky-cookies-notification/scripts/ 		107 B
461 B 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js?ver=1649063725
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
68cdaaeccd079ab33df06d3e5fb47594a4458a6491d48a8ae2f394defb419eb5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:54 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Apr 2022 09:15:27 GMT
Server
nginx
ETag
W/"624ab72f-6b"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:54 GMT
alert.js
threatpost.com/wp-content/plugins/kaspersky-cookies-notification/scripts/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js?ver=1649063725
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
500288356853c7199a27a6a2cdcd14b217d18dd9c8103272d8e6def6acbe2580

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:54 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
W/"624ab72d-104a"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:54 GMT
public.js
threatpost.com/wp-content/plugins/honeypot-comments/public/assets/js/ 		116 B
495 B 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/honeypot-comments/public/assets/js/public.js?ver=1.0.0
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
931dc539e87db7f509be9c77dfcc9b2baee0b91e5236aa04580ab14ed81e2cc0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:54 GMT
Content-Encoding
gzip
Last-Modified
Wed, 11 Jun 2014 19:20:42 GMT
Server
nginx
ETag
W/"5398ac0a-74"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:54 GMT
kaspersky-twitter-pullquote.js
threatpost.com/wp-content/plugins/kspr_twitter_pullquote/js/ 		599 B
713 B 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js?ver=1.0
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1791bf831c158912a11ca40bcf5f3573fc54ec8f8343c37780dab679c0203d63

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:54 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
W/"624ab72d-257"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:54 GMT
loadmore.js
threatpost.com/wp-content/themes/threatpost-2018/assets/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/js/loadmore.js?ver=5.9.2
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e0f1df7af81fd8eb920863093c426fdafd241b8d9aeb6126fb2fd24f36c061b3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:54 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Apr 2022 09:15:28 GMT
Server
nginx
ETag
W/"624ab730-11e7"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:54 GMT
social-share.js
threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/js/ 		18 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js?ver=1.0.0
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
546be401414bcb20cdea07cdbcd806409b9629e4895737e214401948c40409f3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:54 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
W/"624ab72d-484d"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:54 GMT
mosquito-scaled-e1648585357672.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2022/03/29162217/ 		43 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/29162217/mosquito-scaled-e1648585357672.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:e600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
53f6440548312e912300ca5fafa1cba39283dca8ba7c84e4a6a8ace656b95adb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 20:33:16 GMT
via
1.1 6ea9fcffa719a56ee2be748a73d37974.cloudfront.net (CloudFront), 1.1 7549433a09d06354ea864d169b689e50.cloudfront.net (CloudFront)
last-modified
Tue, 29 Mar 2022 20:22:38 GMT
server
AmazonS3
age
491260
etag
"d988a13058f3c755c254a7e440a97ce0"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA53-C1
accept-ranges
bytes
content-length
43776
x-amz-cf-id
HbfOuMeVcHlzbRLtv4ukLBcDBfgcX3XgKNfhfbnH2v2kjbb8Y2TS7g==
expires
Wed, 29 Mar 2023 20:22:37 GMT
infosec_insiders_in_article_promo.png
media.threatpost.com/wp-content/uploads/sites/103/2021/07/10165815/ 		20 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/07/10165815/infosec_insiders_in_article_promo.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:e600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bbe4e4e4e847a32bd717d963f0ac04b619a7a9cdd631a7454d9dfec16fbae73f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Tue, 04 Jan 2022 23:44:31 GMT
via
1.1 985c0b2ec44bdebc7f24f26d1e427d31.cloudfront.net (CloudFront), 1.1 7549433a09d06354ea864d169b689e50.cloudfront.net (CloudFront)
last-modified
Tue, 10 Aug 2021 20:58:17 GMT
server
AmazonS3
age
7737385
etag
"101ba02c43488b8b07cf42f9aa850f6a"
x-cache
Hit from cloudfront
content-type
image/png
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-P2, FRA53-C1
accept-ranges
bytes
content-length
20484
x-amz-cf-id
qTvC4j3P44S00GM0hktwHEFBohQgVBth3VbGt494htVjt5XFp8Cv2w==
expires
Wed, 10 Aug 2022 20:58:15 GMT
api.js
www.google.com/recaptcha/ 		852 B
623 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?hl=en&render=explicit
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
8fb4a4f4521a94032afdb851a8612f898a1e8a40705d06df03ddfa932d3ca274
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
554
x-xss-protection
1; mode=block
expires
Mon, 04 Apr 2022 13:00:55 GMT
scripts.js
kasperskycontenthub.com/threatpost-global/wp-content/plugins/kaspersky-embeds/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kasperskycontenthub.com/threatpost-global/wp-content/plugins/kaspersky-embeds/js/scripts.js?ver=1.0
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b1f863d13dbad7d5240f577a73b47b06227d218909259042da95301e2eb8be55

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:55 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
W/"624ab72d-828"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:55 GMT
api.js
www.google.com/recaptcha/ 		852 B
970 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?render=explicit&ver=202124050927
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
68cc26362c0cc4baa161311ed8f92a440624b120f844cecef402a4c7f94bf39d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
557
x-xss-protection
1; mode=block
expires
Mon, 04 Apr 2022 13:00:55 GMT
main.js
threatpost.com/wp-content/plugins/kaspersky-gravity-forms-dynamic-recaptcha/assets/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/kaspersky-gravity-forms-dynamic-recaptcha/assets/js/main.js?ver=202124050927
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4d52f37b83f70c5035632548c652508d793eec55e17f2ac19552f4fa19d323be

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:58 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
W/"624ab72d-ab4"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:58 GMT
s_code_single_suite.js
media.kaspersky.com/tracking/omniture/ 		172 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js?ver=5.9.2
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
185.85.15.23 , Germany, ASN200107 (KL-EXT, CH),
Reverse DNS
Software
/ Kaspersky Labs, Kaspersky Labs
Resource Hash
9e89048f0456e3b02cedb7cf76410b3576a32bad0f1cc024640f01e1339b3a71
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
etag
"8044e984f147d81:0"
x-powered-by
Kaspersky Labs, Kaspersky Labs
alt-svc
h3=":443"; ma=86400
content-length
49271
x-xss-protection
1; mode=block
last-modified
Mon, 04 Apr 2022 06:59:25 GMT
server
x-frame-options
SAMEORIGIN
date
Mon, 04 Apr 2022 13:00:54 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=3600
x-server
fr1/FRA3
accept-ranges
bytes
x-content-type-options
nosniff
main.js
threatpost.com/wp-content/themes/threatpost-2018/assets/js/ 		114 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/js/main.js?ver=202107061113
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4e0b5563ff1fc5175d65e11e1546bee1945486d65d76c9248bdd77487532dadf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:58 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Apr 2022 09:15:28 GMT
Server
nginx
ETag
W/"624ab730-1c643"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:58 GMT
regenerator-runtime.min.js
threatpost.com/wp-includes/js/dist/vendor/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a3e64300797e8078baa41dbc49e2affc1d2bedd04a470f0c929ed7fac698fbcd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:58 GMT
Content-Encoding
gzip
Last-Modified
Fri, 11 Mar 2022 00:51:39 GMT
Server
nginx
ETag
W/"622a9d1b-195e"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:58 GMT
wp-polyfill.min.js
threatpost.com/wp-includes/js/dist/vendor/ 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e20ddb9ed1fa044cb624f0253bb06b13c92ed9915063bd63a5806440c6b1ce7c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:58 GMT
Content-Encoding
gzip
Last-Modified
Fri, 11 Mar 2022 00:51:39 GMT
Server
nginx
ETag
W/"622a9d1b-4b3d"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:58 GMT
dom-ready.min.js
threatpost.com/wp-includes/js/dist/ 		1 KB
989 B 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-includes/js/dist/dom-ready.min.js?ver=ecda74de0221e1c2ce5c57cbb5af09d5
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e127aead57cd6625f795f8c41d8b7c463c2c50158e3a3dc398424db2b16bd5db

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:58 GMT
Content-Encoding
gzip
Last-Modified
Fri, 11 Mar 2022 00:51:39 GMT
Server
nginx
ETag
W/"622a9d1b-4e9"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:58 GMT
hooks.min.js
threatpost.com/wp-includes/js/dist/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e5935466216a250bb06338805b32ffb19eeda9042ead790ebc6e5dda27820adb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:58 GMT
Content-Encoding
gzip
Last-Modified
Fri, 11 Mar 2022 00:51:39 GMT
Server
nginx
ETag
W/"622a9d1b-163a"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:58 GMT
i18n.min.js
threatpost.com/wp-includes/js/dist/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-includes/js/dist/i18n.min.js?ver=30fcecb428a0e8383d3776bcdd3a7834
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
22c90613db09ef65c964b143e6adbe584b42eae85c9b7a75fa27c22b25cccb90

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:58 GMT
Content-Encoding
gzip
Last-Modified
Fri, 11 Mar 2022 00:51:39 GMT
Server
nginx
ETag
W/"622a9d1b-28a7"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:58 GMT
a11y.min.js
threatpost.com/wp-includes/js/dist/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-includes/js/dist/a11y.min.js?ver=68e470cf840f69530e9db3be229ad4b6
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
927e16d837ac9f46ddb4a64c8fea1cbe39343902c91b14e11b484e9b01f98cdd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:58 GMT
Content-Encoding
gzip
Last-Modified
Fri, 11 Mar 2022 00:51:39 GMT
Server
nginx
ETag
W/"622a9d1b-bfd"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:58 GMT
jquery.json.min.js
threatpost.com/wp-content/plugins/gravityforms/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/gravityforms/js/jquery.json.min.js?ver=2.5.16.3
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
693c8b61667ac94847264924178702a190c5113b41b82085dad0641f89e3f864

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:58 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
W/"624ab72d-730"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:58 GMT
gravityforms.min.js
threatpost.com/wp-content/plugins/gravityforms/js/ 		43 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.5.16.3
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
69f0ade8cca67112ef495f707fb73c68fd5099a6cd9c51d9ba9ceda8dcca16f7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:58 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
W/"624ab72d-abe0"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:58 GMT
conditional_logic.min.js
threatpost.com/wp-content/plugins/gravityforms/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/gravityforms/js/conditional_logic.min.js?ver=2.5.16.3
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
7104f88840a420f1702717d900db98910deb6141ad639bb7338b88993e989c72

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:58 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
W/"624ab72d-213f"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:58 GMT
placeholders.jquery.min.js
threatpost.com/wp-content/plugins/gravityforms/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/plugins/gravityforms/js/placeholders.jquery.min.js?ver=2.5.16.3
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
public
Date
Mon, 04 Apr 2022 13:00:58 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
W/"624ab72d-121f"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Cache-Control
max-age=604800, public
Connection
close
Expires
Mon, 11 Apr 2022 13:00:58 GMT
apstag.js
c.amazon-adsystem.com/aax2/ 		134 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/engine.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.62.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-62-173.fra56.r.cloudfront.net
Software
Server /
Resource Hash
3ef5bfd224e0baa902eb88c94979cfaeccf2169a996c601fa3de4c3f3b33da01

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-amz-version-id
.7apL996dsR_ZFPBtTTtY5SRaPfBf8DJ
content-encoding
gzip
etag
4e3fad24a118a07cea7ce88b2721a583
age
176
x-cache
Hit from cloudfront
server
Server
x-amz-rid
0Z0B5DW9HG5598DNBRD5
date
Mon, 04 Apr 2022 12:58:12 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 cae542650fb32c773cc494fc6e7e71e6.cloudfront.net (CloudFront)
cache-control
public, max-age=900
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
timing-allow-origin
*
x-amz-cf-id
dVLgwaGI20Rc68FWQhW8e2vZlSPhjnajYhwGlr0qxJJrvNljlws7TQ==
connatix.player.dc.js
cds.connatix.com/p/157363/ Frame 89D9
Redirect Chain
  • https://cd.connatix.com/connatix.player.js
  • https://cds.connatix.com/p/157363/connatix.player.dc.js
858 KB
200 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/157363/connatix.player.dc.js
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0ac2e8b703898e10c303ba046d2ab970637e88801cbc4cdda6585e61b6f9b01b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:54 GMT
content-encoding
br
last-modified
Mon, 04 Apr 2022 11:50:13 GMT
age
3828
etag
"e2a47e99d492d2432a43ae24aeccf37d"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
204758

Redirect headers

location
https://cds.connatix.com/p/157363/connatix.player.dc.js
date
Mon, 04 Apr 2022 13:00:54 GMT
cache-control
no-cache, no-store, must-revalidate, max-age=0
accept-ranges
bytes
content-length
0
access-control-max-age
86400
hls.5b3b785f487abbe00eee.js
cds.connatix.com/p/157363/ Frame 89D9 		0
47 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/157363/hls.5b3b785f487abbe00eee.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:54 GMT
content-encoding
br
last-modified
Mon, 04 Apr 2022 11:50:13 GMT
age
4021
etag
"182f65d040bfb9544bd8f71472475672"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
48258
/
kasperskycontenthub.com/ 		0
399 B 		Script
General
Check archive.org
Download Go to
Full URL
https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=673462241&back=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:00:55 GMT
X-Content-Type-Options
nosniff
Server
nginx
X-Frame-Options
SAMEORIGIN
Connection
close
Content-Type
application/javascript
x-cache-hit
MISS
Transfer-Encoding
chunked
X-Debug-Auth
off
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Request-Host
kasperskycontenthub.com
X-XSS-Protection
1; mode=block
gtm.js
www.googletagmanager.com/ 		182 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
14f7418616b029172fe23347ff6c4003fd133e0013fb529cbf08ca2551cf4f08
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
61829
x-xss-protection
0
last-modified
Mon, 04 Apr 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 04 Apr 2022 13:00:55 GMT
gtm.js
www.googletagmanager.com/ 		503 KB
117 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
64a070c03bfaed7c72d80f87044e30f0f8add5f9412bc8641d72a5cb969aa97e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
119632
x-xss-protection
0
last-modified
Mon, 04 Apr 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 04 Apr 2022 13:00:55 GMT
icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 		13 KB
13 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
97f5070aadd9475bb56a49a7bc1114e9fe1b992b55f2b227502f35f8bba71d74

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:00:58 GMT
Last-Modified
Mon, 04 Apr 2022 09:15:25 GMT
Server
nginx
ETag
"624ab72d-328e"
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
12942
icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 		13 KB
13 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-160-135.compute-1.amazonaws.com
Software
nginx /
Resource Hash
97f5070aadd9475bb56a49a7bc1114e9fe1b992b55f2b227502f35f8bba71d74

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:00:58 GMT
Last-Modified
Mon, 04 Apr 2022 09:15:26 GMT
Server
nginx
ETag
"624ab72e-328e"
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Connection
close
Accept-Ranges
bytes
Content-Length
12942
logo.png
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
public
date
Mon, 04 Apr 2022 13:00:55 GMT
via
1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront)
last-modified
Mon, 04 Apr 2022 09:15:28 GMT
server
nginx
x-amz-cf-pop
FRA6-C1
etag
"624ab730-4a32"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
max-age=604800, public
accept-ranges
bytes
content-length
18994
x-amz-cf-id
HnyzHcABQ6w1Xe4bSZwp99pmsk1ygedOMbDiwh9eLLjq98fK2IkSRA==
expires
Mon, 11 Apr 2022 13:00:55 GMT
museosans-700-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
via
1.1 8e04f5d6c745b231c10fce7c2aa9c70e.cloudfront.net (CloudFront)
last-modified
Mon, 04 Apr 2022 09:15:28 GMT
server
nginx
x-amz-cf-pop
FRA6-C1
etag
"624ab730-51a4"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
20900
x-amz-cf-id
MouDXrvZrIVgc0KpcnWgbS60tBhM7nhMdeOWl-n83TRpLIAZi5LDCA==
museosans-100-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
via
1.1 8e04f5d6c745b231c10fce7c2aa9c70e.cloudfront.net (CloudFront)
last-modified
Mon, 04 Apr 2022 09:15:28 GMT
server
nginx
x-amz-cf-pop
FRA6-C1
etag
"624ab730-50c8"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
20680
x-amz-cf-id
oNPU_Hy-XCnMVpg_RRlMtte4u53vYbTfMlBew3nhdHqQOvBmYVfADA==
museosans-300-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
via
1.1 8e04f5d6c745b231c10fce7c2aa9c70e.cloudfront.net (CloudFront)
last-modified
Mon, 04 Apr 2022 09:15:25 GMT
server
nginx
x-amz-cf-pop
FRA6-C1
etag
"624ab72d-51b8"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
20920
x-amz-cf-id
LmS10ITMps7gD4gQ44haoAOoIlRs7xrj5ILfTtekiYEERQ4fclVDRg==
museosans-500-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		20 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
via
1.1 8e04f5d6c745b231c10fce7c2aa9c70e.cloudfront.net (CloudFront)
last-modified
Mon, 04 Apr 2022 09:15:28 GMT
server
nginx
x-amz-cf-pop
FRA6-C1
etag
"624ab730-5194"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
20884
x-amz-cf-id
BJOz3gyiNf_BFKAuz5m4MO8GQi4fQq3f1C1MVeRvtj0323_WuUJ-qw==
Lisa-Vaas-Headshot.jpg
media.threatpost.com/wp-content/uploads/sites/103/2021/05/05095532/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/05/05095532/Lisa-Vaas-Headshot.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:e600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d5a65e5129df0b4c89e73f205c6cb89cba0cd1d8e21a1512ca76b769634052d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Sun, 26 Sep 2021 09:50:16 GMT
via
1.1 018ffb575888f1c9ec960e3e977c042f.cloudfront.net (CloudFront), 1.1 7549433a09d06354ea864d169b689e50.cloudfront.net (CloudFront)
last-modified
Tue, 25 May 2021 13:37:34 GMT
server
AmazonS3
age
16427440
etag
"78f8fd88850c65941db84cb8bf0d741d"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-P2, FRA53-C1
accept-ranges
bytes
content-length
18649
x-amz-cf-id
mw03kzSNZx5B-v20ZcHA8OLwzflf0e-eZcR-L_y_p_1aYNhWgwmYMg==
expires
Wed, 25 May 2022 13:37:32 GMT
museosans-500italic-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500italic-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
17aee1fe3d7d16e647b97f568230c2ff36c1855ce35ce930c26aec5d2c58eaf4

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
via
1.1 8e04f5d6c745b231c10fce7c2aa9c70e.cloudfront.net (CloudFront)
last-modified
Mon, 04 Apr 2022 09:15:28 GMT
server
nginx
x-amz-cf-pop
FRA6-C1
etag
"624ab730-5c74"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
23668
x-amz-cf-id
du6ZV8w0ufry5-XOMXxjQSFUS3-hgNlWL7GEmqjFBdhsSimd65V47g==
attack-horizon-e1648572335942.jpg
media.threatpost.com/wp-content/uploads/sites/103/2022/03/29124520/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/29124520/attack-horizon-e1648572335942.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:e600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9348552099a43c0139caafab45ef6413d7cefac6722387854ad3f360660fd2af

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 20:33:18 GMT
via
1.1 9015971351bc982a04ee209a022bb1f8.cloudfront.net (CloudFront), 1.1 7549433a09d06354ea864d169b689e50.cloudfront.net (CloudFront)
last-modified
Tue, 29 Mar 2022 16:45:36 GMT
server
AmazonS3
age
491258
etag
"eca883d1f4516d2ba4f04ea1187fa5ab"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-P2, FRA53-C1
accept-ranges
bytes
content-length
11312
x-amz-cf-id
7PLHkb4ZVf3PcZiVEtaltmHewWRSFyzr8J38Zt6AyVuvPlsgDLTJNg==
expires
Wed, 29 Mar 2023 16:45:35 GMT
Base64_encoded_blob-e1648583546965.jpg
media.threatpost.com/wp-content/uploads/sites/103/2022/03/29155214/ 		94 KB
95 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/29155214/Base64_encoded_blob-e1648583546965.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:e600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6b1bb389b13a881a2cefef04679293b420d442949428cb6fe32a876324fdf5d3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 20:33:18 GMT
via
1.1 3f52d342c56014599dee37446f6c9f2e.cloudfront.net (CloudFront), 1.1 7549433a09d06354ea864d169b689e50.cloudfront.net (CloudFront)
last-modified
Tue, 29 Mar 2022 19:52:27 GMT
server
AmazonS3
age
491258
etag
"616bb59ec067dc03f083d9d03c776231"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-P2, FRA53-C1
accept-ranges
bytes
content-length
96671
x-amz-cf-id
oCShvrSxFJ-KElZ4Hv3thkdT6SgCYNMpPl2Td6ma3ZnSPbN7ThcWXg==
expires
Wed, 29 Mar 2023 19:52:26 GMT
14_kaspersky_secure_futures_magazine_composable_infrastructure-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2022/03/01154703/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2022/03/01154703/14_kaspersky_secure_futures_magazine_composable_infrastructure-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:e600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7e75ade51afcae47ec8dedc46bd50962ebb58b46638a69951f1f494c5052fe14

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Tue, 08 Mar 2022 15:57:05 GMT
via
1.1 57d93b321db68494cc6755a0d3fb29cc.cloudfront.net (CloudFront), 1.1 7549433a09d06354ea864d169b689e50.cloudfront.net (CloudFront)
last-modified
Tue, 01 Mar 2022 20:47:09 GMT
server
AmazonS3
age
2322231
etag
"502f5a6c66ba05c0831f656eb6cc29dd"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA2-C2, FRA53-C1
accept-ranges
bytes
content-length
2476
x-amz-cf-id
2_tGdv0u57OYC-FBixAkxEjwV0nkgevbADRjDZq3lrmhF6atpNHIqg==
expires
Wed, 01 Mar 2023 20:47:08 GMT
checklist2-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2021/10/19100940/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/10/19100940/checklist2-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:e600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7fd9983a3429d6ead1f66bf933770f9b790818b189e39ff0f2a0d3f590bbf67b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Fri, 25 Feb 2022 18:49:28 GMT
via
1.1 fb8c0300277bd0137c1693d3d64ab550.cloudfront.net (CloudFront), 1.1 7549433a09d06354ea864d169b689e50.cloudfront.net (CloudFront)
last-modified
Tue, 19 Oct 2021 14:09:44 GMT
server
AmazonS3
age
3262288
etag
"14bf40c9dffffaec5cd1337f170dac93"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA53-C1
accept-ranges
bytes
content-length
2112
x-amz-cf-id
q3pOWOlR6vQelsqU4js_T_6HBE3eXC0B-gwdiIqLZHtIwzeOocvlXw==
expires
Wed, 19 Oct 2022 14:09:43 GMT
5-Steps-For-Securing-Your-Remote-Work-Space-e1645021300212-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2021/09/09141032/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/09/09141032/5-Steps-For-Securing-Your-Remote-Work-Space-e1645021300212-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:e600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1f3d8b57f69b73694c38ba6bbf8ddc46c8a5e52db401795fa8ab80643e14236d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 21:12:50 GMT
via
1.1 666eddda46892ed48d8d771b6142ac24.cloudfront.net (CloudFront), 1.1 7549433a09d06354ea864d169b689e50.cloudfront.net (CloudFront)
last-modified
Wed, 16 Feb 2022 14:21:42 GMT
server
AmazonS3
age
3340086
etag
"8d2fd78b5abc332b1098cc4de81608b9"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-P2, FRA53-C1
accept-ranges
bytes
content-length
1940
x-amz-cf-id
mCGAjFj0136p87Xay9TuSxTlRsCmMYLERuM-c4RpE4aA-YVKiiFCzw==
expires
Thu, 16 Feb 2023 14:21:40 GMT
nuclear-bomb-explosion-1478796377Hhl-64x64.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2021/09/29112739/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/09/29112739/nuclear-bomb-explosion-1478796377Hhl-64x64.jpeg
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:e600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6c8e343da3b15a6a26e0367b83d1c97813863ea6e6a905bd9e69870bb0a0ebd0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Wed, 09 Feb 2022 21:08:04 GMT
via
1.1 9c7c26f5beeb09381cea450ea3581b36.cloudfront.net (CloudFront), 1.1 7549433a09d06354ea864d169b689e50.cloudfront.net (CloudFront)
last-modified
Wed, 29 Sep 2021 15:27:43 GMT
server
AmazonS3
age
4636372
etag
"6d0d1a22dbbe088376115135bb5be675"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA53-C1
accept-ranges
bytes
content-length
2337
x-amz-cf-id
Ys3USEmIViied0LLfUT0tViU4IfvV90oe4to7-xgGzzsHpVTnLz5SQ==
expires
Thu, 29 Sep 2022 15:27:42 GMT
mail-plane-light.svg
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		828 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
via
1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront)
last-modified
Mon, 04 Apr 2022 09:15:25 GMT
server
nginx
x-amz-cf-pop
FRA6-C1
etag
"624ab72d-33c"
x-cache
Miss from cloudfront
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
content-length
828
x-amz-cf-id
Q17e4xuFd7O2PdT9DxKqnh4MnZhGlGcYOn73TSQIfhsjOHOTpUKPVw==
twitter-blue.svg
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		868 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
via
1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront)
last-modified
Mon, 04 Apr 2022 09:15:26 GMT
server
nginx
x-amz-cf-pop
FRA6-C1
etag
"624ab72e-364"
x-cache
Miss from cloudfront
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
content-length
868
x-amz-cf-id
0O9ULjKBggW9lwGfQfy7QVOb9hbnf2_3q-KvwgsjP49gy1G0Fiq6ug==
museosans-700italic-webfont.woff2
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
via
1.1 8e04f5d6c745b231c10fce7c2aa9c70e.cloudfront.net (CloudFront)
last-modified
Mon, 04 Apr 2022 09:15:26 GMT
server
nginx
x-amz-cf-pop
FRA6-C1
etag
"624ab72e-3dcc"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
15820
x-amz-cf-id
T9Xe6RSAicjsrfETxdbIJc503aVs8lROFmht8jH-7DPxI2HSvRklnA==
player.css
cds.connatix.com/p/157363/ 		56 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/157363/player.css
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
bdfd60b477fc3a53026309cc91965dae061323c4a99562dabdd08831147528b2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
content-encoding
br
last-modified
Mon, 04 Apr 2022 11:50:13 GMT
age
3828
etag
"379e0d01d797a7cf7455b95630ef6907"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
8612
mail-plane-large-dark.svg
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		812 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
via
1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront)
last-modified
Mon, 04 Apr 2022 09:15:25 GMT
server
nginx
x-amz-cf-pop
FRA6-C1
etag
"624ab72d-32c"
x-cache
Miss from cloudfront
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
content-length
812
x-amz-cf-id
qchjxTGgJiP4k-N-A_crrQAPAQKyHcPOSo-aM8PCaKtuQy8Iz_bXPg==
logo-white.png
assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
public
date
Mon, 04 Apr 2022 13:00:55 GMT
via
1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront)
last-modified
Mon, 04 Apr 2022 09:15:25 GMT
server
nginx
x-amz-cf-pop
FRA6-C1
etag
"624ab72d-260a"
x-cache
Miss from cloudfront
content-type
image/png
cache-control
max-age=604800, public
accept-ranges
bytes
content-length
9738
x-amz-cf-id
PXioJ6advD-xmgSRI1L-iHdhTaL1yKbVrpsuO6vbUqY-6rx4T4WMoA==
expires
Mon, 11 Apr 2022 13:00:55 GMT
Log4J_shell_thrpst-e1643986376319-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2021/12/30110920/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://media.threatpost.com/wp-content/uploads/sites/103/2021/12/30110920/Log4J_shell_thrpst-e1643986376319-64x64.jpg
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:e600:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
41f047950d4db7e04d250ebe65613aaaf482546a855d9321d1536ecb8ab6cccf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Fri, 04 Feb 2022 18:59:05 GMT
via
1.1 e38834cd8f7f79ef118dc9bba0861780.cloudfront.net (CloudFront), 1.1 7549433a09d06354ea864d169b689e50.cloudfront.net (CloudFront)
last-modified
Fri, 04 Feb 2022 14:52:59 GMT
server
AmazonS3
age
5076111
etag
"8b8e89e4e306930920312db10e2c0dbf"
x-cache
Hit from cloudfront
content-type
image/jpeg
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1, FRA53-C1
accept-ranges
bytes
content-length
2455
x-amz-cf-id
KrI0oaNU1xSq6daYlT1X11_M8pk9LW1yZUo13qfAFLVR6ibaSmTN6Q==
expires
Sat, 04 Feb 2023 14:52:57 GMT
pls
capi.connatix.com/core/ Frame 89D9 		8 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi.connatix.com/core/pls?v=157363
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
81aad196eb5b0fd18d4ae314e89e260affe5bbe6d6e6b065514e380270b40a7b

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-max-age
86400
access-control-allow-credentials
true
accept-ranges
bytes
content-length
3716
recaptcha__en.js
www.gstatic.com/recaptcha/releases/gZWLhEUEJFxEhoT5hpjn2xHK/ 		359 KB
142 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/gZWLhEUEJFxEhoT5hpjn2xHK/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en&render=explicit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5eea1c9406e22225635f46d7ddde71a450b2337a7cd0b25ff834aef95734258
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 12:16:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2682
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
144576
x-xss-protection
0
last-modified
Mon, 28 Mar 2022 04:22:14 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 04 Apr 2023 12:16:13 GMT
vendor-list.json
qd.admetricspro.com/js/cmp2/ 		256 KB
36 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://qd.admetricspro.com/js/cmp2/vendor-list.json
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:456d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1aeb3ee07f4b462935c5d8047ff038c8e279d75f9be1dcd0b848ba68223a3ee2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Mon, 31 May 2021 16:54:38 GMT
server
cloudflare
etag
W/"3ffae-5c3a314b5dcb2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rNHMFbbvFLcjsOcRkRV1LZZgLM4HWXo%2BPjxjaT09lEl9McKGo0dxaNqey4wlUqeTyKSIaFjnb8FHE0MYrKJasz4%2BGXEOKx5cyD%2BnvfBYM39fBtidixjfrQwzHnTXuiM58nlxM2oxwt8jnTiFDa6v0Jeu"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=600
cf-ray
6f6a3acdcfd89951-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Mon, 04 Apr 2022 13:10:55 GMT
pubads_impl_2022032106.js
securepubads.g.doubleclick.net/gpt/ 		364 KB
124 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022032106.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
sffe /
Resource Hash
8da979458600536726a4bfca5e105c96a405e0740c16e55a7d6cc59108706417
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 12:02:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3504
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
126678
x-xss-protection
0
last-modified
Thu, 24 Mar 2022 20:13:14 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Tue, 04 Apr 2023 12:02:31 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		152 B
743 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=threatpost.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
9c3b4ae64ba79687d183404ed80c00f909330c0e1bd8a260b5886c107a27ffec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:00:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
107
x-xss-protection
0
expires
Mon, 04 Apr 2022 13:00:55 GMT
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 20:58:51 GMT
content-encoding
gzip
age
15955325
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
mTFddHHDmTzxAMWQVlIDqFdn16B06qY26F3KLIIoTSS-vZj08ccw2A==
bl-39123b0-71ac0870.js
tagan.adlightning.com/math-aids-threatpost/ 		46 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-39123b0-71ac0870.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e2835af998d5ef885bfa14a1b1995c7724d5b6a76f545b4a491763bff6f0dac5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Sat, 02 Apr 2022 00:47:40 GMT
content-encoding
gzip
age
216796
x-cache
Hit from cloudfront
content-length
19393
x-amz-meta-git_commit
39123b0
last-modified
Sat, 02 Apr 2022 00:31:19 GMT
server
AmazonS3
etag
"27a611307893faed4f77b20bc9c527af"
x-amz-version-id
ciXDgJvjDfKJZB9C8XzODN3O2B85Zno7
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
5XBSEBAiutm5p4jMtInyYS630R1LyvV-aBABQIUymFW09k9mS1QFfA==
config
c.amazon-adsystem.com/cdn/prod/ 		662 B
1020 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fthreatpost.com&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.62.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-62-173.fra56.r.cloudfront.net
Software
Server /
Resource Hash
6493fe707262fb8d9bc0e4d487e319fc9ebe7de26ebe7e3b4f58a5d17f03a9ea

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 09:05:14 GMT
via
1.1 cae542650fb32c773cc494fc6e7e71e6.cloudfront.net (CloudFront)
server
Server
age
14140
x-cache
Hit from cloudfront
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://threatpost.com
cache-control
max-age=21550, s-maxage=21600
access-control-allow-credentials
true
x-amz-cf-pop
FRA56-C1
content-length
662
x-amz-cf-id
zOAUbpq_3BgeSLTJJpP_XMIBqvWkHXhwrFYWs8wR9tv1xYehKnVK4Q==
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.62.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-62-173.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 02:53:29 GMT
content-encoding
gzip
vary
Accept-Encoding,Origin
age
36447
x-cache
Hit from cloudfront
access-control-allow-origin
*
last-modified
Thu, 17 Mar 2022 02:21:48 GMT
server
AmazonS3
etag
W/"a4d296427fc806b21335359e398c025c"
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-version-id
khsXo6Z3HSo5bHNWbmb1eMp88IHhxPc.
via
1.1 28ccbefb54459137bb0b0d946fd75e48.cloudfront.net (CloudFront)
cache-control
public, max-age=86400
x-amz-cf-pop
FRA56-C1
content-type
application/javascript
x-amz-cf-id
dDQU-y7nwL-trucaRUXjD2FaE31LwUNaChtIp87H8fSg0mjkGzYjng==
recaptcha__de.js
www.gstatic.com/recaptcha/releases/gZWLhEUEJFxEhoT5hpjn2xHK/ 		362 KB
143 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/gZWLhEUEJFxEhoT5hpjn2xHK/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=explicit&ver=202124050927
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dff2681d8f5f16b61b464b599d7c62f61efe496b54a77044145495bc8cad36d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 12:47:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
832
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
146406
x-xss-protection
0
last-modified
Mon, 28 Mar 2022 04:22:14 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 04 Apr 2023 12:47:03 GMT
insights.bin
ins.connatix.com/4eefa1a0fabb9a6e17c3e70f39eb58fe/ Frame 89D9 		324 B
529 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ins.connatix.com/4eefa1a0fabb9a6e17c3e70f39eb58fe/insights.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
69445fd8e1a8e96fc098b81f84d19b23cb88621fbc780e7dc24d0f6b3ae5bd80

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
gzip
last-modified
Fri, 01 Apr 2022 10:22:11 GMT
age
267943
etag
"69cb80b2eb19eb311bb83b48d1c6404e"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
210
pubcid.min.js
secure.cdn.fastclick.net/js/pubcid/latest/ 		53 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.45.103.213 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-45-103-213.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:55 GMT
content-encoding
gzip
last-modified
Tue, 01 Jun 2021 17:06:57 GMT
server
Apache
etag
"d398-5c3b75e9ebb41-gzip"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=900
accept-ranges
bytes
content-length
17087
expires
Mon, 04 Apr 2022 13:15:55 GMT
id5-api.js
cdn.id5-sync.com/api/1.0/ 		40 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.id5-sync.com/api/1.0/id5-api.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
46.105.202.126 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
9476350068dbd8b61373906f6d9dba49ed31ed5d64d6ee2d48da082c44a447dc
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
br
x-cacheable
Matched cache
x-cdn-pop-ip
137.74.120.0/27
date
Mon, 04 Apr 2022 12:14:01 GMT
content-type
text/javascript;charset=utf-8
cache-control
max-age=3600
x-cdn-pop
sbg
content-disposition
attachment;filename="id5-api.js"
accept-ranges
bytes
content-length
11181
x-request-id
696327546
gtm.js
www.googletagmanager.com/ 		428 KB
109 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
90091319f77fae62b671a59a04c05c87d4d6d56f0f2c01c2b40be7d226de545a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
111362
x-xss-protection
0
last-modified
Mon, 04 Apr 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 04 Apr 2022 13:00:56 GMT
localstore.js
script.4dex.io/ 		483 B
940 B 		Script
General
Check archive.org
Download Go to
Full URL
https://script.4dex.io/localstore.js
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1136700
x-amz-request-id
tx8eb36d25696045eca73c2-00623993ca
x-amz-id-2
tx8eb36d25696045eca73c2-00623993ca
last-modified
Tue, 22 Mar 2022 09:15:21 GMT
server
cloudflare
etag
W/"922cffdd75f7192f75231d92684885aa"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HmM4PZBFLCV3p2%2FA8%2Badv8PM6MdNqWQendnN6Ld8g8fDobsz1m99Ish6x%2F5fiIxOY8CfLH7MSAQQlzWaDQiZRm5mePpV9jKI81tEthn4b4BIrp30s6HScQOSVRjGSVYqL0KK8VAqZjBxYrB9"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=1800
x-amz-version-id
1647940521027959
cf-ray
6f6a3ad47be468fb-FRA
724.json
id5-sync.com/g/v2/ 		212 B
531 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/g/v2/724.json
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.36.109.183 , France, ASN16276 (OVH, FR),
Reverse DNS
p08.id5-sync.com
Software
/
Resource Hash
1346e9414628a4c6d106f570b2e78911684b9c3f87b2b3b2e9f9d38fd1838f6d
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://threatpost.com
Date
Mon, 04 Apr 2022 13:00:55 GMT
Access-Control-Allow-Credentials
true
Vary
Origin
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/json;charset=UTF-8
bid
c.amazon-adsystem.com/e/dtb/ 		64 B
532 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&pid=zKK1G2va24ZXV&cb=0&ws=1600x1200&v=7.74.0&t=1200&slots=%5B%7B%22sd%22%3A%22div-gpt-ad-6794670-2%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-970x250-ATF%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6794670-3%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x250-ATF%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6794670-5%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x600-ATF%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-6794670-1%22%2C%22s%22%3A%5B%222x2%22%5D%2C%22sn%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-2x2-Skin%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.62.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-62-173.fra56.r.cloudfront.net
Software
Server /
Resource Hash
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
via
1.1 cae542650fb32c773cc494fc6e7e71e6.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA56-C1
x-amz-rid
DJMR6PJ0189BV017S7HG
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
64
x-amz-cf-id
j_yZyapzHGcjGFLwVZB4BkBBLlovdXIR012STERlbxpG1-Nbk9Yn0w==
sr
capi-tier-1-us-east-2.connatix.com/tr/ Frame 89D9 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-1-us-east-2.connatix.com/tr/sr?v=157363
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.223.60.0 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-223-60-0.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		83 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
sffe /
Resource Hash
a458687751e48d0f34909564714e7c6dd152c0bef1e10c7c78d3f0d8a2ba1b91
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28412
x-xss-protection
0
server
sffe
etag
"1177 / 945 of 1000 / last-modified: 1649070439"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Mon, 04 Apr 2022 13:00:56 GMT
2_media.bin
vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/ Frame 89D9 		285 B
351 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/2_media.bin
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3b9d39edb2591de65a095117689dd79effa44a7cf3e0a594d01c978b2f05d00e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
gzip
last-modified
Thu, 18 Mar 2021 19:13:10 GMT
age
79164
etag
"259c03714a4dc20e6a891f05ce653dc0"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
249
ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame 89D9 		375 KB
126 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b8e352006cc3bc3c7c2206316ef5ecc3a319959d6b6a3b4da9702afd1dff10de
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
127864
x-xss-protection
0
expires
Mon, 04 Apr 2022 13:00:56 GMT
1.png
img.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/c2ecd04f-0dca-4ffa-8761-d93b34717380/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/c2ecd04f-0dca-4ffa-8761-d93b34717380/1.png
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
739ab1cbd5fc795c806cfbc012e937834a1d566f02ed72ff02af2700c0629eb4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
br
age
1147114
etag
"CDlq0wWU2N6Hha9Y1OkqKS7K/JyWAUvXYL5GlZ2se8g"
access-control-max-age
86400
fastly-io-info
ifsz=8114 idim=288x42 ifmt=png ofsz=6487 odim=288x42 ofmt=png
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/png
content-length
6487
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
3370
date
Mon, 04 Apr 2022 12:04:46 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Mon, 04 Apr 2022 14:04:46 GMT
quant.js
secure.quantserve.com/ 		24 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8d6580af877387b05d9ffac3ebeacfe25a7728c77adef6d9b32fd72ccbe21468

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
gzip
etag
"u2JtyZzqnTXwzBUswy2r+w=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
expires
Mon, 11 Apr 2022 13:00:56 GMT
uwt.js
static.ads-twitter.com/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
gzip
last-modified
Tue, 29 Mar 2022 00:09:12 GMT
etag
"8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary
Accept-Encoding,Host
x-tw-cdn
FT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache
x-cache
HIT, HIT
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
5410
x-served-by
cache-iad-kcgs7200069-IAD, cache-hhn11523-HHN
c
prebid.a-mo.net/a/ 		0
348 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.a-mo.net/a/c
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 04 Apr 2022 13:00:56 GMT
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
server
envoy
x-envoy-upstream-service-time
323
vary
origin, Accept-Encoding
translator
hbopenbid.pubmatic.com/ 		0
0
prebid
mp.4dex.io/ 		114 B
587 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mp.4dex.io/prebid
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:372 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4be06cf99cd685a0f4f2162ae9b76f416e95a8cc0a0da96f461559490f249e3b

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

cf-ray
6f6a3ad63ff85c8c-FRA
pragma
no-cache
date
Mon, 04 Apr 2022 13:00:56 GMT
via
1.1 google
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
https://threatpost.com
expires
0
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-encoding
gzip
x-err
Validating the Prebid Request adunits. Sampled or No valid non-debug AdUnits
cygnus
htlb.casalemedia.com/ 		37 B
332 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=438654&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22148811ef6279875%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%22%2C%22ref%22%3A%22https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3%22%2C%22domain%22%3A%22threatpost.com%22%2C%22publisher%22%3A%7B%22domain%22%3A%22threatpost.com%22%7D%2C%22keywords%22%3A%22Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A4%2C%22msi%22%3A4%2C%22mfu%22%3A0%2C%22bu%22%3A3%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A3%2C%22ren%22%3Afalse%2C%22version%22%3A%225.17.0%22%2C%22userIds%22%3A%5B%5D%2C%22fpd%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2215672697d924608%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-970x250-ATF%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-970x250-ATF%22%2C%22sid%22%3A%22970x250%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-970x250-ATF%22%2C%22sid%22%3A%22970x90%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%2216daa5a06b255ea%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x250-ATF%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x250-ATF%22%2C%22sid%22%3A%22336x280%22%7D%7D%5D%7D%7D%2C%7B%22id%22%3A%22173325931d4df4b%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x600-ATF%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A600%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22dfp_ad_unit_code%22%3A%22%2F22404337467%2C21707124336%2Fthreatpost-300x600-ATF%22%2C%22sid%22%3A%22300x600%22%7D%7D%5D%7D%7D%5D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.85.251.43 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-251-43.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
c9f2e34a5b621232e6b0d9bc180a2b07f3425aafd8fa8a0c3e3971b04bae7b32

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:00:56 GMT
x-ak-initial-geo
CC:[DE], RC:[HE], CN:[EU], CIP:[185.213.155.169], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://threatpost.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
37
x-ak-client-geo
12
expires
Mon, 04 Apr 2022 13:00:56 GMT
v2
e.serverbid.com/api/ 		711 B
984 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://e.serverbid.com/api/v2
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.189.254.17 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 04 Apr 2022 13:00:56 GMT
access-control-allow-credentials
true
content-length
711
vary
Origin
content-type
application/json
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9695ad017373d9b19cda6b03bc00b5&pos=threatpost.com_desktop_728x90-atf&cmd=bid&secure=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
b1a37dafa1028347188cc748fb71c7d8d7357988b2004b12ec92c5dda3dc2235

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
92 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9695ad017373d9b19cda6b03bc00b5&pos=threatpost.com_desktop_300x250-atf&cmd=bid&secure=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
738ee0b280500a64e936646d56bd7b97cf345a52f37bf66370697a183b359099

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
content-length
62
bidRequest
c2shb.ssp.yahoo.com/ 		62 B
291 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9695ad017373d9b19cda6b03bc00b5&pos=threatpost.com_desktop_300x600-atf&cmd=bid&secure=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
233adb7eb31a24bdf8a03a6419d57432d6162ef0ccbd68cc67b65295e74ecaee

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
content-length
62
prebid
ib.adnxs.com/ut/v3/ 		11 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.87 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
d7650213aed884d4eb7b8300b890ef7f6a0b18fd3448413497c8ab30b9799d3d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

Date
Mon, 04 Apr 2022 13:00:56 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
185.213.155.169; 185.213.155.169; 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
f4dbbeae-00b1-4e23-84d1-3871e1602471
Server
nginx/1.21.3
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
btlr.sharethrough.com/universal/ 		0
113 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.121.26 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-196-121-26.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 04 Apr 2022 13:00:56 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/universal/ 		0
112 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.121.26 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-196-121-26.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 04 Apr 2022 13:00:56 GMT
access-control-allow-credentials
true
vary
Origin
v1
btlr.sharethrough.com/universal/ 		0
112 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.121.26 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-196-121-26.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 04 Apr 2022 13:00:56 GMT
access-control-allow-credentials
true
vary
Origin
arj
teachingaids-d.openx.net/w/1.0/ 		174 B
590 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=f5ca9979-7238-4d24-8c31-95c5390829a6%2Cf5ca9979-7238-4d24-8c31-95c5390829a6%2Ced082621-9581-45ae-bc8e-b50f7d2a2ccc%2C59fed6e0-fcde-4edc-81af-608b469ce19d%2C59fed6e0-fcde-4edc-81af-608b469ce19d&nocache=1649077255933&gdpr=0&x_gdpr_f=1&pubcid=cc65f5d8-71cb-4128-a926-06dc4151e455&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divids=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&aucs=%252F22404337467%252C21707124336%252Fthreatpost-970x250-ATF%2C%252F22404337467%252C21707124336%252Fthreatpost-970x250-ATF%2C%252F22404337467%252C21707124336%252Fthreatpost-300x250-ATF%2C%252F22404337467%252C21707124336%252Fthreatpost-300x600-ATF%2C%252F22404337467%252C21707124336%252Fthreatpost-300x600-ATF&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
08072a60078355b35831d9de7e9628ef201de11378fedca448fff989a19d29a9

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
gzip
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
164
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		4 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&kw=Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy&tg_i.ref=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&tg_i.page=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F&tg_i.domain=threatpost.com&tg_i.dfp_ad_unit_code=22404337467%2C21707124336%2Fthreatpost-970x250-ATF&tg_i.pbadslot=22404337467%2C21707124336%2Fthreatpost-970x250-ATF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=f5ca9979-7238-4d24-8c31-95c5390829a6&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.5838864302598588
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
2602:803:c004:200::140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
a1a67351bfc55c2db35bf6e28e27108e56fa0cce416c663343696b21e9856798

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:00:56 GMT
Content-Encoding
gzip
Server
nginx/1.21.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
1936
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		626 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&kw=Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy&tg_i.ref=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&tg_i.page=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F&tg_i.domain=threatpost.com&tg_i.dfp_ad_unit_code=22404337467%2C21707124336%2Fthreatpost-300x250-ATF&tg_i.pbadslot=22404337467%2C21707124336%2Fthreatpost-300x250-ATF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=ed082621-9581-45ae-bc8e-b50f7d2a2ccc&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.2961155842766099
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
2602:803:c004:200::140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
1a71b807ce4e56e46f3a58c5243928292277b85560060068c48a0bff35f8867d

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:00:56 GMT
Server
nginx/1.21.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
626
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		626 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&kw=Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy&tg_i.ref=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&tg_i.page=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F&tg_i.domain=threatpost.com&tg_i.dfp_ad_unit_code=22404337467%2C21707124336%2Fthreatpost-300x600-ATF&tg_i.pbadslot=22404337467%2C21707124336%2Fthreatpost-300x600-ATF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=59fed6e0-fcde-4edc-81af-608b469ce19d&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.6855564644636192
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
2602:803:c004:200::140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
d63a979624d0168362ee85d71af7eece046e02ce0b42dd71cf8ad8809e237175

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:00:56 GMT
Server
nginx/1.21.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
626
Expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		626 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&kw=Hacks%2CMalware%2CVulnerabilities%2CWebSecurity%2CMobileSecurity%2CPrivacy&tg_i.ref=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&tg_i.page=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F&tg_i.domain=threatpost.com&tg_i.dfp_ad_unit_code=22404337467%2C21707124336%2Fthreatpost-300x600-ATF&tg_i.pbadslot=22404337467%2C21707124336%2Fthreatpost-300x600-ATF&tk_flint=pbjs_lite_v5.17.0&x_source.tid=59fed6e0-fcde-4edc-81af-608b469ce19d&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.47811944697037334
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
2602:803:c004:200::140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
8ebcfe6d879fbfc22c88777434fcf1cd8c50899e18041fd23d7a9572a5a3956d

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:00:56 GMT
Server
nginx/1.21.4
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Content-Length
626
Expires
Wed, 17 Sep 1975 21:32:10 GMT
bid
ap.lijit.com/rtb/ 		94 B
741 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/rtb/bid?src=prebid_prebid_5.17.0
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
/
Resource Hash
29314c3c04c124ca7bd0c11412671f9eb37385a9dae741f783fc9cc03af60d25

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

Date
Mon, 04 Apr 2022 13:00:56 GMT
Content-Encoding
gzip
Vary
Accept-Encoding, User-Agent
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Content-Type
application/json
Access-Control-Allow-Origin
https://threatpost.com
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap3ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Content-Length
98
mvo
tag.1rx.io/rmp/216477/0/ 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/216477/0/mvo?z=1r&hbv=5.17,2.1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.43 Utrecht, Netherlands, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Mon, 04 Apr 2022 13:00:56 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
auction
tlx.3lift.com/header/ 		19 B
514 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=5.17.0&referrer=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&tmax=1200&gdpr=false
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.28.166.250 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-28-166-250.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:00:56 GMT
accept-ch
sec-ch-dpr,sec-ch-prefers-color-scheme,sec-ch-ua-bitness,sec-ch-ect,sec-ch-downlink,sec-ch-rtt,sec-ch-ua-arch,sec-ch-viewport-width,sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-model,sec-ch-viewport-height,sec-ch-width,sec-ch-save-data,sec-ch-device-memory
x-auction-status
12, 12, 12
content-type
application/json; charset=utf-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
adreq
ads.servenobid.com/ 		548 B
606 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.servenobid.com/adreq?cb=6796
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.244.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-154-244-32.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
cd3767c9daaaaf6b31ba6dd8821d1cf09594ffdddb05a60b81d960aa4e2f44e9

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 04 Apr 2022 13:00:57 GMT
content-encoding
gzip
amp-access-control-allow-source-origin
*
vary
accept-encoding
content-type
application/json
access-control-allow-origin
https://threatpost.com
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
724.json
id5-sync.com/g/v2/ 		213 B
532 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/g/v2/724.json
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.36.109.183 , France, ASN16276 (OVH, FR),
Reverse DNS
p08.id5-sync.com
Software
/
Resource Hash
4d8f864aed2d746918261e411ee2422b2d82fb085eb228b7af075cd4f98ced2e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

Access-Control-Allow-Origin
https://threatpost.com
Date
Mon, 04 Apr 2022 13:00:56 GMT
Access-Control-Allow-Credentials
true
Vary
Origin
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Content-Type
application/json;charset=UTF-8
hls.5b3b785f487abbe00eee.js
cds.connatix.com/p/157363/ Frame 89D9 		162 KB
47 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/157363/hls.5b3b785f487abbe00eee.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e2c4332b6cd0fea250e89907921adaf7e597b52808cf19c995d6173ae0263f21

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
br
last-modified
Mon, 04 Apr 2022 11:50:13 GMT
age
4023
etag
"182f65d040bfb9544bd8f71472475672"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
48258
rules-p-_7kVx0t9Jqj90.js
rules.quantcount.com/ 		2 B
354 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:f000:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 12:35:57 GMT
via
1.1 4f114016fe4d6c05531b0486ec2868be.cloudfront.net (CloudFront)
server
AmazonS3
age
1498
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
cross-origin-resource-policy
cross-origin
x-cache
Hit from cloudfront
x-amz-cf-pop
FRA56-C1
content-length
2
x-amz-cf-id
hPRwYF7FEXT4Ynth-gdmHIh0w9ALQAqndqIi8Hhbc4tm8ETUImCNrg==
adagio.js
script.4dex.io/ 		72 KB
23 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://script.4dex.io/adagio.js
Requested by
Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:8a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3373dca69883fd4d5298c955d822359a23e9c3658b63e06b483e251c10024f21

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1135523
access-control-max-age
3000
access-control-allow-methods
GET
x-amz-request-id
tx6f2ea791109f4903a1561-0062399424
x-amz-id-2
tx6f2ea791109f4903a1561-0062399424
last-modified
Tue, 22 Mar 2022 09:15:19 GMT
server
cloudflare
etag
W/"f6062b9ed3c12dab430d5d33afafadb4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cFPg6gIMToziFAGAkOwUnyhp9UPTYk2xbuDWiJ2PN5q%2BY2%2F1XAFmm9fcbNYRqAEwrDBd%2FjWNN%2FCVAPP0lP9CQTTa6QKoJXTRyHIf8ZV9H6xg%2BrNBO6F0hE2pEFMri0W1Lu4zIg3pjnj8mjK7"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=1800
access-control-allow-credentials
true
x-amz-version-id
1647940519211847
cf-ray
6f6a3ad7a96e9bcb-FRA
access-control-allow-headers
Authorization
adsct
t.co/i/ 		43 B
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=2d6030c4-d01c-484a-a33d-79a30b615ef1&tw_document_href=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-response-time
111
date
Mon, 04 Apr 2022 13:00:56 GMT
server
tsa_o
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
457030cb5833c57916087dd2e2ffe2c074b491939a3ef442dd50a7e0b4b281cf
content-length
43
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&aip=1&a=1595079605&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ul=en-us&de=UTF-8&dt=Log4JShell%20Used%20to%20Swarm%20VMware%20Servers%20with%20Miners%2C%20Backdoors%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1147685384&gjid=453060609&cid=444449005.1649077256&tid=UA-35676203-21&_gid=528781315.1649077256&_r=1&gtm=2wg3u0PM29HLF&z=1817537765
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:00:57 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&aip=1&a=1595079605&t=event&ni=0&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ul=en-us&de=UTF-8&dt=Log4JShell%20Used%20to%20Swarm%20VMware%20Servers%20with%20Miners%2C%20Backdoors%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=VISIBILITY&ea=elementVisibility%20%2F%20%5BHeader%5D%20%2F%20Social%20Networks%20View&_u=YEDAAEABAAAAAC~&jid=&gjid=&cid=444449005.1649077256&tid=UA-35676203-21&_gid=528781315.1649077256&gtm=2wg3u0PM29HLF&z=1037410599
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 03 Apr 2022 13:52:54 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
83283
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
bridge3.508.0_en.html
imasdk.googleapis.com/js/core/ Frame A857 		592 KB
193 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.508.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
56e21c0b93290490c1b1bcd3c541dc358b4f5bb43b24d954dc075e82fe48dcaf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges
bytes
age
542313
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
197186
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy
cross-origin
date
Tue, 29 Mar 2022 06:22:24 GMT
expires
Wed, 29 Mar 2023 06:22:24 GMT
last-modified
Mon, 28 Mar 2022 15:10:05 GMT
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
client.js
s0.2mdn.net/instream/video/ Frame 89D9 		44 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/instream/video/client.js
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16746
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Mon, 04 Apr 2022 13:00:57 GMT
bridge3.508.0_en.html
imasdk.googleapis.com/js/core/ Frame A5B8 		592 KB
193 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.508.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
56e21c0b93290490c1b1bcd3c541dc358b4f5bb43b24d954dc075e82fe48dcaf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges
bytes
age
542313
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
197186
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy
cross-origin
date
Tue, 29 Mar 2022 06:22:24 GMT
expires
Wed, 29 Mar 2023 06:22:24 GMT
last-modified
Mon, 28 Mar 2022 15:10:05 GMT
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
bridge3.508.0_en.html
imasdk.googleapis.com/js/core/ Frame 2F6E 		592 KB
193 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imasdk.googleapis.com/js/core/bridge3.508.0_en.html
Requested by
Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
56e21c0b93290490c1b1bcd3c541dc358b4f5bb43b24d954dc075e82fe48dcaf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges
bytes
age
542313
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
197186
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy
cross-origin
date
Tue, 29 Mar 2022 06:22:24 GMT
expires
Wed, 29 Mar 2023 06:22:24 GMT
last-modified
Mon, 28 Mar 2022 15:10:05 GMT
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
ao
capi-tier-1-us-east-2.connatix.com/tr/ Frame 89D9 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-1-us-east-2.connatix.com/tr/ao?v=157363
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.223.60.0 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-223-60-0.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
g
capi-tier-1-us-east-2.connatix.com/rtb/ Frame 89D9 		128 B
415 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-1-us-east-2.connatix.com/rtb/g?v=157363
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.223.60.0 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-223-60-0.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
c6c483679c45eb8eb879b3d17690dd23b9cf18de296dff1eab5af96c912f49c9

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Mon, 04 Apr 2022 13:00:56 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
119
bid
c.amazon-adsystem.com/e/dtb/ 		23 B
492 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&pid=zKK1G2va24ZXV&cb=1&ws=1600x1200&v=7.74.0&t=2000&slots=%5B%7B%22id%22%3A%22Amazon_400x225%22%2C%22mt%22%3A%22v%22%7D%5D&cfgv=1&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.62.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-62-173.fra56.r.cloudfront.net
Software
Server /
Resource Hash
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:57 GMT
via
1.1 cae542650fb32c773cc494fc6e7e71e6.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA56-C1
x-amz-rid
C2CC3ZWQP3Q46869K13V
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
23
x-amz-cf-id
hSb1G8QGxxcGmziD-IZtqhbXOR0NVeWEgNKX3QVSXOB5eWIpxAmVIw==
ps
capi-tier-1-us-east-2.connatix.com/tr/ Frame 89D9 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-1-us-east-2.connatix.com/tr/ps?v=157363
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.223.60.0 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-223-60-0.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Mon, 04 Apr 2022 13:00:57 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
1_th.jpg
img.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e998d70d54146b70fbd8882efdd0682978dbc337f03a6e22367cb97aadf9e573

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:57 GMT
content-encoding
br
age
244263
etag
"JNaAhBiLMSOnkkei/N3fo5fCL/mt/wlc+iBOJzzjuy8"
access-control-max-age
86400
fastly-io-info
ifsz=79819 idim=2560x1440 ifmt=jpeg ofsz=7628 odim=400x225 ofmt=jpeg
access-control-allow-origin
*
cache-control
max-age=2592000, public
fastly-stats
io=1
accept-ranges
bytes
content-type
image/jpeg
content-length
7179
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame CE6D 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 12:52:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
508
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Mon, 04 Apr 2022 13:52:29 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
441 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-35676203-21&cid=444449005.1649077256&jid=1147685384&gjid=453060609&_gid=528781315.1649077256&_u=YEBAAEAAAAAAAC~&z=311460508
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Mon, 04 Apr 2022 13:00:57 GMT
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame FDBE 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 12:52:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
508
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Mon, 04 Apr 2022 13:52:29 GMT
prebid6.7.0-1.js
cds.connatix.com/p/plugins/ Frame D695 		456 KB
119 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
084885652dacd1b70a7979e7631caa6fe5985a5c1b872c28dd890d9ea39cec3d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:57 GMT
content-encoding
br
last-modified
Wed, 09 Feb 2022 14:06:45 GMT
age
2944195
etag
"c647c6ead685f3c1b8ba4c8a5de1eb5a"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
121193
pixel;r=1530112873;source=gtm;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3;uht=2;fpan=1;fpa=P0-4999010...
pixel.quantserve.com/ 		35 B
372 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=1530112873;source=gtm;rf=0;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3;uht=2;fpan=1;fpa=P0-499901047-1649077256863;pbc=;ns=0;ce=1;qjs=1;qv=a98acd33-20220316110313;cm=;gdpr=0;us_privacy=1---;ref=;d=threatpost.com;je=0;sr=1600x1200x24;dst=0;et=1649077256863;tzo=0;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2022%2F03%2F29162217%2Fmosqu%2Ctype.article%2Ctitle.Log4JShell%20Used%20to%20Swarm%20VMware%20Servers%20with%20Miners%252C%20Backdoors%2Cdescription.Researchers%20have%20found%20three%20backdoors%20and%20four%20miners%20in%20attacks%20exploiting%20the%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:00:57 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
omweb-v1.js
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 8E62 		37 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Requested by
Host: srcdoc
URL: about:srcdoc
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 12:52:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
508
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12861
x-xss-protection
0
last-modified
Tue, 26 Oct 2021 20:08:54 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="omsdk-team-release-policy"
vary
Accept-Encoding
report-to
{"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Mon, 04 Apr 2022 13:52:29 GMT
integrator.js
adservice.google.de/adsid/ 		107 B
792 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:00:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
549 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:00:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		61 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1185834301470211&correlator=4193938599747649&eid=31066024%2C31066025%2C44755509&output=ldjh&gdfp_req=1&vrg=2022032106&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&tfua=0&tfcd=0&iu_parts=22404337467%3A21707124336%2Cthreatpost-970x250-ATF%2Cthreatpost-300x250-ATF%2Cthreatpost-300x600-ATF%2Cthreatpost-2x2-Skin%2Cthreatpost-AdX-Interstitial&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2%2C1x1&ifi=1&adks=4166723991%2C1414505084%2C1356251026%2C3771495681%2C2643643476&sfv=1-0-38&ecs=20220404&ists=1&fas=0%2C0%2C0%2C0%2C8&fsapi=false&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7C&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Flog4jshell-swarm-vmware-servers-miners-backdoors%252F179142%252F%26urlquery%3Dgoogfc%26contentid%3D179142%26category%3Dmalware-2%26contenttags%3D&sc=1&cookie_enabled=1&abxe=1&dt=1649077257021&lmt=1649077257&dlt=1649077253000&idt=2444&biw=1600&bih=1200&adxs=436%2C1082%2C1082%2C0%2C-9&adys=8%2C166%2C1211%2C8%2C-9&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&frm=20&vis=1&scr_x=0&scr_y=0&psz=728x0%7C300x0%7C300x0%7C1600x0%7C0x-1&msz=728x0%7C300x0%7C300x0%7C1600x0%7C0x-1&fws=0%2C0%2C0%2C0%2C2&ohw=0%2C0%2C0%2C0%2C0&ga_vid=444449005.1649077256&ga_sid=1649077257&ga_hid=1595079605&ga_fc=true&btvi=0%7C0%7C1%7C0%7C-1&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022032106.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
88825aa6711a2083445d3b77ec2178aaaa6ed3622bf938e045dd9ea492deb91f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:58 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11540
x-xss-protection
0
google-lineitem-id
5792876106,5794282999,5794835207,-2,-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138364533266,138364581378,138364590135,-2,-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4B89 		6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022032106.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, immutable, max-age=31536000
content-encoding
gzip
content-length
3108
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 04 Apr 2022 13:00:57 GMT
expires
Tue, 04 Apr 2023 13:00:57 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
pubads_impl_page_level_ads_2022032106.js
securepubads.g.doubleclick.net/gpt/ 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022032106.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022032106.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
sffe /
Resource Hash
17c36e9523e8b97999649b89a0f8480d574d7a1fe1dd4f3d8fe841e5649cd0c5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 16:37:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
505385
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13258
x-xss-protection
0
last-modified
Thu, 24 Mar 2022 20:13:14 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Wed, 29 Mar 2023 16:37:52 GMT
playlist.m3u8
vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/ Frame 89D9 		309 B
271 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/playlist.m3u8
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/157363/hls.5b3b785f487abbe00eee.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:57 GMT
content-encoding
gzip
last-modified
Thu, 18 Mar 2021 19:13:10 GMT
age
89947
etag
"8a966507b13615ecdc1330a4bc9dcfe1"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
164
ga-audiences
www.google.com/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-35676203-21&cid=444449005.1649077256&jid=1147685384&_u=YEBAAEAAAAAAAC~&z=2103562473
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:00:58 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-35676203-21&cid=444449005.1649077256&jid=1147685384&_u=YEBAAEAAAAAAAC~&z=2103562473
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:00:58 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
0.m3u8
vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/ Frame 89D9 		662 B
381 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/0.m3u8
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/157363/hls.5b3b785f487abbe00eee.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
3788f6d78d3779c5cb9799b5a5194c8e4f56de10b3c7cc962dd4ff56a006c076

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:58 GMT
content-encoding
gzip
last-modified
Thu, 18 Mar 2021 19:13:09 GMT
age
89946
etag
"3462f99156683c73680c822827559fb9"
vary
Accept-Encoding
content-type
application/x-mpegURL
access-control-allow-origin
*
access-control-max-age
86400
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
content-length
267
bidRequest
c2shb.pubgw.yahoo.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://c2shb.pubgw.yahoo.com/bidRequest
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-openrtb-version
Access-Control-Request-Method
POST
Origin
https://threatpost.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods
GET,POST,OPTIONS
access-control-allow-origin
https://threatpost.com
access-control-max-age
600
age
0
content-length
0
date
Mon, 04 Apr 2022 13:00:58 GMT
server
ATS/9.1.0.33
bidRequest
c2shb.pubgw.yahoo.com/ Frame D695 		66 B
122 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c2shb.pubgw.yahoo.com/bidRequest
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.33 /
Resource Hash
b8bb46fa9e3b8dd06c8f74c1b0e4af0c9975bee50f3032987946822a5aaace86

Request headers

Referer
https://threatpost.com/
x-openrtb-version
2.5
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
application/json

Response headers

date
Mon, 04 Apr 2022 13:00:58 GMT
server
ATS/9.1.0.33
age
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods
POST,GET,HEAD,OPTIONS
content-type
application/json;charset=utf-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
content-length
66
translator
hbopenbid.pubmatic.com/ Frame D695 		0
115 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 04 Apr 2022 13:00:57 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
prebid
ib.adnxs.com/ut/v3/ Frame D695 		138 B
987 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.87 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
2e5fbf796957265d266f18bca82506983d8eda6a4368f11711f43ef79cd5a350
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:00:58 GMT
X-Proxy-Origin
185.213.155.169; 185.213.155.169; 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
fd9a9502-070f-4652-8b50-e2a6e7780577
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
138
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cygnus
htlb.casalemedia.com/ Frame D695 		35 B
330 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=435871&v=8.1&ac=j&sd=1&nf=1&t=900&r=%7B%22id%22%3A%2270b775dbfc0c9%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A0%2C%22iu%22%3A1%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.7.0%22%2C%22userIds%22%3A%5B%22pubcid%22%5D%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%228f9316d754c8b6%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%2C%22fl%22%3A%22x%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%5D%2C%22playerSize%22%3A%5B%5B400%2C225%5D%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22skip%22%3A1%2C%22skipmin%22%3A31%2C%22skipafter%22%3A5%2C%22placement%22%3A1%2C%22w%22%3A400%2C%22h%22%3A225%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221005%22%2C%22rid%22%3A%22618ead1e-6d0d-4481-ac4d-e915bf24f879%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%229f1282e0-01d3-4e17-aace-32d1f0478889%22%7D%5D%7D%5D%2C%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%7D
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.85.251.43 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-251-43.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
717ac88612cde92669ca85963eac24bc3832909dad47e2f79cb860a80ba393ec

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:00:58 GMT
x-ak-initial-geo
CC:[DE], RC:[HE], CN:[EU], CIP:[185.213.155.169], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://threatpost.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
35
x-ak-client-geo
12
expires
Mon, 04 Apr 2022 13:00:58 GMT
mvo
tag.1rx.io/rmp/216475/0/ Frame D695 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/216475/0/mvo?z=1r&hbv=6.7,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.43 Utrecht, Netherlands, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Mon, 04 Apr 2022 13:00:58 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
mvo
tag.1rx.io/rmp/233098/0/ Frame D695 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/233098/0/mvo?z=1r&hbv=6.7,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.43 Utrecht, Netherlands, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Mon, 04 Apr 2022 13:00:58 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
prebid
ib.adnxs.com/ut/v3/ Frame D695 		139 B
988 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.87 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
f93b24cf2e261837a56a959179d201f8ffd8100c9efae679b20e90d1adb00541
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:00:58 GMT
X-Proxy-Origin
185.213.155.169; 185.213.155.169; 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
828759e7-ca48-4500-919b-e80765629f78
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
139
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
c
prebid.a-mo.net/a/ Frame D695 		0
229 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.a-mo.net/a/c
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 04 Apr 2022 13:00:58 GMT
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
server
envoy
x-envoy-upstream-service-time
151
vary
origin, Accept-Encoding
avjp
teachingaids-d.openx.net/v/1.0/ Frame D695 		106 B
127 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=b710e755-e236-4a75-b23c-957ff22db474&nocache=1649077257613&gdpr=0&pubcid=9f1282e0-01d3-4e17-aace-32d1f0478889&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C618ead1e-6d0d-4481-ac4d-e915bf24f879%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A400%2C%22h%22%3A225%2C%22skippable%22%3Atrue%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22protocols%22%3A%5B5%2C2%2C3%2C6%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22maxduration%22%3A180%7D%7D%5D%7D&auid=540882779&vwd=400&vht=225&aumfs=250
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:00:58 GMT
via
1.1 google
server
OXGW/18.0.0
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
106
expires
Mon, 26 Jul 1997 05:00:00 GMT
avjp
teachingaids-d.openx.net/v/1.0/ Frame D695 		106 B
127 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ch=UTF-8&res=1600x1200x24&ifr=true&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=4f023ee2-e55c-4d76-be7a-460e9faf5ade&nocache=1649077257617&gdpr=0&pubcid=9f1282e0-01d3-4e17-aace-32d1f0478889&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C618ead1e-6d0d-4481-ac4d-e915bf24f879%2C%2C&openrtb=%7B%22imp%22%3A%5B%7B%22video%22%3A%7B%22w%22%3A400%2C%22h%22%3A225%2C%22skippable%22%3Atrue%2C%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22protocols%22%3A%5B5%2C2%2C3%2C6%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22maxduration%22%3A180%7D%7D%5D%7D&auid=540882778&vwd=400&vht=225&aumfs=250
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:00:58 GMT
via
1.1 google
server
OXGW/18.0.0
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
https://threatpost.com
cache-control
private, max-age=0, no-cache
access-control-allow-credentials
true
content-type
application/json
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
106
expires
Mon, 26 Jul 1997 05:00:00 GMT
cygnus
htlb.casalemedia.com/ Frame D695 		37 B
332 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=435870&v=8.1&ac=j&sd=1&nf=1&t=900&r=%7B%22id%22%3A%2221f5ff4079e192a%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A0%2C%22iu%22%3A1%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.7.0%22%2C%22userIds%22%3A%5B%22pubcid%22%5D%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22222351055f561ec%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%2C%22fl%22%3A%22x%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%5D%2C%22playerSize%22%3A%5B%5B400%2C225%5D%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22skip%22%3A1%2C%22skipmin%22%3A31%2C%22skipafter%22%3A5%2C%22placement%22%3A1%2C%22w%22%3A400%2C%22h%22%3A225%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221005%22%2C%22rid%22%3A%22618ead1e-6d0d-4481-ac4d-e915bf24f879%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%229f1282e0-01d3-4e17-aace-32d1f0478889%22%7D%5D%7D%5D%2C%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%7D
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.85.251.43 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-251-43.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
30c3fec93060e1d17e88aaf8a361ac1fbb241cbe28b72a1b801b788250ac7eca

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:00:58 GMT
x-ak-initial-geo
CC:[DE], RC:[HE], CN:[EU], CIP:[185.213.155.169], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://threatpost.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
37
x-ak-client-geo
12
expires
Mon, 04 Apr 2022 13:00:58 GMT
mvo
tag.1rx.io/rmp/233148/0/ Frame D695 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/233148/0/mvo?z=1r&hbv=6.7,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.43 Utrecht, Netherlands, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Mon, 04 Apr 2022 13:00:58 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
mvo
tag.1rx.io/rmp/216476/0/ Frame D695 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/216476/0/mvo?z=1r&hbv=6.7,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.43 Utrecht, Netherlands, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Mon, 04 Apr 2022 13:00:58 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
translator
hbopenbid.pubmatic.com/ Frame D695 		0
59 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 04 Apr 2022 13:00:56 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
bl-39123b0-71ac0870.js
tagan.adlightning.com/math-aids-threatpost/ Frame 7C8D 		46 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-39123b0-71ac0870.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e2835af998d5ef885bfa14a1b1995c7724d5b6a76f545b4a491763bff6f0dac5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Sat, 02 Apr 2022 00:47:40 GMT
content-encoding
gzip
age
216799
x-cache
Hit from cloudfront
content-length
19393
x-amz-meta-git_commit
39123b0
last-modified
Sat, 02 Apr 2022 00:31:19 GMT
server
AmazonS3
etag
"27a611307893faed4f77b20bc9c527af"
x-amz-version-id
ciXDgJvjDfKJZB9C8XzODN3O2B85Zno7
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
0ijCrqvSKUOY3RsWVIQZWj4vFJNi0lAwwKk_9OJzTuLk0LXvRIb_cQ==
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ Frame 7C8D 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 20:58:51 GMT
content-encoding
gzip
age
15955328
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
TUHRqrlzhTbxex4WMHQv9X-k2Sw6z49HW76g4tP7GieSnuexHkNlYQ==
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ Frame 7C8D 		156 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
662c2a94ddbefd80383f947d986fdf188283cb827e3bd48e7caa477209616262
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
54060
x-xss-protection
0
server
cafe
etag
14745439489497797269
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 04 Apr 2022 13:00:58 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 7C8D 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d593fdf64289375adaa96b87ebf4c4beec2995d730e3601254e0a226808bfe57
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36916
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1648640521462251"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 04 Apr 2022 13:00:58 GMT
bl-39123b0-71ac0870.js
tagan.adlightning.com/math-aids-threatpost/ Frame 9389 		46 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-39123b0-71ac0870.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e2835af998d5ef885bfa14a1b1995c7724d5b6a76f545b4a491763bff6f0dac5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Sat, 02 Apr 2022 00:47:40 GMT
content-encoding
gzip
age
216799
x-cache
Hit from cloudfront
content-length
19393
x-amz-meta-git_commit
39123b0
last-modified
Sat, 02 Apr 2022 00:31:19 GMT
server
AmazonS3
etag
"27a611307893faed4f77b20bc9c527af"
x-amz-version-id
ciXDgJvjDfKJZB9C8XzODN3O2B85Zno7
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
TQOg3IkfaJy5_3V_xZvs4K_gfKOsJ7MmBPRMD02tdEbMBxsYt0QB9g==
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ Frame 9389 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 20:58:51 GMT
content-encoding
gzip
age
15955328
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
o6gAeGkm1hdT6-lBbBYdE7QmOANKuuAtTaMNyF2Cha-jrCXE64wUiQ==
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ Frame 9389 		156 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1f795bca081568c2a3800db7469b24f498296c697a7e7e8b2a5914e39bd0e9d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
54061
x-xss-protection
0
server
cafe
etag
1083773940456145860
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 04 Apr 2022 13:00:58 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 9389 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d593fdf64289375adaa96b87ebf4c4beec2995d730e3601254e0a226808bfe57
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36916
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1648640521462251"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 04 Apr 2022 13:00:58 GMT
bl-39123b0-71ac0870.js
tagan.adlightning.com/math-aids-threatpost/ Frame 2725 		46 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-39123b0-71ac0870.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e2835af998d5ef885bfa14a1b1995c7724d5b6a76f545b4a491763bff6f0dac5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Sat, 02 Apr 2022 00:47:40 GMT
content-encoding
gzip
age
216799
x-cache
Hit from cloudfront
content-length
19393
x-amz-meta-git_commit
39123b0
last-modified
Sat, 02 Apr 2022 00:31:19 GMT
server
AmazonS3
etag
"27a611307893faed4f77b20bc9c527af"
x-amz-version-id
ciXDgJvjDfKJZB9C8XzODN3O2B85Zno7
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
fZ6rUpcu2_IM74KF5VUmRct1_mz8udYfTj_CDfyFlvP8laF06fneAg==
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ Frame 2725 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 20:58:51 GMT
content-encoding
gzip
age
15955328
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
QNuL0dfIAFWeSdiNF2eN87wPubDtps5aC87Ej9rhDdHtdkyD7z2TVA==
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ Frame 2725 		156 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1fcd5be68b59b4fef4f4d950c369de931a13c82cd4cb3c194b834710d80cbd75
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
54061
x-xss-protection
0
server
cafe
etag
10668877354929561248
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 04 Apr 2022 13:00:58 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 2725 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d593fdf64289375adaa96b87ebf4c4beec2995d730e3601254e0a226808bfe57
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36916
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1648640521462251"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 04 Apr 2022 13:00:58 GMT
0.mp4
vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/ Frame 89D9 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/0.mp4
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/157363/hls.5b3b785f487abbe00eee.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d8bd1954d35c36441c577e571af12e327da0115465a35f85bca7f6976ad49dda

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Range
bytes=0-1361

Response headers

date
Mon, 04 Apr 2022 13:00:58 GMT
last-modified
Thu, 18 Mar 2021 19:13:09 GMT
age
89905
etag
"0f4ba301101db680996746112d54887a"
access-control-max-age
86400
content-type
video/mp4
Content-Range
bytes 0-1361/5163990
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
access-control-allow-origin
*
Content-Length
1362
0.mp4
vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/ Frame 89D9 		639 KB
640 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/0.mp4
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/157363/hls.5b3b785f487abbe00eee.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1a125096dce20357e3049f8166f66af69a0e57f5f802696000ab095613703e8f

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Range
bytes=1362-656072

Response headers

date
Mon, 04 Apr 2022 13:00:58 GMT
last-modified
Thu, 18 Mar 2021 19:13:09 GMT
age
89905
etag
"0f4ba301101db680996746112d54887a"
access-control-max-age
86400
content-type
video/mp4
Content-Range
bytes 1362-656072/5163990
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
access-control-allow-origin
*
Content-Length
654711
id
dpm.demdex.net/ 		368 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=983502BE532960BE0A490D4C%40AdobeOrg&d_nsid=0&ts=1649077258132
Requested by
Host: media.kaspersky.com
URL: https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js?ver=5.9.2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.242.106.163 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-242-106-163.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
cee550c754b603a8dd705a8de703ac2eb8e1c2c6fd5a9b4acfef424364824a1d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-1-v030-0b9ab801d.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-TID
IXHuBANnSA0=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://threatpost.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
312
Expires
Thu, 01 Jan 1970 00:00:00 UTC
flipboard.svg
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/ 		236 B
563 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/flipboard.svg
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:59 GMT
via
1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront)
last-modified
Mon, 04 Apr 2022 09:15:25 GMT
server
nginx
x-amz-cf-pop
FRA6-C1
etag
"624ab72d-ec"
x-cache
Miss from cloudfront
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
content-length
236
x-amz-cf-id
lPdn60A_hkFdR9s16UPcFaRZbRS8fOnKtYW9GmFWWemLSrKKCiOZDA==
fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:6400:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer
https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/themes/threatpost-2018/assets/css/main.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=1d62b9db
Origin
https://threatpost.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:59 GMT
via
1.1 8e04f5d6c745b231c10fce7c2aa9c70e.cloudfront.net (CloudFront)
last-modified
Mon, 04 Apr 2022 09:15:28 GMT
server
nginx
x-amz-cf-pop
FRA6-C1
etag
"624ab730-12d68"
x-cache
Miss from cloudfront
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
77160
x-amz-cf-id
djZDkOfBBGV8ppkYH6nvE98YRQ7W9_GVWG0yO5gJqsXIAt95rzI_Rw==
v1
geo.ipify.org/api/ 		491 B
676 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://geo.ipify.org/api/v1?apiKey=at_riPAQYz3EiQ6JhsH05bmtozma13RA
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.140.160.2 Ogden, United States, ASN18450 (WEBNX, US),
Reverse DNS
threatintelligenceplatform.com
Software
nginx /
Resource Hash
ca0c444aae496568a573398c2e7d3bf6057f44eec50331b16664967fefa0e9ad
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:00:59 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Server
nginx
X-Frame-Options
SAMEORIGIN
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
no-cache, private
Transfer-Encoding
chunked
Connection
keep-alive
adsct
analytics.twitter.com/i/ 		31 B
459 B 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=2d6030c4-d01c-484a-a33d-79a30b615ef1&tw_document_href=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&tpx_cb=twttr.conversion.loadPixels
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.67 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-response-time
105
date
Mon, 04 Apr 2022 13:00:58 GMT
content-encoding
gzip
server
tsa_o
strict-transport-security
max-age=631138519
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0
x-connection-hash
013ae72ab4e2cda2549f21ccc2c489dbf660b3d61b0e50910736f2a43351fcd1
content-type
application/javascript;charset=utf-8
content-length
57
view
securepubads.g.doubleclick.net/pcs/ Frame 7C8D 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuFgE-Zjxx5JvAY4iRH4GTvesHFxQipgkCIKO9_enRlbOEqpSr0Cg2gQeqQU9Pm3WD2m_5vlODtW1Y7rgu7Pyf2Lg52-z7Uqe2elvZ7wvno1GqAlTkXpIZJBeNDmL1Iim_4SZTgO7RexP2wJK4sj0Rgk7HN-60GVRAO8g6-TQ4icTWyL6dR7ZDth0iuZoeJlzVpn0ECQyFNi5LTsUwPT0Yq9MPwz2hg0q86pJvtV4MXxGYOs9ZV5LzHS_B1tWQUITOH3_f4f6Keg5jeIR8PJ8Z5XeF6AdweF80lUnx6I31blTiUGTgoVEx6O-WdSNc47n0hGYZC&sai=AMfl-YQ4gMfUcNb04RUBjHai12MnTx1Dyro_g4YPbs-aoLzCSHgL97yeyNEFcvVj3piPSHAvX2-jA4jH2F8TgQgcP0_Ny-ZHO5qp0NQzAy1X7Q&sig=Cg0ArKJSzD-TW4qiRbHoEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:00:59 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Mon, 04 Apr 2022 13:00:59 GMT
truncated
/ Frame 7C8D 		216 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7a3278fb19fc43ee6153a721e59c7f83168924d5c705823fbfcf827f13dfdda4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame 2725 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss36CoHN8l9U6ivsMFfnLM07lMj8Bh0gw8lGTPul3ZXSeAA3Vq95G4i6sOEAKp2N8Wo7WJG6UdJ6N5_EU1OVpSvU7g80ywcvYyjL2E6x4f749GT-VP1U0mV51rr-OOptXNJFh2qG-Tz5wTSMCc4gPIJ8aFFvzt4LnaGSkLtlF5rCVyYiLGZmtXK2BwgFNZMtx9bKtLf0hNtvdoJfCV1rJ9h_ri7AHAC4xdXiaA0J0NB9c0ls4rQvtEsYZfUR1LStdaLLbxidINIoElXESdnaHuux_yt6GXBDhj1KEdRwbT-mqTIBs4Mm7IDDtvvDRZAiHmodcqC&sai=AMfl-YTQHshjWYp4SLitV1W37-v0jgxXaRoOGnRWv6gxaP3GCh0u58tJgoXuIPQHzIA3KupNxo4X5ruxhW1cURmdE8VLB2wKx18dAN7hEQHVzA&sig=Cg0ArKJSzFEgJgYBdbgAEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:00:59 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
view
securepubads.g.doubleclick.net/pcs/ Frame 9389 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsteT7YyhMj6Y2OmSj6TDzvllkMc6vlw9lGhNg5O05yfRkeKmmEd9syHmy0yIUWubHJQZL1dkh-xFaUvuvoAyq9JAGo8wfKHV89hdLI7VTk1TErX2HnUQFWUaDkHV07a_opCX7KTn7CinR3AZW81CYXx-G4bmpbpJBgs2bR6VHlBDOqt3ywP7DanHgtlmzSx50UFsk0fx6zRSOMKaao3ObhwxQVnik_3FuaSlisj-dOB5UKnefDdvXY6tGNLNkSheDesLe8Fcn--4Ebb47NUKo6SYBltvOT7ilvsUoLZbbnDD7grgFBVIoAzptID55ZtFcdQX_qY&sai=AMfl-YTqcb26NJJYlJ4Fi2sVpL-TCAXnse8UAKnvGV8bKjtHnsOa60NzB1yYDTYXlUBblAaPDEg2XPVIDeDhGm6iXJWMGaFuRylOE_J8WK1NJw&sig=Cg0ArKJSzN5brSubgvlQEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:00:59 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
truncated
/ Frame 9389 		217 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e98eb1460234fd6b5825c8abddbcdfa37f9cdfd1c757c433aa0756dda317f4e5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 2725 		218 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7b06577922291f33b79bf89d32290e97e9c8264af48b3f94bdf27adf46e70a16

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type
image/png
dest5.html
kaspersky.demdex.net/ Frame 9DCF 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://kaspersky.demdex.net/dest5.html?d_nsid=0
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.15.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-154-15-255.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Accept-Ranges
bytes
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
2791
Content-Type
text/html;charset=UTF-8
DCS
dcs-prod-irl1-2-v030-05420085f.edge-irl1.demdex.com UNKNOWN
Expires
Thu, 01 Jan 1970 00:00:00 UTC
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
M1As/2MvQCo=
content-encoding
gzip
date
Mon, 4 Apr 2022 13:00:59 GMT
last-modified
Tue, 15 Mar 2022 12:36:14 GMT
vary
accept-encoding
id
kaspersky.d3.sc.omtrdc.net/ 		2 B
316 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://kaspersky.d3.sc.omtrdc.net/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=983502BE532960BE0A490D4C%40AdobeOrg&mid=88238087729275811294175148010201061015&ts=1649077259209
Requested by
Host: media.kaspersky.com
URL: https://media.kaspersky.com/tracking/omniture/s_code_single_suite.js?ver=5.9.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-188-95-229.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Mon, 04 Apr 2022 13:00:59 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-7b6f4bb9f7-s5whd
vary
Origin
x-c
main-1637.I660130.M0-562
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
content-type
application/x-javascript;charset=utf-8
content-length
2
x-xss-protection
1; mode=block
ibs:dpid=411&dpuuid=YkrsDAAAAJKdVwQA
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=83717903610884437954011580615560476877
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YkrsDAAAAJKdVwQA
42 B
943 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YkrsDAAAAJKdVwQA
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Server
34.242.106.163 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-242-106-163.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

DCS
dcs-prod-irl1-2-v030-00923ae7d.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
TfdJM4OnSMs=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YkrsDAAAAJKdVwQA
Date
Mon, 04 Apr 2022 13:01:00 GMT
Cache-Control
no-cache
Server
AMO-cookiemap/1.1
Connection
keep-alive
Content-Length
0
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
integrator.js
adservice.google.de/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:01:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:01:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		67 KB
15 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1185834301470211&correlator=2873896537220121&eid=31066024%2C31066025%2C44755509&output=ldjh&gdfp_req=1&vrg=2022032106&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&tfua=0&tfcd=0&iu_parts=22404337467%3A21707124336%2Cthreatpost-970x250-ATF%2Cthreatpost-300x250-ATF%2Cthreatpost-300x600-ATF%2Cthreatpost-2x2-Skin%2Cthreatpost-AdX-Interstitial&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2%2C1x1&ifi=6&adks=4166723991%2C1414505084%2C1356251026%2C3771495681%2C2643643476&sfv=1-0-38&ecs=20220404&ris=2~2~2~2~2&rcs=1%2C1%2C1%2C1%2C1&ists=1&fas=0%2C0%2C0%2C0%2C8&fsapi=false&prev_scp=amznbid%3D2%26amznp%3D2%26hb_adid_rubicon%3D65017161785768a%26hb_bidder_rubicon%3Drubicon%26dyn_bids%3D0.21%26hb_adid%3D65017161785768a%26hb_bidder%3Drubicon%7Camznbid%3D2%26amznp%3D2%26hb_adid_appnexus%3D64d094c1541d09a%26hb_bidder_appnexus%3Dappnexus%26dyn_bids%3D0.02%26hb_adid%3D64d094c1541d09a%26hb_bidder%3Dappnexus%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7C&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Flog4jshell-swarm-vmware-servers-miners-backdoors%252F179142%252F%26urlquery%3Dgoogfc%26contentid%3D179142%26category%3Dmalware-2%26contenttags%3D&sc=1&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&abxe=1&dt=1649077259230&lmt=1649077259&dlt=1649077253000&idt=2444&biw=1600&bih=1200&adxs=315%2C1064%2C1082%2C0%2C-9&adys=8%2C256%2C1581%2C8%2C-9&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&frm=20&vis=1&scr_x=0&scr_y=0&psz=970x90%7C336x280%7C300x250%7C1600x0%7C0x-1&msz=970x90%7C336x280%7C300x250%7C1600x0%7C0x-1&fws=0%2C0%2C0%2C0%2C2&ohw=0%2C0%2C0%2C0%2C0&ga_vid=444449005.1649077256&ga_sid=1649077257&ga_hid=1595079605&ga_fc=true&btvi=0%7C0%7C2%7C0%7C-1&nvt=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022032106.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
0c6420a2a054c1be4bddb86d4a472bebf82bdd50a20bb8e596669bb04117a73a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:00 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15083
x-xss-protection
0
google-lineitem-id
5697900663,5792816763,-1,-2,-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138350331126,138364955038,-1,-2,-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203240101/ Frame 7C8D 		297 KB
107 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7500593236707325&plah=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
85dbba0089503ee23422468ede0994ba879e96a25ce4bfaf2406f1654bbb2410
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:00:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
109417
x-xss-protection
0
server
cafe
etag
8894996251107762295
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 04 Apr 2022 13:00:59 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20220330/r20190131/ Frame 62F9 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20220330/r20190131/zrt_lookup.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0ce5fc08d0f617e71e1d61bcd79fc7cc1855f4221945b0c09ac774685fe7f52c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

age
48719
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=1209600
content-encoding
gzip
content-length
4502
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 03 Apr 2022 23:29:01 GMT
etag
4044455266028820542
expires
Sun, 17 Apr 2022 23:29:01 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
sv
capi-tier-1-us-east-2.connatix.com/tr/ Frame 89D9 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-1-us-east-2.connatix.com/tr/sv?v=157363
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.223.60.0 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-223-60-0.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Mon, 04 Apr 2022 13:00:59 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203300101/ Frame 9389 		301 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203300101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7500593236707325&plah=threatpost.com&bust=31066120
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
58f40e70904ea6117401789b2c4daf93831eeafa1079afbcb04026f5883edfae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
110325
x-xss-protection
0
server
cafe
etag
8757688092525074742
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 04 Apr 2022 13:01:00 GMT
show_ads_impl_with_ama_fy2019.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203240101/ Frame 2725 		297 KB
107 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203240101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-7500593236707325&plah=threatpost.com&bust=31065921
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2700d79a7d4fc0066996f0a3002c37fab7cbef0a0bf63668303b52726fe4bc39
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
109422
x-xss-protection
0
server
cafe
etag
6357067802716305471
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 04 Apr 2022 13:01:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 7C8D 		0
0
cookie.js
partner.googleadservices.com/gampad/ Frame 7C8D 		0
0
integrator.js
adservice.google.de/adsid/ Frame 7C8D 		0
0
integrator.js
adservice.google.com/adsid/ Frame 7C8D 		0
0
ads
googleads.g.doubleclick.net/pagead/ Frame B9EC 		0
0
sodar
pagead2.googlesyndication.com/getconfig/ Frame 7C8D 		0
0
0.mp4
vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/ Frame 89D9 		613 KB
613 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/0.mp4
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/157363/hls.5b3b785f487abbe00eee.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b0c35bcc511183abbaf158b20f6f4a85a54cf4353b4df88163dc9425d97e4ca6

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Range
bytes=656073-1283660

Response headers

date
Mon, 04 Apr 2022 13:01:00 GMT
last-modified
Thu, 18 Mar 2021 19:13:09 GMT
age
89907
etag
"0f4ba301101db680996746112d54887a"
access-control-max-age
86400
content-type
video/mp4
Content-Range
bytes 656073-1283660/5163990
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
access-control-allow-origin
*
Content-Length
627588
view
securepubads.g.doubleclick.net/pcs/ Frame 9389 		0
0
view
securepubads.g.doubleclick.net/pcs/ Frame 2725 		0
0
sodar
pagead2.googlesyndication.com/getconfig/ 		14 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022032106&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022032106.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
10792ba188ea5d2ecb0fffeec2aece8ea2fbd37204c4b5a6f3b528eca21320ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:01:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10700
x-xss-protection
0
activeview
pagead2.googlesyndication.com/pcs/ Frame 7C8D 		0
0
activeview
pagead2.googlesyndication.com/pcs/ Frame 9389 		0
0
activeview
pagead2.googlesyndication.com/pcs/ Frame 2725 		0
0
bl-39123b0-71ac0870.js
tagan.adlightning.com/math-aids-threatpost/ Frame BDC7 		46 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-39123b0-71ac0870.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e2835af998d5ef885bfa14a1b1995c7724d5b6a76f545b4a491763bff6f0dac5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Sat, 02 Apr 2022 00:47:40 GMT
content-encoding
gzip
age
216801
x-cache
Hit from cloudfront
content-length
19393
x-amz-meta-git_commit
39123b0
last-modified
Sat, 02 Apr 2022 00:31:19 GMT
server
AmazonS3
etag
"27a611307893faed4f77b20bc9c527af"
x-amz-version-id
ciXDgJvjDfKJZB9C8XzODN3O2B85Zno7
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
i68iCA_zgnc0EALkVXb6Hone7AcRW4XykKwkubEPqdevYkAJ3VtDYQ==
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ Frame BDC7 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 20:58:51 GMT
content-encoding
gzip
age
15955330
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
6kcQlwl-I1iiIAeEYm3kXORodpXh59cZDyPtgimzmqcrO9uCUvO58A==
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame BDC7 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d593fdf64289375adaa96b87ebf4c4beec2995d730e3601254e0a226808bfe57
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36916
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1648640521462251"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 04 Apr 2022 13:01:00 GMT
bl-39123b0-71ac0870.js
tagan.adlightning.com/math-aids-threatpost/ Frame 901A 		46 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-39123b0-71ac0870.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e2835af998d5ef885bfa14a1b1995c7724d5b6a76f545b4a491763bff6f0dac5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Sat, 02 Apr 2022 00:47:40 GMT
content-encoding
gzip
age
216801
x-cache
Hit from cloudfront
content-length
19393
x-amz-meta-git_commit
39123b0
last-modified
Sat, 02 Apr 2022 00:31:19 GMT
server
AmazonS3
etag
"27a611307893faed4f77b20bc9c527af"
x-amz-version-id
ciXDgJvjDfKJZB9C8XzODN3O2B85Zno7
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
aJiielWrYBONsEVsSlS9qJie-dyaaycOwN_QH_2rTaAWfef48uKckw==
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ Frame 901A 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 20:58:51 GMT
content-encoding
gzip
age
15955330
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
0RdP99skW7hUKqix-fsS2Rm0pY5Rb5ZPZihkpl2lvjrRy-Bef5ONcw==
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ Frame 901A 		156 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f36d6f39c5e18053e0fd5e117a1c899a87a4bf1cd8b8c440bddf52b7eba62893
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
54068
x-xss-protection
0
server
cafe
etag
296232736641913431
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 04 Apr 2022 13:01:00 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 901A 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d593fdf64289375adaa96b87ebf4c4beec2995d730e3601254e0a226808bfe57
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36916
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1648640521462251"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 04 Apr 2022 13:01:00 GMT
container.html
ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 768E 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges
bytes
age
4
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, immutable, max-age=31536000
content-encoding
gzip
content-length
3108
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 04 Apr 2022 13:00:57 GMT
expires
Tue, 04 Apr 2023 13:00:57 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 04 Apr 2022 13:01:01 GMT
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1595079605&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&dp=%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ul=en-us&de=UTF-8&dt=Log4JShell%20Used%20to%20Swarm%20VMware%20Servers%20with%20Miners%2C%20Backdoors%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAEABAAAAAC~&jid=545262266&gjid=564500784&cid=444449005.1649077256&uid=88238087729275811294175148010201061015&tid=UA-63997723-2&_gid=528781315.1649077256&_r=1&gtm=2wg3u0WZ7LJ3&cd14=no_locale&cd15=88238087729275811294175148010201061015&cd53=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F100.0.4896.60%20Safari%2F537.36&cd16=444449005.1649077256&z=1076718339
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:01 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
3375
date
Mon, 04 Apr 2022 12:04:46 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Mon, 04 Apr 2022 14:04:46 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:7::17d8:4dc8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
5d5cf5a4a5b7c02915bc261dca0c755d29beda0c0c3a005c78c1682c9934bb3c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:01 GMT
Content-Encoding
gzip
Last-Modified
Fri, 18 Mar 2022 23:45:34 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=55999
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3104
js
www.googletagmanager.com/gtag/ 		93 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-9582686
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T45JW6B&l=dataLayer
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
429321a814615c2b46db8510a4e1253dbd006e413d63026f43de9ebb58749b17
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:01 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37610
x-xss-protection
0
last-modified
Mon, 04 Apr 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 04 Apr 2022 13:01:01 GMT
0.mp4
vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/ Frame 89D9 		583 KB
584 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://vid.connatix.com/pid-c2ecd04f-0dca-4ffa-8761-d93b34717380/60764267-557e-410f-85cb-f102d92ee134/523d4fb0-4f47-4bf9-83cd-2b5c179a45db/0.mp4
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/157363/hls.5b3b785f487abbe00eee.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6ee01e065dff517ba78e03c1692a6d7bacba2d47302ebe41687efab7afcf2666

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Range
bytes=1283661-1880801

Response headers

date
Mon, 04 Apr 2022 13:01:01 GMT
last-modified
Thu, 18 Mar 2021 19:13:09 GMT
age
89906
etag
"0f4ba301101db680996746112d54887a"
access-control-max-age
86400
content-type
video/mp4
Content-Range
bytes 1283661-1880801/5163990
cache-control
public,max-stale=31557600,stale-while-revalidate=31557600,immutable,max-age=31557600
accept-ranges
bytes
access-control-allow-origin
*
Content-Length
597141
js
www.googletagmanager.com/gtag/ 		176 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-YP1JLG57CH&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WZ7LJ3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
7e4e518db6ef82fc5bd4a52ac46e3eed1ee128021cdd80869bca85eab17a265c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:01 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
66029
x-xss-protection
0
expires
Mon, 04 Apr 2022 13:01:01 GMT
mq
capi-tier-1-us-east-2.connatix.com/tr/ Frame 89D9 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-1-us-east-2.connatix.com/tr/mq?v=157363
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.223.60.0 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-223-60-0.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Mon, 04 Apr 2022 13:01:00 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
collect
stats.g.doubleclick.net/j/ 		4 B
25 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-63997723-2&cid=444449005.1649077256&jid=545262266&uid=88238087729275811294175148010201061015&gjid=564500784&_gid=528781315.1649077256&_u=aEDAAEABAAAAAC~&z=432729138
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Mon, 04 Apr 2022 13:01:01 GMT
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame BDC7 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssZ7G1r1NPFXFhqqJdx0ebMg1oVI3PmE293hZoRhQ7Y0CCXgU6iechJA7-VArEBk54I73IbY32zz2sX46v8JlncuT5PKW0YP8AgTceDpyqARrdCXVOxf2BMypKmOHGN-7s_einQY3bBwYQGfbyW-pmvnSnmWJCQKJj60l0o6VZVH107BzeT1nh-E9Ovom9IHATvglbJdLgJeoYFHqJBQ_oEDsnKo6Ul-An5uu0eHinlxWb64bUWMvKW0XqLg0jD0nLrDoacZJG3-U2l2qD9u6ZvopfpyjLNm7h7KLF1vHp2DYbySNes2XfMUfQXVwndXt5NC5j5ig&sig=Cg0ArKJSzJ2PjaeYcQ4XEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:01:01 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
js
tags.mathtag.com/notify/ Frame BDC7 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.mathtag.com/notify/js?exch=ruc&s_exch=ruc&id=5aW95q2jLzIzLyAvT1RZMlpUWTNPRFl0WW1Ka01DMHpZamM1TFRBd01EQXRNREF3TURBd01EQXdNREF3LzE2NjExNzg0ODcxMDA5NzU4OTIvMTA0MDYyOTUvMTExNDI0ODEvOS9rNXQyOTRaRGZ2TWtqazA5ZGdBNjFqbk9oajF3RDZnd19La0wxbXozR2FzLzEvOS8wLzAvMTg1MzkyMS8wLzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMTY2MTE3ODQ4NzEwMDk3NTg5Mi9hbXMvMC8xMDAwMS8xMDEvOTk5LzIvMmEwMzoxYjIwOjY6ZjAwMDo6LzAuMDAwLzE2NDkwNzcyNTYvMTY0OTA4OTg1Ni85LzE5MjU0Lw/sa5UYxrbazajsJcJDOlB3AACgxg&nodeid=357&group=cdg&auctionid=1661178487100975892&shardkey=1661178487100975892&sid=11142481&cid=10406295&bp=a_cagefj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.134.181&3pck=https%3A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F1ae7566e-24ce-409a-945b-6cc4b4592ccf%2F
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.134.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.305.0 /
Resource Hash
02465f79cfb28eaa438ad7f3f17a14060ddac8bfc403ef72f36f8d1d9e1215f9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:02 GMT
Content-Encoding
gzip
x-mm-bid-request-time
1649077256
Last-Modified
Mon, 04 Apr 2022 13:00:56 GMT
Server
MMBD/3.305.0
x-mm-latency
1 (0)
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
x-mm-dbg
Count
Cache-Control
no-cache
x-mm-host
cdg-router-x91, cdg-bidder-x54
Connection
close
Content-Type
application/x-javascript; charset=UTF-8
Expires
Mon, 04 Apr 2022 13:01:01 GMT
1ae7566e-24ce-409a-945b-6cc4b4592ccf
beacon-fra2.rubiconproject.com/beacon/d/ Frame BDC7 		43 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon-fra2.rubiconproject.com/beacon/d/1ae7566e-24ce-409a-945b-6cc4b4592ccf?oo=0&accountId=19254&siteId=300372&zoneId=1509502&sizeId=55&e=6A1E40E384DA563B81DBB270C43A0F16084F6FB94D1BF597BEC0966C7DE4D72AEF986366CAC7318BE5F3A11F7FFBDA426D748C0D8D7FAA22C778F3960CE4E61138F32E4F7348F5BA6418C72BD9F7D37492B910FE175A3D70E2415B40B965D6E3A0629DAD06110F8251DA004D8779CB37AF3110A00326FF6BCAF8C8B8F3DCE3F0F8173AA1652781238EC275C0873AE19D3411F4A9DE11AB2C4EE8FBE914508B90998A3230C489E6C0B491127CF63155180E9B507315AB3D83CDA10306204D320B
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
2602:803:c004:200::154 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:02 GMT
X-Content-Type-Options
nosniff
X-Frame-Options
DENY
Content-Type
image/avif
Cache-Control
private, max-age=0, no-cache
Connection
keep-alive
Content-Length
43
X-XSS-Protection
1; mode=block
Expires
01 Jan 1970 10:00:00 GMT
ck-confirm
tags.mathtag.com/ Frame BDC7
Redirect Chain
  • https://tags.mathtag.com/notify/img?exch=ruc&s_exch=ruc&id=5aW95q2jLzIzLyAvT1RZMlpUWTNPRFl0WW1Ka01DMHpZamM1TFRBd01EQXRNREF3TURBd01EQXdNREF3LzE2NjExNzg0ODcxMDA5NzU4OTIvMTA0MDYyOTUvMTExNDI0ODEvOS9rNX...
  • https://tags.mathtag.com/ck-confirm?bid_id=1661178487100975892&node_id=357&exch_id=9
49 B
330 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tags.mathtag.com/ck-confirm?bid_id=1661178487100975892&node_id=357&exch_id=9
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Server
185.29.134.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.305.0 /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:02 GMT
Server
MMBD/3.305.0
Content-Type
image/gif
Cache-Control
no-cache
x-mm-host
cdg-router-x103, cdg-bidder-x54
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
49
Expires
Mon, 04 Apr 2022 13:01:01 GMT

Redirect headers

Date
Mon, 04 Apr 2022 13:01:02 GMT
x-mm-bid-request-time
1649077256
Last-Modified
Mon, 04 Apr 2022 13:00:56 GMT
Server
MMBD/3.305.0
x-mm-latency
2 (1)
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://tags.mathtag.com/ck-confirm?bid_id=1661178487100975892&node_id=357&exch_id=9
x-mm-dbg
Count
Cache-Control
no-cache
x-mm-host
cdg-router-x102, cdg-bidder-x54
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Keep-Alive
timeout=360
Content-Length
84
Expires
Mon, 04 Apr 2022 13:01:01 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 901A 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst8yROw6WnHHvZzxBlcakB6YLFMmS_YfkcNyQ7lKTDbTvzhs5QHRYMbw3Uy-Dm9PBRiFWzWlJM3uEOnclAJqecTW57MStynT8ku_7DVwXunGf1MrUhe1i4f0eBMDBbxt9pf_mC1hhKG4b7CdVf2qtiIBg6r1XRzK6AGVSd2UWrNw9AwO3EGoaeghXeLXwG8H4Qzc6SlwhmRqzKhJ-xg-jAleqD7-XkhX9ZaEv4uDc0bnbA3_s0b2z6q1FALBqDE-SNRl_B_WYXDapIIyp8GL49C4_HciLriOBeLlbtulndLDmPx-Ixl3iEhRFIddJd6SbgR_4AL&sig=Cg0ArKJSzNz2arv9ba7LEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:01:01 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
bl-39123b0-71ac0870.js
tagan.adlightning.com/math-aids-threatpost/ Frame 768E 		46 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/bl-39123b0-71ac0870.js
Requested by
Host: ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
URL: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e2835af998d5ef885bfa14a1b1995c7724d5b6a76f545b4a491763bff6f0dac5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Sat, 02 Apr 2022 00:47:40 GMT
content-encoding
gzip
age
216802
x-cache
Hit from cloudfront
content-length
19393
x-amz-meta-git_commit
39123b0
last-modified
Sat, 02 Apr 2022 00:31:19 GMT
server
AmazonS3
etag
"27a611307893faed4f77b20bc9c527af"
x-amz-version-id
ciXDgJvjDfKJZB9C8XzODN3O2B85Zno7
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
nKenS2reNa_6Psna67cnGl7HS_lbxztVDJtaI_Z2004GwcT_MW3yrg==
b-7b120a5-9b871d4e.js
tagan.adlightning.com/math-aids-threatpost/ Frame 768E 		73 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Requested by
Host: ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
URL: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-117.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 20:58:51 GMT
content-encoding
gzip
age
15955331
x-cache
Hit from cloudfront
content-length
28179
x-amz-meta-git_commit
7b120a5
last-modified
Mon, 16 Aug 2021 17:49:31 GMT
server
AmazonS3
etag
"c42a7ac1ac405f3f0cad04305cad5553"
x-amz-version-id
HCJNSpgvHPkSF2.YDap.Qx6PnxOllH79
via
1.1 98997c223299d9efd138e7fb9a08a072.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
eZi5CXyh6Wq4GLHg5VHQOyfj5LqcImjqt_oQaeW7OF3P_o0QfUH5CA==
js
tags.mathtag.com/notify/ Frame 768E 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvTkRoall6aGpNalF0TTJZeE5pMW1aRFEyTFRBd01EQXRNREF3TURBd01EQXdNREF3LzE2NjExNzg1MDY0MzEyOTYxNzQvMTA0MDYyOTEvMTExNDI0ODEvNC9rNXQyOTRaRGZ2TWtqazA5ZGdBNjF0U2NsS0FiY3JocGltMHpkdFN1LUFRLzEvNC8wLzAvMTg1MzkyMS8zMTE3NzgzODA4LzIxNTU0My8xMTI5Mjc0LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMTY2MTE3ODUwNjQzMTI5NjE3NC96cmgvMC8xMDAwMS8xMDEvOTk5LzI1OC8xODUuMjEzLjE1NS4wLzAuMDAwLzE2NDkwNzcyNjAvMTY0OTA4OTg2MC80L3B1Yi00MTEzNjgxODgyMzExNDU1Lw/i3PH2TS9x9yxgoOzO5AJSumJ6Hw&nodeid=719&group=zrh&auctionid=1661178506431296174&shardkey=1661178506431296174&sid=11142481&cid=10406291&bp=a_cagefj&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.133.238&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCmwTgC-xKYq2oO8LG7_UPrYWL0AvPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi00MTEzNjgxODgyMzExNDU1yAEJ4AIAqAMBqgSyAk_QiwJY09x2nTwn_8pWW1jnbN2fq9eWLbAnHPpoIq4BOuU9sPNw9QHbPNdt-lZVQ4-m_PUxvqYmNskevbb2T8yVzTXKx1KAzjibVRqhoHzGzR_IqTpUUWtbaQ_Lu6yJ0NebD8E1uqDJ_oUySPG3TYGKjIo4C8Yw8ES9JeLHhlQRCwWsqCIx5GYE4w69V4wpVGjWSnCU0nuT884e6k7u-l_4F7sBmlcSMqk6jQtjSA4CF0IrH67qhek71M_8vlQbF_YPzVeTHgr5KedfMT4EFXX9uwBC7M3hbgxqL7XtiVB5mNo6fe0-k0ssCq2zbbD9zrvOFS0eZCUkQA309qPHkGwBaXF9A0u7KEDA-EutK9RT7X6oKYbKH2nE_LqwjE5T_6Q5nUWrXjkngrTWVWvP4ph2fOAEAYAGh-uT36LvmL9goAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBQiAYRAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1PpsWOEAqviAL_vGDxDUDGGKmU-w%26client%3Dca-pub-4113681882311455%26adurl%3D
Requested by
Host: ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
URL: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.134.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.305.0 /
Resource Hash
e736de183dc3e5ea94905f3925ad71b012c65a101f6fe31ef8b8fe9a6cb50898

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:02 GMT
Content-Encoding
gzip
x-mm-bid-request-time
1649077260
Last-Modified
Mon, 04 Apr 2022 13:01:00 GMT
Server
MMBD/3.305.0
x-mm-latency
17 (1)
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
x-mm-dbg
Count
Cache-Control
no-cache
x-mm-host
cdg-router-x94, zrh-bidder-x72
Connection
close
Content-Type
application/x-javascript; charset=UTF-8
Expires
Mon, 04 Apr 2022 13:01:01 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame 768E 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/window_focus_fy2019.js
Requested by
Host: ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
URL: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 12:54:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
410
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1233
x-xss-protection
0
server
cafe
etag
16517525077337815633
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 18 Apr 2022 12:54:12 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 768E 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
URL: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d593fdf64289375adaa96b87ebf4c4beec2995d730e3601254e0a226808bfe57
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36916
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1648640521462251"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 04 Apr 2022 13:01:01 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame 768E 		15 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
URL: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 12:59:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
68
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6407
x-xss-protection
0
server
cafe
etag
6055885685211612390
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 18 Apr 2022 12:59:54 GMT
l
www.google.com/ads/measurement/ Frame 768E 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTSEcWjKQFr4YdG4DqGaEk_pFbVlW0frek-kvH4gWl4JzjGIZrE2BfaZJFS2Kl2ZplWudhLLBJPOke78aTUpzS0tmztiQ
Requested by
Host: ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
URL: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers
ext.js
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 768E 		22 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js
Requested by
Host: ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
URL: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 06:13:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
24439
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7022
x-xss-protection
0
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Tue, 04 Apr 2023 06:13:43 GMT
truncated
/ Frame 901A 		212 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e388df0a2d325b5c1562bcabfa19bccb30646f0f98d09205d10e0c818cc9454f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type
image/png
ga-audiences
www.google.com/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-63997723-2&cid=444449005.1649077256&jid=545262266&_u=aEDAAEABAAAAAC~&z=2024416129
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:01 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-63997723-2&cid=444449005.1649077256&jid=545262266&_u=aEDAAEABAAAAAC~&z=2024416129
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:02 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
s29751185160482
kaspersky.d3.sc.omtrdc.net/b/ss/kaspersky-single-suite/1/JS-2.22.3/ 		43 B
244 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kaspersky.d3.sc.omtrdc.net/b/ss/kaspersky-single-suite/1/JS-2.22.3/s29751185160482?AQB=1&ndh=1&pf=1&t=4%2F3%2F2022%2013%3A1%3A1%201%200&mid=88238087729275811294175148010201061015&aamlh=6&ce=UTF-8&ns=kaspersky&cdp=2&pageName=websites%20%3E%20log4jshell-swarm-vmware-servers-miners-backdoors%2F179142&g=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&cc=USD&ch=websites&server=threatpost.com&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=other&c3=b2c&v3=websites%20%3E%20log4jshell-swarm-vmware-servers-miners-backdoors%2F179142&v9=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&c20=url&c29=v1%3As_code_single_suite.js%3AtrackPageView%20%3E%20sng.t%3Ap&c30=v1%3A20220404%3A288%3ANextGen%3A%5BNULL%5D&c31=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F&v44=D%3Dv3&c47=Default&v47=D%3Dc47&c51=Websites&c57=%5BNULL%5D&v57=D%3Dc57&c58=Log4JShell%20Used%20to%20Swarm%20VMware%20Servers%20with%20Miners%2C%20Backdoors%20%7C%20Threatpost&v71=v1%3APage%20View%3A%5BNULL%5D&v113=88238087729275811294175148010201061015&v116=444449005.1649077256&v125=0.346381815582425_1649077258135&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=983502BE532960BE0A490D4C%40AdobeOrg&AQE=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-188-95-229.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:01 GMT
x-content-type-options
nosniff
x-c
main-1637.I660130.M0-562
p3p
CP="This is not a P3P policy"
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Tue, 05 Apr 2022 13:01:01 GMT
server
jag
xserver
anedge-7b6f4bb9f7-fdl82
etag
3541366452754284544-4619711439816977100
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Sun, 03 Apr 2022 13:01:01 GMT
abt
capi-tier-1-us-east-2.connatix.com/tr/ Frame 89D9 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-1-us-east-2.connatix.com/tr/abt?v=157363
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.223.60.0 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-223-60-0.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Mon, 04 Apr 2022 13:01:01 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
show_ads_impl_with_ama_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203280101/ Frame 901A 		297 KB
106 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203280101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7500593236707325&plah=threatpost.com&bust=31065971
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a1e501c32fd16834ccafb815b04ef0133d5e2eef235996b29ef40b1345329476
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
108687
x-xss-protection
0
server
cafe
etag
12009476120517264993
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 04 Apr 2022 13:01:02 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20220330/r20190131/ Frame 0A09 		10 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20220330/r20190131/zrt_lookup.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0ce5fc08d0f617e71e1d61bcd79fc7cc1855f4221945b0c09ac774685fe7f52c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

age
48721
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=1209600
content-encoding
gzip
content-length
4502
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 03 Apr 2022 23:29:01 GMT
etag
4044455266028820542
expires
Sun, 17 Apr 2022 23:29:01 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
json
gum.criteo.com/sid/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fthreatpost.com%2F&domain=threatpost.com&cw=1&lsw=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://threatpost.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Mon, 04 Apr 2022 13:01:01 GMT
expires
0
pragma
no-cache
server-processing-duration-in-ticks
1750
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
sid
mug.criteo.com/ Frame D695
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fthreatpost.com%2F&domain=threatpost.com&cw=1&lsw=1
  • https://mug.criteo.com/sid?cpp=RMdY4nxhZERuWEJKTkkvdjFxWnBEMlVJYU1PSmZzVmw0NWt2SVQ4UFFSV3pSZ3g4MmVGNDgyUGI3Y1h4bnpWS3hiSldyM1pUNlBNRGdWVUJCVVFJY2g0dEF5ZW1QVTcrUFd2Y3BUYjVNNjJtQm9aZXBSK1BFVFBYMTRzdG...
353 B
620 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=RMdY4nxhZERuWEJKTkkvdjFxWnBEMlVJYU1PSmZzVmw0NWt2SVQ4UFFSV3pSZ3g4MmVGNDgyUGI3Y1h4bnpWS3hiSldyM1pUNlBNRGdWVUJCVVFJY2g0dEF5ZW1QVTcrUFd2Y3BUYjVNNjJtQm9aZXBSK1BFVFBYMTRzdGhUNnkwMnRCMmFIWnZrQ1VWOXM1b2Zlejk5NHcyUndiWHFjMzY0SzZBTFFxckVNbWIxbEVibnQ0cG83M1VGTDRqWnBBTnhhMkczU2xwTW53NWJNRjZZTVRHMFFad2ZxUlhNWi9JdDlJNG9KLzRTMmN1UmQwPXw&cppv=2
Protocol
H2
Server
178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
05a1d2c97dab86882c75625d3f8481b3764a3ba31d7e670578b68db56322747d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:02 GMT
content-encoding
gzip
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
2087
strict-transport-security
max-age=31536000; preload;
expires
0

Redirect headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:02 GMT
location
https://mug.criteo.com/sid?cpp=RMdY4nxhZERuWEJKTkkvdjFxWnBEMlVJYU1PSmZzVmw0NWt2SVQ4UFFSV3pSZ3g4MmVGNDgyUGI3Y1h4bnpWS3hiSldyM1pUNlBNRGdWVUJCVVFJY2g0dEF5ZW1QVTcrUFd2Y3BUYjVNNjJtQm9aZXBSK1BFVFBYMTRzdGhUNnkwMnRCMmFIWnZrQ1VWOXM1b2Zlejk5NHcyUndiWHFjMzY0SzZBTFFxckVNbWIxbEVibnQ0cG83M1VGTDRqWnBBTnhhMkczU2xwTW53NWJNRjZZTVRHMFFad2ZxUlhNWi9JdDlJNG9KLzRTMmN1UmQwPXw&cppv=2
strict-transport-security
max-age=31536000; preload;
access-control-allow-methods
GET
content-type
text/html; charset=utf-8
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
2039
content-length
482
expires
0
async_usersync.html
acdn.adnxs.com/dmp/ Frame DDF3 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
26800
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Mon, 04 Apr 2022 13:01:02 GMT
ETag
W/"623de86a-cf34"
Expires
Fri, 01 Apr 2022 05:34:16 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
1, 556948
X-Served-By
cache-lga21970-LGA, cache-hhn4050-HHN
X-Timer
S1649077262.307737,VS0,VE0
pd
u.openx.net/w/1.0/ Frame 2CE9 		668 B
717 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
2916b1da41266e7cc16ed5d7597fedbafcdf79a06a6e9d8d6c94e8a8d8ad1ee9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
418
content-type
text/html
date
Mon, 04 Apr 2022 13:01:02 GMT
p3p
CP="CUR ADM OUR NOR STA NID"
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
via
1.1 google
ixmatch.html
js-sec.indexww.com/um/ Frame 5A5E 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.225.98 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a72-247-225-98.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7c3b96f238042f73d0bedf5877fa02eb834e89649bbd122e2f10cc35238173cf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
1388
Content-Type
text/html; charset=UTF-8
Date
Mon, 04 Apr 2022 13:01:02 GMT
ETag
"e20015-b6b-5d84d0db0c30a"
Last-Modified
Fri, 18 Feb 2022 16:05:37 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Server
Apache
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame DED4 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.225.32 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a72-247-225-32.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges
bytes
cache-control
max-age=98377
content-encoding
gzip
content-length
5549
content-type
text/html; charset=UTF-8
date
Mon, 04 Apr 2022 13:01:02 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
expires
Tue, 05 Apr 2022 16:20:39 GMT
last-modified
Tue, 01 Feb 2022 06:38:00 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 0B08 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
26800
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Mon, 04 Apr 2022 13:01:02 GMT
ETag
W/"623de86a-cf34"
Expires
Fri, 01 Apr 2022 05:34:16 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
1, 538649
X-Served-By
cache-lga21970-LGA, cache-hhn4071-HHN
X-Timer
S1649077262.306116,VS0,VE0
pd
u.openx.net/w/1.0/ Frame E24D 		668 B
729 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
2916b1da41266e7cc16ed5d7597fedbafcdf79a06a6e9d8d6c94e8a8d8ad1ee9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
418
content-type
text/html
date
Mon, 04 Apr 2022 13:01:02 GMT
p3p
CP="CUR ADM OUR NOR STA NID"
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
via
1.1 google
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 2AC3 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.225.32 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a72-247-225-32.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges
bytes
cache-control
max-age=98377
content-encoding
gzip
content-length
5549
content-type
text/html; charset=UTF-8
date
Mon, 04 Apr 2022 13:01:02 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
expires
Tue, 05 Apr 2022 16:20:39 GMT
last-modified
Tue, 01 Feb 2022 06:38:00 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
ixmatch.html
js-sec.indexww.com/um/ Frame 0991 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.225.98 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a72-247-225-98.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7c3b96f238042f73d0bedf5877fa02eb834e89649bbd122e2f10cc35238173cf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
1388
Content-Type
text/html; charset=UTF-8
Date
Mon, 04 Apr 2022 13:01:02 GMT
ETag
"e20015-b6b-5d84d0db0c30a"
Last-Modified
Fri, 18 Feb 2022 16:05:37 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Server
Apache
Vary
Accept-Encoding
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1649077261614&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D39138%26time%3D1649077261614%26url%3Dhttps%253A%252F%252Fthreatpost.com%252Flog4j...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1649077261614&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&liSy...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1649077261614&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&liS...
0
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1649077261614&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&liSync=true&e_ipv6=AQJVs0f1R98uYwAAAX_0qhwJkgj1Rqfhz_UdH0TCbGn2u6cPUr6pl6efWV7viqEACwN0wMfV
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:03 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 1666361F5F734D0CBCE9BB323F5261EF Ref B: FRAEDGE0916 Ref C: 2022-04-04T13:01:03Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-proto
http/2
content-length
0
x-li-uuid
AAXb07iC16/4zpwqU0hOFg==
x-li-fabric
prod-lva1

Redirect headers

date
Mon, 04 Apr 2022 13:01:03 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 3A872A98A1A243B2A582F77B13AB716F Ref B: FRAEDGE1209 Ref C: 2022-04-04T13:01:03Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=39138&time=1649077261614&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&liSync=true&e_ipv6=AQJVs0f1R98uYwAAAX_0qhwJkgj1Rqfhz_UdH0TCbGn2u6cPUr6pl6efWV7viqEACwN0wMfV
x-li-proto
http/2
content-length
0
x-li-uuid
AAXb07h9Uk7EeOu2sWwqfA==
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame D553 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges
bytes
age
312
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 04 Apr 2022 12:55:50 GMT
expires
Tue, 04 Apr 2023 12:55:50 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame DD0F 		783 B
535 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
fa45be5f94ed67d5adbacd25e63380ec4f624801cf3be0f3755d024eeaeedfc7
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-PW+vVTmfuSxdUDi8JJu49w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=300
content-encoding
gzip
content-length
513
content-security-policy
script-src 'report-sample' 'nonce-PW+vVTmfuSxdUDi8JJu49w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Mon, 04 Apr 2022 13:01:02 GMT
expires
Mon, 04 Apr 2022 13:01:02 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
collect
www.google-analytics.com/g/ 		0
17 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-YP1JLG57CH&gtm=2oe3u0&_p=1595079605&sr=1600x1200&ul=en-us&cid=444449005.1649077256&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&dt=Log4JShell%20Used%20to%20Swarm%20VMware%20Servers%20with%20Miners%2C%20Backdoors%20%7C%20Threatpost&sid=1649077260&sct=1&seg=0&en=page_view&_fv=1&_ss=1&ep.pageType=other&ep.businessType=b2c&ep.siteType=Default&ep.siteClass=Websites&ep.siteLocale=%5BNULL%5D&ep.pageName=websites%20%3E%20log4jshell-swarm-vmware-servers-miners-backdoors%2F179142&ep.campaign=&ep.acCampaignId=&ep.omnitureVisitorId=88238087729275811294175148010201061015
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-YP1JLG57CH&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:02 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://threatpost.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=COWozMO7-vYCFdoHBgAdQtkOhA;src=9582686;type=globalc;cat=globa0;ord=2524034030170;gtm=2od3u0;auiddc=497573009.1649077262;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Flog4jshell-swarm...
9582686.fls.doubleclick.net/ Frame 286C
Redirect Chain
  • https://9582686.fls.doubleclick.net/activityi;src=9582686;type=globalc;cat=globa0;ord=2524034030170;gtm=2od3u0;auiddc=497573009.1649077262;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Flog4jshell-swa...
  • https://9582686.fls.doubleclick.net/activityi;dc_pre=COWozMO7-vYCFdoHBgAdQtkOhA;src=9582686;type=globalc;cat=globa0;ord=2524034030170;gtm=2od3u0;auiddc=497573009.1649077262;u1=B2C;u2=no_locale;u4=t...
705 B
489 B 		Document
General
Check archive.org
Download Go to
Full URL
https://9582686.fls.doubleclick.net/activityi;dc_pre=COWozMO7-vYCFdoHBgAdQtkOhA;src=9582686;type=globalc;cat=globa0;ord=2524034030170;gtm=2od3u0;auiddc=497573009.1649077262;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F;u6=;u7=88238087729275811294175148010201061015-444449005.1649077256;u9=_log4jshell-swarm-vmware-servers-miners-backdoors_179142_;~oref=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-9582686
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.16.134 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s06-in-f134.1e100.net
Software
cafe /
Resource Hash
c4636e5d625edef8957656051a5f7bd9f25d8a1c0d4071c864e808f84e3073b6
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
about:blank
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
gzip
content-length
466
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 04 Apr 2022 13:01:02 GMT
expires
Mon, 04 Apr 2022 13:01:02 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 04 Apr 2022 13:01:02 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://9582686.fls.doubleclick.net/activityi;dc_pre=COWozMO7-vYCFdoHBgAdQtkOhA;src=9582686;type=globalc;cat=globa0;ord=2524034030170;gtm=2od3u0;auiddc=497573009.1649077262;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F;u6=;u7=88238087729275811294175148010201061015-444449005.1649077256;u9=_log4jshell-swarm-vmware-servers-miners-backdoors_179142_;~oref=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
13jyvo1ofguz
hal9000.redintelligence.net/zone/ Frame BDC7 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hal9000.redintelligence.net/zone/13jyvo1ofguz?subid=&gdpr=0&gdpr_consent=&rnd=1661178487100975892&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:ruc&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3D1f328385c6725036ee24783edd71c25810098ea0_55%26mt_aid%3D1661178487100975892%26mt_id%3D10406295%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D9%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D0088624a-ec0e-4c01-8853-b63b47d1bc7e%26mt_cid%3D0088624a-ec0e-4c01-8853-b63b47d1bc7e%26mt_3pck%3Dhttps%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F1ae7566e-24ce-409a-945b-6cc4b4592ccf%2F%26redirect%3D
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.63.164 Reilingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.164.63.201.138.clients.your-server.de
Software
Apache /
Resource Hash
1e74ddf52d74a4db0641a3e669ef47c36189c0206c434ff6aa2880b44f648d50

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:02 GMT
Content-Encoding
gzip
Server
Apache
Connection
close
Content-Length
2960
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
ck-confirm
tags.mathtag.com/ Frame BDC7 		49 B
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tags.mathtag.com/ck-confirm?bid_id=1661178487100975892&node_id=357&exch_id=9
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.134.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.305.0 /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:02 GMT
Server
MMBD/3.305.0
Content-Type
image/gif
Cache-Control
no-cache
x-mm-host
cdg-router-x41, cdg-bidder-x54
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
49
Expires
Mon, 04 Apr 2022 13:01:01 GMT
img
pixel.mathtag.com/event/ Frame BDC7 		43 B
405 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=9&v2=1661178487100975892&v3=1129274&v4=11142481&v5=10406295&mt_nsync=1&no_attr=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.58.217.190 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-58-217-190.deploy.static.akamaitechnologies.com
Software
MT3 4320 2f2dfe5 master cdg-pixel-x26 config:1.0.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:02 GMT
Server
MT3 4320 2f2dfe5 master cdg-pixel-x26 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 04 Apr 2022 13:01:01 GMT
img
tags.mathtag.com/event/ Frame BDC7 		49 B
330 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tags.mathtag.com/event/img?type=mmImpTrack&exch=ruc&bid=1661178487100975892&st=11142481&time=1649077262&nodeid=357
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.134.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.305.0 /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:02 GMT
Server
MMBD/3.305.0
Content-Type
image/gif
Cache-Control
no-cache
x-mm-host
cdg-router-x104, cdg-bidder-x54
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
49
Expires
Mon, 04 Apr 2022 13:01:01 GMT
sd
eu-u.openx.net/w/1.0/ Frame E24D
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=398a624a-ec0e-4b01-a32f-29671dd4853d
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=398a624a-ec0e-4b01-a32f-29671dd4853d
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:02 GMT
via
1.1 google
server
OXGW/18.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Mon, 04 Apr 2022 13:01:02 GMT
Server
MT3 4320 2f2dfe5 master cdg-pixel-x25 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=398a624a-ec0e-4b01-a32f-29671dd4853d
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Mon, 04 Apr 2022 13:01:01 GMT
sd
us-u.openx.net/w/1.0/ Frame E24D
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&&val=95XsMqTE6Grsnutk9pH1a_KXumrslOsw-MGHFROi
43 B
122 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&&val=95XsMqTE6Grsnutk9pH1a_KXumrslOsw-MGHFROi
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:02 GMT
via
1.1 google
server
OXGW/18.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:02 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072956&&val=95XsMqTE6Grsnutk9pH1a_KXumrslOsw-MGHFROi
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame E24D
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8804791352649137698
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8804791352649137698
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
via
1.1 google
server
OXGW/18.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=8804791352649137698
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame E24D 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=1fc9ca81-d84c-7edf-f3f0-ce342576d7a8&gdpr=0
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame E24D 		170 B
243 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MzNhNjE5NGItMTEzYi0yMDdiLWU2MTAtOTQ4ZGVmOTQxOWM4
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame E24D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGDMuHtjrB9PflyXnCcgEpU&google_cver=1
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGDMuHtjrB9PflyXnCcgEpU&google_cver=1
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
via
1.1 google
server
OXGW/18.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGDMuHtjrB9PflyXnCcgEpU&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 2CE9
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
  • https://eu-u.openx.net/w/1.0/sd?id=536872786&val=398a624a-ec0e-4b01-a32f-29671dd4853d
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=398a624a-ec0e-4b01-a32f-29671dd4853d
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:02 GMT
via
1.1 google
server
OXGW/18.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Mon, 04 Apr 2022 13:01:02 GMT
Server
MT3 4320 2f2dfe5 master cdg-pixel-x27 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=398a624a-ec0e-4b01-a32f-29671dd4853d
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=360
Content-Length
0
Expires
Mon, 04 Apr 2022 13:01:01 GMT
sd
us-u.openx.net/w/1.0/ Frame 2CE9
Redirect Chain
  • https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072956&&val=95XsMqTE6Grsnutk9pH1a_KXumrslOsw-MGHFROi
43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072956&&val=95XsMqTE6Grsnutk9pH1a_KXumrslOsw-MGHFROi
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:02 GMT
via
1.1 google
server
OXGW/18.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:02 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072956&&val=95XsMqTE6Grsnutk9pH1a_KXumrslOsw-MGHFROi
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
sd
eu-u.openx.net/w/1.0/ Frame 2CE9
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=22
  • https://c1.adform.net/serving/cookie/match?CC=1&party=22
  • https://eu-u.openx.net/w/1.0/sd?id=537113484&val=3184545604644256536
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=3184545604644256536
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
via
1.1 google
server
OXGW/18.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
server
nginx
location
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=3184545604644256536
access-control-max-age
86400
access-control-allow-methods
GET
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
openx
match.adsrvr.org/track/cmf/ Frame 2CE9 		70 B
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/openx?oxid=1fc9ca81-d84c-7edf-f3f0-ce342576d7a8&gdpr=0
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 2CE9 		170 B
232 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MzNhNjE5NGItMTEzYi0yMDdiLWU2MTAtOTQ4ZGVmOTQxOWM4
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 2CE9
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGDMuHtjrB9PflyXnCcgEpU&google_cver=1
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGDMuHtjrB9PflyXnCcgEpU&google_cver=1
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/pd?gdpr=0&gdpr_consent=
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
via
1.1 google
server
OXGW/18.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEGDMuHtjrB9PflyXnCcgEpU&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sid
mug.criteo.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=RMdY4nxhZERuWEJKTkkvdjFxWnBEMlVJYU1PSmZzVmw0NWt2SVQ4UFFSV3pSZ3g4MmVGNDgyUGI3Y1h4bnpWS3hiSldyM1pUNlBNRGdWVUJCVVFJY2g0dEF5ZW1QVTcrUFd2Y3BUYjVNNjJtQm9aZXBSK1BFVFBYMTRzdGhUNnkwMnRCMmFIWnZrQ1VWOXM1b2Zlejk5NHcyUndiWHFjMzY0SzZBTFFxckVNbWIxbEVibnQ0cG83M1VGTDRqWnBBTnhhMkczU2xwTW53NWJNRjZZTVRHMFFad2ZxUlhNWi9JdDlJNG9KLzRTMmN1UmQwPXw&cppv=2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
null
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
null
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Mon, 04 Apr 2022 13:01:02 GMT
expires
0
pragma
no-cache
server-processing-duration-in-ticks
1909
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
async_usersync
ib.adnxs.com/ Frame 0B08 		0
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.87 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:02 GMT
X-Proxy-Origin
185.213.155.169; 185.213.155.169; 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
dff6eff2-feb4-4ecf-988f-5ea80383a62f
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame DDF3 		0
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.87 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:02 GMT
X-Proxy-Origin
185.213.155.169; 185.213.155.169; 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
46c33938-cb43-44f5-80a8-f0e9ad39de83
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 768E 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CIsiIC-xKYq2oO8LG7_UPrYWL0AvPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi00MTEzNjgxODgyMzExNDU1yAEJ4AIAqAMBqgSvAk_QiwJY09x2nTwn_8pWW1jnbN2fq9eWLbAnHPpoIq4BOuU9sPNw9QHbPNdt-lZVQ4-m_PUxvqYmNskevbb2T8yVzTXKx1KAzjibVRqhoHzGzR_IqTpUUWtbaQ_Lu6yJ0NebD8E1uqDJ_oUySPG3TYGKjIo4C8Yw8ES9JeLHhlQRCwWsqCIx5GYE4w69V4wpVGjWSnCU0nuT884e6k7u-l_4F7sBmlcSMqk6jQtjSA4CF0IrH67qhek71M_8vlQbF_YPzVeTHgr5KedfMT4EFXX9uwBC7M3hbgxqL7XtiVB5mNo6fe0-k0ssCq2zbbD9zrvOFS0eZCUkQA309qPHkGwBaXF9A0u7KECC-mo_h2j36vMMYS0SX8Y04a66MER950WEXQUEpJg5rqx4zNfIb-AEAYAGh-uT36LvmL9goAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBQiAYRABgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTQxMTM2ODE4ODIzMTE0NTUYhNt7&sigh=dKGWOt5D5Wg&uach_m=[UACH]&cid=CAQSPACNIrLMPPbW66EiQ8eA8lVNsU7Hj_MxoQwVMVVFT7yNL1POLn3e_HZPmPYq2m-OuaQYXSZ3HPABAUzx9hgB&tpd=AGWhJmtox0yU59uR5jnlzuULtVzFpeAV0bIHMo2QzIMPwgv8ESJu6vBPmuTWdxHd8r_Cl2ujR3952xhFLSueLGos7G2nxijAUQc5P9Nos5_M9hlD68tPBeulWXr_kBuFPIKTtEsLi87UcI2s2AugJdCVr0WqvBZiWQC_xtu1iRV32Kej1VHVAj30huy7lMk3-_b1nj8DwKUVu8-7hJ5kv8dSku5Yhybfpx55eT3nvVWOhya_7cWh33M5oJ4n0gNyIx_Lfu0_lZu4FHKUYUJvSuyaOhaXVGLSeVOtGgonR8bGY17vfE0FYnTyJEoaFchbtk_JiWyZwZbF-i3KdSPnPwG6voAB-_M6tLEWyAU0dzhJWslaufoLcy9X-lNbngSdkhtQtR5qFBfTq3tY_7hIBQdwqcTuzYK0fVPFE_tZUYO14g9VkUD0J6Nb6ro_DETlTWjeUgI-PY1zijqbeFte9L7DzqwbVzWNFiy4zDbWJXdvnedyD4WyPC4C6IP4T7a1HHAIddLj5H0tEUtLDR8zx4n9lIt1EZTTKYpsFZvUpqXfo2QDTSGZtwsrwmFmN7btioHzEvER1iJRBvrA_v_PkSCAkNfCvnnIAmH0LLWBnDpIey0XIKG-zvQ1lpIGiIOOpFq6xvnwWtF5Xy30uQkQvYziYflAT11PB-lVA45jjsvyta6zejZYqwlehLMR2cVfJMNysjvVizQfPCCYaDU7_6ntONHI6DuL6B8vab9QlsreN3pL0yzaKvKpfAxChPnHcxfn92S1eAr2Geb7gvCBjJxrWAT_9HdLn3CTKjjuPE2Lb49JMMUDBEvfDjRawK8uai9zbwOfHuN95cJhkKEkkcCvH3HwsXwnyzSsPZjYeXivOW0kbJDbfj2O7pLTkPTpwOJe6L_FValf8fAxo1CNk2-uSjn6R7zou6OQCFB9OYBivK-vQCVfotIP0Sue_aNru99UrACbo48XsXsvuceUtEk_6Af71dJVUCvcHdTYTq-YtcfI7yGpMs6jFznBs2TiM1Qa9BJbFZSfKOjQphJot7LRiLQlP-5eUEnS68ykHhwvcvIDbYxhwGnJxpisYSTzJD-Q7WYxDN0PvvrN78qVK3Gyv07yAvbRpDQbUBo
Requested by
Host: ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
URL: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers
ynpsxyk40ika
hal9000.redintelligence.net/zone/ Frame 768E 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hal9000.redintelligence.net/zone/ynpsxyk40ika?subid=&gdpr=0&gdpr_consent=&rnd=1661178506431296174&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYkrsDAABW44Iu-YCOg9BXA%26exch_seat%3D20035004448%26mt_aid%3D1661178506431296174%26mt_id%3D10406291%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D398a624a-ec0e-4b01-a32f-29671dd4853d%26mt_cid%3D398a624a-ec0e-4b01-a32f-29671dd4853d%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCmwTgC-xKYq2oO8LG7_UPrYWL0AvPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi00MTEzNjgxODgyMzExNDU1yAEJ4AIAqAMBqgSyAk_QiwJY09x2nTwn_8pWW1jnbN2fq9eWLbAnHPpoIq4BOuU9sPNw9QHbPNdt-lZVQ4-m_PUxvqYmNskevbb2T8yVzTXKx1KAzjibVRqhoHzGzR_IqTpUUWtbaQ_Lu6yJ0NebD8E1uqDJ_oUySPG3TYGKjIo4C8Yw8ES9JeLHhlQRCwWsqCIx5GYE4w69V4wpVGjWSnCU0nuT884e6k7u-l_4F7sBmlcSMqk6jQtjSA4CF0IrH67qhek71M_8vlQbF_YPzVeTHgr5KedfMT4EFXX9uwBC7M3hbgxqL7XtiVB5mNo6fe0-k0ssCq2zbbD9zrvOFS0eZCUkQA309qPHkGwBaXF9A0u7KEDA-EutK9RT7X6oKYbKH2nE_LqwjE5T_6Q5nUWrXjkngrTWVWvP4ph2fOAEAYAGh-uT36LvmL9goAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBQiAYRAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_1PpsWOEAqviAL_vGDxDUDGGKmU-w%2526client%253Dca-pub-4113681882311455%2526adurl%253D%26redirect%3D
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.63.164 Reilingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.164.63.201.138.clients.your-server.de
Software
Apache /
Resource Hash
014b24b9f921d57218038483c9fe91d034341795fdd1ed3e86af0a918c8d5dd8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:03 GMT
Content-Encoding
gzip
Server
Apache
Connection
close
Content-Length
3585
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
ck-confirm
tags.mathtag.com/ Frame 768E 		49 B
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tags.mathtag.com/ck-confirm?bid_id=1661178506431296174&node_id=719&exch_id=4
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.134.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.305.0 /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:03 GMT
Server
MMBD/3.305.0
Content-Type
image/gif
Cache-Control
no-cache
x-mm-host
cdg-router-x39, zrh-bidder-x72
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
49
Expires
Mon, 04 Apr 2022 13:01:02 GMT
img
pixel.mathtag.com/event/ Frame 768E 		43 B
438 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=4&v2=1661178506431296174&v3=1129274&v4=11142481&v5=10406291&mt_nsync=1&no_attr=1
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.58.217.190 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-58-217-190.deploy.static.akamaitechnologies.com
Software
MT3 4320 2f2dfe5 master cdg-pixel-x24 config:1.0.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:03 GMT
X-Akamai-Origin-Object-Size
43
Server
MT3 4320 2f2dfe5 master cdg-pixel-x24 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 04 Apr 2022 13:01:02 GMT
img
tags.mathtag.com/event/ Frame 768E 		49 B
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tags.mathtag.com/event/img?type=mmImpTrack&exch=adx&bid=1661178506431296174&st=11142481&time=1649077262&nodeid=719
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.134.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.305.0 /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:03 GMT
Server
MMBD/3.305.0
Content-Type
image/gif
Cache-Control
no-cache
x-mm-host
cdg-router-x90, zrh-bidder-x72
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
49
Expires
Mon, 04 Apr 2022 13:01:02 GMT
request.php
hal900018.redintelligence.net/ Frame BDC7
Redirect Chain
  • https://hal900018.redintelligence.net/request.php?zone=13jyvo1ofguz&nw=20&renderingType=javascript&namespace=0d816687fc&subid=&uid=facdb5ac1437de61&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
  • https://hal900018.redintelligence.net/request.php?zone=13jyvo1ofguz&nw=20&renderingType=javascript&namespace=0d816687fc&subid=&uid=facdb5ac1437de61&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
609 B
934 B 		Script
General
Check archive.org
Download Go to
Full URL
https://hal900018.redintelligence.net/request.php?zone=13jyvo1ofguz&nw=20&renderingType=javascript&namespace=0d816687fc&subid=&uid=facdb5ac1437de61&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aruc&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3D1f328385c6725036ee24783edd71c25810098ea0_55%26mt_aid%3D1661178487100975892%26mt_id%3D10406295%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D9%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D0088624a-ec0e-4c01-8853-b63b47d1bc7e%26mt_cid%3D0088624a-ec0e-4c01-8853-b63b47d1bc7e%26mt_3pck%3Dhttps%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F1ae7566e-24ce-409a-945b-6cc4b4592ccf%2F%26redirect%3D&documentReferer=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ancestorOrigins=https%3A%2F%2Fthreatpost.com&random=7228620978956&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Server
144.76.91.199 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.199.91.76.144.clients.your-server.de
Software
Apache /
Resource Hash
02a4f533291fddfe6e522debc6e84482e6dfe92e0e3ec82c1620df975db67a6c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:03 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId
72207300145112504380392011919018
Connection
close
Content-Type
application/x-javascript; charset=utf-8
Content-Length
328
Expires
Mon, 04 Apr 2022 14:01:03 +0200

Redirect headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:03 GMT
Server
Apache
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location
request.php?zone=13jyvo1ofguz&nw=20&renderingType=javascript&namespace=0d816687fc&subid=&uid=facdb5ac1437de61&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aruc&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3D1f328385c6725036ee24783edd71c25810098ea0_55%26mt_aid%3D1661178487100975892%26mt_id%3D10406295%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D9%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D0088624a-ec0e-4c01-8853-b63b47d1bc7e%26mt_cid%3D0088624a-ec0e-4c01-8853-b63b47d1bc7e%26mt_3pck%3Dhttps%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2F1ae7566e-24ce-409a-945b-6cc4b4592ccf%2F%26redirect%3D&documentReferer=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ancestorOrigins=https%3A%2F%2Fthreatpost.com&random=7228620978956&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control
no-store, no-cache, must-revalidate, max-age=0
Connection
close
Content-Type
text/html; charset=UTF-8
Content-Length
0
Expires
Mon, 04 Apr 2022 14:01:03 +0200
view
securepubads.g.doubleclick.net/pcs/ Frame 901A 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstxCQByAGtYME--dx0_2RdEWlewNiZ6LEiEtK9v6uqmNsnvZeKW6hKAKtN3TlA7C112GvGJ4kOPZW080_tIfTiUy9VuVvK5zrISc_m7gX1LW33CyBe8CjR7eM3ajpCFsOFIsrpt4gGsjcLgeTGxRR_bVLCyf4b8V0HBAnPMQ0_C4yiegHs-S8t3Axvp2Coc3-TCpz4lrT-gwTi-Q3Zoo-pNPhdkUy8xYXDATVmYvrgneRtSe2lwE7rfeQkZe1STvVHHhWLvuhEcGv-VDb2YmJbeeLnE3f_UKJ0hT-ciBjEB6uH4V3OdkqLGpsFxM1ZW0k9HmRo4Zo8&sig=Cg0ArKJSzFdoPh-V0fpjEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:01:03 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Mon, 04 Apr 2022 13:01:03 GMT
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 9788 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156858&gdpr=0&gdpr_consent=
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.225.32 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a72-247-225-32.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges
bytes
cache-control
max-age=98376
content-encoding
gzip
content-length
5549
content-type
text/html; charset=UTF-8
date
Mon, 04 Apr 2022 13:01:03 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
expires
Tue, 05 Apr 2022 16:20:39 GMT
last-modified
Tue, 01 Feb 2022 06:38:00 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 6001 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
26801
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Mon, 04 Apr 2022 13:01:03 GMT
ETag
W/"623de86a-cf34"
Expires
Fri, 01 Apr 2022 05:34:16 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
1, 556974
X-Served-By
cache-lga21970-LGA, cache-hhn4050-HHN
X-Timer
S1649077263.418413,VS0,VE0
pd
eu-u.openx.net/w/1.0/ Frame 1FBB 		542 B
358 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
3a08d2b1de76612fac62b55acb6ef3c43ee8596ac0033b156db08278c92602ed

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
339
content-type
text/html
date
Mon, 04 Apr 2022 13:01:03 GMT
p3p
CP="CUR ADM OUR NOR STA NID"
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
via
1.1 google
sync
eb2.3lift.com/ Frame FF71
Redirect Chain
  • https://eb2.3lift.com/sync?
  • https://eb2.3lift.com/sync?&ld=1
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://eb2.3lift.com/sync?&ld=1
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
60b1781f67ce46f0cfc0f96fdfae97843bfde0f26c98bc98450914baaffd654a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-length
460
content-type
text/html; charset=utf-8
date
Mon, 04 Apr 2022 13:01:03 GMT
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control
no-cache, no-store, must-revalidate
content-length
0
date
Mon, 04 Apr 2022 13:01:03 GMT
location
/sync?&ld=1
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 36ED
Redirect Chain
  • https://sync.serverbid.com/ss/2000891.html
  • https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
5 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.42 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
f3d66b78ca0c93adf48dec8533da3c4db538cc648dc60e383d5fd0b666859206
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=24511
Connection
Keep-Alive
Content-Length
4947
Content-Type
text/html
Date
Mon, 04 Apr 2022 13:01:03 GMT
Last-Modified
Wed, 20 Nov 2019 20:29:05 GMT
Vary
Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW
1649077263.dop245.am5.t,1649077263.cds129.am5.shn,1649077263.dop245.am5.t,1649077263.cds277.am5.c
age
0
etag
"1b0ebac83fe30af80513039edbdf566f"
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-request-id
tx000000000000010815c71-006249fa4e-14cff4ac-nyc3a
x-rgw-object-type
Normal

Redirect headers

cache-control
no-cache
content-length
0
location
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
sync.html
public.servenobid.com/ Frame 4825 		8 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://public.servenobid.com/sync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:46::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0849eef021b381cb3f64d424bdd29839513dbb4e964aef0420136906426a18de

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges
bytes
cache-control
max-age=86400
content-encoding
br
content-type
text/html
date
Mon, 04 Apr 2022 13:01:03 GMT
etag
"866b66bb3ccc5c8de41913672c69b8f7"
last-modified
Tue, 15 Mar 2022 23:39:48 GMT
server
AmazonS3
x-amz-id-2
Whw4gUaF5qRRhOMRwKptf7o3l9ebgSMjvbEzTldEI0EueT2RFJ+3BSTsvbolN0hYAMyfIX5wp5A=
x-amz-meta-codebuild-buildarn
arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:a4519585-d31b-4588-8499-6641ec459b43
x-amz-meta-codebuild-content-md5
d97b029b026ab1b5da9f71fc8f6cf19a
x-amz-meta-codebuild-content-sha256
1bd3623b950dcf081744ebf0150c6ff72edcc5cbd4a3ea8293d7f9c29b2e9c0b
x-amz-request-id
HXRZQT963RTZSQMT
x-azure-ref
0D+xKYgAAAABZfi6kL82kSaraB7OdtYErQkVSMzBFREdFMDQxNQA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref-originshield
0B9ZKYgAAAACZa7PyionRSpaoccUupXqQQU1TMDRFREdFMTkwOQA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-cache
TCP_HIT
ixmatch.html
js-sec.indexww.com/um/ Frame 361C 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js-sec.indexww.com/um/ixmatch.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.225.98 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a72-247-225-98.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7c3b96f238042f73d0bedf5877fa02eb834e89649bbd122e2f10cc35238173cf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
1388
Content-Type
text/html; charset=UTF-8
Date
Mon, 04 Apr 2022 13:01:03 GMT
ETag
"e20015-b6b-5d84d0db0c30a"
Last-Modified
Fri, 18 Feb 2022 16:05:37 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Server
Apache
Vary
Accept-Encoding
beacon
ap.lijit.com/ Frame 6572 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ap.lijit.com/beacon?informer=13394437
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx / raptor
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date
Mon, 04 Apr 2022 13:01:03 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Pragma
no-cache
Server
nginx
X-Powered-By
raptor
X-Sovrn-Pod
ad_ap3ams1
usync.html
eus.rubiconproject.com/ Frame 4D7C 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html
Requested by
Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Mon, 04 Apr 2022 13:01:03 GMT
ETag
"402b2-119-5d32342a551c0"
Last-Modified
Tue, 14 Dec 2021 23:07:59 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
st
capi-tier-1-us-east-2.connatix.com/tr/ Frame 89D9 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-1-us-east-2.connatix.com/tr/st?v=157363
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.223.60.0 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-223-60-0.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Mon, 04 Apr 2022 13:01:02 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
cookie.js
partner.googleadservices.com/gampad/ Frame 901A 		218 B
227 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=threatpost.com&callback=_gfp_s_&client=ca-pub-7500593236707325&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
ae2d5c94fe1def9e51e6497f11b21b9a00d549a9e398dc63b1f62245c189bce1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
205
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ Frame 901A 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:01:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ Frame 901A 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=threatpost.com
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:01:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 486F 		26 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ed9e77a7cc7d2301d9e4b5466db374c5da9adcfafdcdf9a9b125372aa96659cc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding
br
content-length
11652
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 04 Apr 2022 13:01:03 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
sodar
pagead2.googlesyndication.com/getconfig/ Frame 901A 		14 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220330&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203280101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-7500593236707325&plah=threatpost.com&bust=31065971
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
591993084654d5f4cc7653675191becd17764e7ec44340b8cb4e712f7231181c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:01:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10731
x-xss-protection
0
dc_pre=COWozMO7-vYCFdoHBgAdQtkOhA;src=9582686;type=globalc;cat=globa0;ord=2524034030170;gtm=2od3u0;auiddc=*;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Flog4jshell-swarm-vmware-servers-miners-backdo...
adservice.google.com/ddm/fls/z/ Frame 286C 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=COWozMO7-vYCFdoHBgAdQtkOhA;src=9582686;type=globalc;cat=globa0;ord=2524034030170;gtm=2od3u0;auiddc=*;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F;u6=;u7=88238087729275811294175148010201061015-444449005.1649077256;u9=_log4jshell-swarm-vmware-servers-miners-backdoors_179142_;~oref=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3
Requested by
Host: 9582686.fls.doubleclick.net
URL: https://9582686.fls.doubleclick.net/activityi;dc_pre=COWozMO7-vYCFdoHBgAdQtkOhA;src=9582686;type=globalc;cat=globa0;ord=2524034030170;gtm=2od3u0;auiddc=497573009.1649077262;u1=B2C;u2=no_locale;u4=threatpost.com;u5=%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F;u6=;u7=88238087729275811294175148010201061015-444449005.1649077256;u9=_log4jshell-swarm-vmware-servers-miners-backdoors_179142_;~oref=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3?
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://9582686.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame DD0F 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022032106&jk=1185834301470211&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers
dds
rtb.openx.net/sync/ Frame 1FBB 		43 B
350 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.openx.net/sync/dds
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
211.253.186.35.bc.googleusercontent.com
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-request-id
tui0dioam9gfn40q9uviok9grstsir0b
8b0eacc5-48e0-ec96-c227-d8c1da211ae1
pr-bh.ybp.yahoo.com/sync/openx/ Frame 1FBB 		43 B
987 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/openx/8b0eacc5-48e0-ec96-c227-d8c1da211ae1?gdpr=0
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:d29:3605:9f4c:83a8:7085:a009 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:03 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
content-type
image/gif
x-xss-protection
1; mode=block
content-length
43
x-content-type-options
nosniff
sd
eu-u.openx.net/w/1.0/ Frame 1FBB
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=OPENX&rurl=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072979%26val%3D_wfivefivec_
  • https://eu-u.openx.net/w/1.0/sd?id=537072979&val=FuM1Z2B31NBmkn5
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537072979&val=FuM1Z2B31NBmkn5
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
via
1.1 google
server
OXGW/18.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:04 GMT
Server
PingMatch/v2.0.30-713-gdae83a2#rel-ec2-master i-022b0454a7aa0bd60@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
Location
https://eu-u.openx.net/w/1.0/sd?id=537072979&val=FuM1Z2B31NBmkn5
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 1FBB
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=openx
  • https://x.bidswitch.net/ul_cb/sync?ssp=openx
  • https://r.scoota.co/sync?ssp=bidswitch&bidswitch_ssp_id=openx
  • https://r.scoota.co/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=openx
  • https://x.bidswitch.net/sync?dsp_id=29&expires=30&user_id=fb5ace67-5a3b-4989-bdd1-e25324821773&ssp=openx
  • https://us-u.openx.net/w/1.0/sd?id=537072968&val=61911d27-645c-4628-a192-91958e64f135&gdpr=&gdpr_consent=
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072968&val=61911d27-645c-4628-a192-91958e64f135&gdpr=&gdpr_consent=
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
via
1.1 google
server
OXGW/18.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
//us-u.openx.net/w/1.0/sd?id=537072968&val=61911d27-645c-4628-a192-91958e64f135&gdpr=&gdpr_consent=
Date
Mon, 04 Apr 2022 13:01:04 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
sd
eu-u.openx.net/w/1.0/ Frame 1FBB
Redirect Chain
  • https://ib.adnxs.com/getuid?https://eu-u.openx.net/w/1.0/sd?id=537072399&val=$UID
  • https://eu-u.openx.net/w/1.0/sd?id=537072399&val=8615746979499682240
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-u.openx.net/w/1.0/sd?id=537072399&val=8615746979499682240
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
via
1.1 google
server
OXGW/18.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:03 GMT
X-Proxy-Origin
185.213.155.169; 185.213.155.169; 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
4fcb36d0-89f7-4a2f-9d5d-0d2c2f8aa514
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://eu-u.openx.net/w/1.0/sd?id=537072399&val=8615746979499682240
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
redir
rtb-csync.smartadserver.com/ Frame 1FBB
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/ox
  • https://match.prod.bidr.io/cookie-sync/ox?_bee_ppp=1
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFERzFFN0VsZGdBQURjNEQzUlZhUQ&bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&b...
  • https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=pm%2Csas%2Cpp%2Cox&bee_sync_current_partner=adx&bee_sync_initiator=ox&bee_sync_hop_count=1
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AADG1E7EldgAADc4D3RVaQ&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3...
  • https://match.prod.bidr.io/cookie-sync?bee_sync_partners=sas%2Cpp%2Cox&bee_sync_current_partner=pm&bee_sync_initiator=adx&bee_sync_hop_count=2
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AADG1E7EldgAADc4D3RVaQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_curre...
43 B
163 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AADG1E7EldgAADc4D3RVaQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID
Requested by
Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Protocol
HTTP/1.1
Server
185.86.137.131 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eu-u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
transfer-encoding
chunked
content-type
image/gif

Redirect headers

location
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AADG1E7EldgAADc4D3RVaQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fbee_sync_partners%3Dpp%252Cox%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID
Date
Mon, 04 Apr 2022 13:01:04 GMT
Server
nginx
Connection
keep-alive
Content-Length
0
strict-transport-security
max-age=2592000; includeSubDomains
usync.js
eus.rubiconproject.com/ Frame 4D7C 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
b7781f6fa62c80c336671d895754a77ce8d0f5e9fe30e0b1f40d08c66261408b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:03 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 16:28:01 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=10072
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9541
Expires
Mon, 04 Apr 2022 15:48:55 GMT
generic
match.adsrvr.org/track/cmf/ Frame FF71 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=1&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame FF71
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&gdpr=1&cmp_cs=
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMwMTY5MTgxMTIxNzIwMjk5MDczNw%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMwMTY5MTgxMTIxNzIwMjk5MDczNw%3D%3D
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H3
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMwMTY5MTgxMTIxNzIwMjk5MDczNw%3D%3D
date
Mon, 04 Apr 2022 13:01:03 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
pixel
cm.g.doubleclick.net/ Frame FF71 		170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=1&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame FF71
Redirect Chain
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=1&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMwMTY5MTgxMTIxNzIwMjk5MDczNw%3D%3D
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMwMTY5MTgxMTIxNzIwMjk5MDczNw%3D%3D
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H3
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMwMTY5MTgxMTIxNzIwMjk5MDczNw%3D%3D
date
Mon, 04 Apr 2022 13:01:03 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
setuid
px.ads.linkedin.com/ Frame FF71 		0
141 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=3301691811217202990737&dbredirect=true&gdpr=1&consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:03 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: BD46B7AD5F5E4285A662230843D7CD6B Ref B: FRAEDGE1209 Ref C: 2022-04-04T13:01:03Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAXb07iG8RYEpOtEL4oLqQ==
xuid
eb2.3lift.com/ Frame FF71
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/3301691811217202990737?gdpr=1&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-k9JTOtBE2oQAvkIrKpMJAySQslvgLoQCz3N_S5U2Zw--~A&dongle=0883
37 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2662&xuid=y-k9JTOtBE2oQAvkIrKpMJAySQslvgLoQCz3N_S5U2Zw--~A&dongle=0883
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Server
13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

date
Mon, 04 Apr 2022 13:01:03 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://eb2.3lift.com/xuid?mid=2662&xuid=y-k9JTOtBE2oQAvkIrKpMJAySQslvgLoQCz3N_S5U2Zw--~A&dongle=0883
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
sync
x.bidswitch.net/ Frame FF71 		43 B
220 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/sync?ssp=triplelift&user_id=3301691811217202990737&gdpr=1&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.122.58.191 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-122-58-191.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:03 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
c.gif
c.bing.com/ Frame FF71 		42 B
594 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.bing.com/c.gif?xid=3301691811217202990737&Red3=TLMS_pd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:03 GMT
etag
"8120eaf0ff3ad81:0"
last-modified
Fri, 18 Mar 2022 19:39:54 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B83F8DCA393A44AD959FF65B3058C27D Ref B: FRAEDGE1214 Ref C: 2022-04-04T13:01:03Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42
iu3
s.amazon-adsystem.com/ Frame FF71
Redirect Chain
  • https://s.amazon-adsystem.com/x/757c0557066e95cfd4c7?gdpr=1&gdpr_consent=&uid=3301691811217202990737
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=3301691811217202990737&dcc=t
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=3301691811217202990737&dcc=t
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
HTTP/1.1
Server
209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Redirect headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:04 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
EXXM113KRSMHJB1TFCMH
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&dl=3lift&gdpr=1&gdpr_consent=&uid=3301691811217202990737&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
xuid
eb2.3lift.com/ Frame FF71
Redirect Chain
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=1&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
37 B
139 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?&ld=1
Protocol
H2
Server
13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif

Redirect headers

Location
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=1
Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:04 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Content-Length
95
Content-Type
text/html; charset=utf-8
V_I9kkE0weacsZYJ7hXHsf1U2l7Bs5zHQi7wjQJaUfA.js
pagead2.googlesyndication.com/bg/ Frame D553 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/V_I9kkE0weacsZYJ7hXHsf1U2l7Bs5zHQi7wjQJaUfA.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
57f23d924134c1e69cb19609ee15c7b1fd54da5ec1b39cc7422ef08d025a51f0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 07:39:24 GMT
content-encoding
br
x-content-type-options
nosniff
age
19299
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13731
x-xss-protection
0
last-modified
Mon, 28 Mar 2022 10:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 04 Apr 2023 07:39:24 GMT
request.php
hal900029.redintelligence.net/ Frame 768E 		613 B
935 B 		Script
General
Check archive.org
Download Go to
Full URL
https://hal900029.redintelligence.net/request.php?zone=ynpsxyk40ika&nw=20&renderingType=javascript&namespace=c5208f21c8&subid=&uid=f1fb6912db3ef5a3&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x600&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=0&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DYkrsDAABW44Iu-YCOg9BXA%26exch_seat%3D20035004448%26mt_aid%3D1661178506431296174%26mt_id%3D10406291%26mt_adid%3D215543%26mt_sid%3D11142481%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D398a624a-ec0e-4b01-a32f-29671dd4853d%26mt_cid%3D398a624a-ec0e-4b01-a32f-29671dd4853d%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCmwTgC-xKYq2oO8LG7_UPrYWL0AvPh46bXMCG2YLGAsCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi00MTEzNjgxODgyMzExNDU1yAEJ4AIAqAMBqgSyAk_QiwJY09x2nTwn_8pWW1jnbN2fq9eWLbAnHPpoIq4BOuU9sPNw9QHbPNdt-lZVQ4-m_PUxvqYmNskevbb2T8yVzTXKx1KAzjibVRqhoHzGzR_IqTpUUWtbaQ_Lu6yJ0NebD8E1uqDJ_oUySPG3TYGKjIo4C8Yw8ES9JeLHhlQRCwWsqCIx5GYE4w69V4wpVGjWSnCU0nuT884e6k7u-l_4F7sBmlcSMqk6jQtjSA4CF0IrH67qhek71M_8vlQbF_YPzVeTHgr5KedfMT4EFXX9uwBC7M3hbgxqL7XtiVB5mNo6fe0-k0ssCq2zbbD9zrvOFS0eZCUkQA309qPHkGwBaXF9A0u7KEDA-EutK9RT7X6oKYbKH2nE_LqwjE5T_6Q5nUWrXjkngrTWVWvP4ph2fOAEAYAGh-uT36LvmL9goAYhqAeKmLECqAemvhuoB5bYG6gHqpuxAqgH35-xAtgHANIIBQiAYRAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_1PpsWOEAqviAL_vGDxDUDGGKmU-w%2526client%253Dca-pub-4113681882311455%2526adurl%253D%26redirect%3D&documentReferer=https%3A%2F%2Fthreatpost.com%2F&ancestorOrigins=https%3A%2F%2Fthreatpost.com&random=3520019953259&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.174.219.99.88.clients.your-server.de
Software
Apache /
Resource Hash
d613258b7f3d911a83031987bc5fc9f017bbdf9c789f7a6973103eb4ccae68f8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:03 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control
no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId
58495700119238404380388011919029
Connection
close
Content-Type
application/x-javascript; charset=utf-8
Content-Length
329
Expires
Mon, 04 Apr 2022 14:01:03 +0200
async_usersync
ib.adnxs.com/ Frame 6001 		0
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.87 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:03 GMT
X-Proxy-Origin
185.213.155.169; 185.213.155.169; 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
2f2b75bc-2b6e-470e-aec4-cc3630f1c14b
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 901A 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 04 Apr 2022 13:01:03 GMT
async_usersync
ib.adnxs.com/ Frame 0B08 		0
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.87 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:03 GMT
X-Proxy-Origin
185.213.155.169; 185.213.155.169; 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
c7d17797-c600-46b3-9b90-3f4ce2f4c4dc
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame DDF3 		0
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.87 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:03 GMT
X-Proxy-Origin
185.213.155.169; 185.213.155.169; 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
f918dcba-0b29-4290-9541-504749d4a754
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
13926
g2.gumgum.com/usync/ Frame E4F5 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
118cabdfcdef519c01c13bdd1d6e922fe838d3b0b33dd26c989d90873e9da415

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

content-encoding
gzip
content-type
text/html;charset=UTF-8
date
Mon, 04 Apr 2022 13:01:04 GMT
etag
W/"02e94c2d25f08ead0eba8357097212873"
server
nginx
timing-allow-origin
*
ps
pixel.33across.com/ Frame DF72 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
67.202.105.21 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ip21.67-202-105.static.steadfastdns.net
Software
33XP004 /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
server
33XP004
x-33x-status
2000208
/
onetag-sys.com/usync/ Frame 9EF0 		2 KB
814 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip254.ip-51-89-9.eu
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
content-type
text/html
strict-transport-security
max-age=15552000
sync
ssbsync.smartadserver.com/api/ Frame 22E3 		1017 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.137.108 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
3d8e43748397c9055cd5d0ff5cd81e31865c9e3f7914457091976107f5def3e7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

content-length
1017
content-type
text/html
date
Mon, 04 Apr 2022 13:01:03 GMT
usermatch
ssum-sec.casalemedia.com/ Frame 03A2
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.225.98 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a72-247-225-98.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
90d444d71168eb54a5d30205b0878d181e9041d13a4ccac78c9ab1cdfcf596e4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
1773
Content-Type
text/html
Date
Mon, 04 Apr 2022 13:01:04 GMT
Dropped-Udsids
241|39|45|230|88|47|90|196
Expires
Mon, 04 Apr 2022 13:01:04 GMT
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma
no-cache
Server
Apache
Vary
Is-Traffic-Usersync

Redirect headers

Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
311
Content-Type
text/html; charset=iso-8859-1
Date
Mon, 04 Apr 2022 13:01:04 GMT
Expires
Mon, 04 Apr 2022 13:01:04 GMT
Location
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma
no-cache
Server
Apache
sync
ads.servenobid.com/ Frame 4825
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
  • https://ads.servenobid.com/sync?pid=312&uid=8615746979499682240
0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=312&uid=8615746979499682240
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
54.154.244.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-154-244-32.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:03 GMT
X-Proxy-Origin
185.213.155.169; 185.213.155.169; 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
d2f171d0-6d70-4614-9a94-c720b56aa179
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ads.servenobid.com/sync?pid=312&uid=8615746979499682240
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sync
ads.servenobid.com/ Frame 4825
Redirect Chain
  • https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
  • https://ads.servenobid.com/sync?pid=310&uid=ecc0e880e0d35add66c56dac
0
347 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=310&uid=ecc0e880e0d35add66c56dac
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
54.154.244.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-154-244-32.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:04 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Location
https://ads.servenobid.com/sync?pid=310&uid=ecc0e880e0d35add66c56dac
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap2ams1
Content-Length
0
Expires
Fri, 20 Mar 2009 00:00:00 GMT
pixel
ap.lijit.com/ Frame 4825 		0
277 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Mon, 04 Apr 2022 13:01:03 GMT
Access-Control-Allow-Credentials
true
X-Sovrn-Pod
ad_ap3ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
rmpssp
sync.1rx.io/usersync2/ Frame 4825
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
  • https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1649077264605
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1649077264605
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
213.19.147.45 Utrecht, Netherlands, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Redirect headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
server
Tengine
etag
RXa248afa19ddd44a5826e6710d81f89a3003
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1649077264605
cache-control
no-store, no-cache, must-revalidate
content-type
text/html
expires
0
sync
ads.servenobid.com/ Frame 4825
Redirect Chain
  • https://p.rfihub.com/cm?pub=44007&in=1
  • https://ads.servenobid.com/sync?pid=324&uid=5133329520874020148
0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=324&uid=5133329520874020148
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
54.154.244.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-154-244-32.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

Location
https://ads.servenobid.com/sync?pid=324&uid=5133329520874020148
Date
Mon, 04 Apr 2022 13:01:04 GMT
Server
Jetty(9.3.29.v20201019)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
usa
sync.go.sonobi.com/ Frame 4825 		0
474 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:04 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-9
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
sync
ads.servenobid.com/ Frame 4825
Redirect Chain
  • https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
  • https://ads.servenobid.com/sync?pid=327&uid=98208ee0-12fe-4234-b79d-199a00d6b88b&gdpr=0&gdpr_consent=&us_privacy=1YN-
0
356 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=327&uid=98208ee0-12fe-4234-b79d-199a00d6b88b&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
54.154.244.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-154-244-32.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

location
https://ads.servenobid.com/sync?pid=327&uid=98208ee0-12fe-4234-b79d-199a00d6b88b&gdpr=0&gdpr_consent=&us_privacy=1YN-
date
Mon, 04 Apr 2022 13:01:03 GMT
cache-control
max-age=0, private, must-revalidate
x-envoy-upstream-service-time
1
server
envoy
content-length
0
sync
ads.servenobid.com/ Frame 4825
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58559/occ
  • https://ups.analytics.yahoo.com/ups/58559/occ?verify=true
  • https://ads.servenobid.com/sync?pid=337&uid=y-Nfn2Zb9E2uHDl8SDkvCzSG8ow.6IQzs9tu_AmIg-~A
0
366 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=337&uid=y-Nfn2Zb9E2uHDl8SDkvCzSG8ow.6IQzs9tu_AmIg-~A
Requested by
Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol
H2
Server
54.154.244.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-154-244-32.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://public.servenobid.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0

Redirect headers

location
https://ads.servenobid.com/sync?pid=337&uid=y-Nfn2Zb9E2uHDl8SDkvCzSG8ow.6IQzs9tu_AmIg-~A
date
Mon, 04 Apr 2022 13:01:04 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
request_content.php
hal900018.redintelligence.net/ Frame 7DAE 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hal900018.redintelligence.net/request_content.php?s=72207300145112504380392011919018&a=572c741f
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
144.76.91.199 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.199.91.76.144.clients.your-server.de
Software
Apache /
Resource Hash
a856921ec103f775728e2327336f39eb61c04f4605e537fc8e81710eb5a1c934

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Cache-Control
no-store, no-cache, must-revalidate, max-age=0
Connection
close
Content-Encoding
gzip
Content-Length
1524
Content-Type
text/html; charset=utf-8
Date
Mon, 04 Apr 2022 13:01:03 GMT
Expires
Mon, 04 Apr 2022 14:01:03 +0200
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma
no-cache
Server
Apache
Vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame 1E28 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?&gdpr=0&geo=eu&co=de
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Mon, 04 Apr 2022 13:01:03 GMT
ETag
"402b2-119-5d32342a551c0"
Last-Modified
Tue, 14 Dec 2021 23:07:59 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
view
securepubads.g.doubleclick.net/pcs/ Frame BDC7 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst_9W4X4-REQGj97UJh885KIUU7VQTwDkNuQ6-WDjh-gC1oEBSEsu5Vyb-m7IAjFypBJJRgL4zuhNKHCM70g0OYtOtf2PyVk1ZyAcHanG4NOCvTeiv6yMhb0UebvEJ4mR1Rr_0xxfUGOFI1wvMVJTmowU5m39XrsUjIXe0jGIYuDQDsirM9SN9PrfCzXsvn2E2NcHxrPWJbAtfiYcv9CvKrV8ELeAfkD8NeWFS9su8fJCMKL5kPehSsPsczmO1ejDBNPvP9BPfwMqjTHYtrwyPEEaT-47G8qaX4Bvr6J18VWHTxwnbxIyL8Zu6e-5OsMr1PUfbrG5pE&sig=Cg0ArKJSzFEvWcvgC39XEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s56-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
date
Mon, 04 Apr 2022 13:01:04 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Mon, 04 Apr 2022 13:01:04 GMT
truncated
/ Frame BDC7 		215 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b9c6bb98a7e0817caa24fd161dc04b9300fe124056cd912d9246785ca944917c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type
image/png
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame 486F 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/window_focus_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 12:54:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
412
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1233
x-xss-protection
0
server
cafe
etag
16517525077337815633
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 18 Apr 2022 12:54:12 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 486F 		119 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d593fdf64289375adaa96b87ebf4c4beec2995d730e3601254e0a226808bfe57
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36916
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1648640521462251"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 04 Apr 2022 13:01:04 GMT
qs_click_protection_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/ Frame 486F 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220330/r20110914/client/qs_click_protection_fy2019.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 12:57:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
193
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6407
x-xss-protection
0
server
cafe
etag
6055885685211612390
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Mon, 18 Apr 2022 12:57:51 GMT
l
www.google.com/ads/measurement/ Frame 486F 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaT_FPK8ForZ-Yj9y7o1Y8SSjqouyPSRDGhHERLShJEWfTHa-b-GHczaj15_iuaKW9fgKAxriu5gTVTH9wmHoSNWJPF_iw
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers
adview
googleads.g.doubleclick.net/pagead/ Frame 486F 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=C0O_zD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE8wFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsU9fNtOeHA8GwMclT3_Qbi-90j2bqWPG-uIdzsW95EBbifuFy2vOOABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBABgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTc1MDA1OTMyMzY3MDczMjUYAA&sigh=WhPWzlv-4zE&uach_m=[UACH]&cid=CAQSPACNIrLMcbTcLpwinS_x3w1E1eJc3tISqn9r7KGzGup4mjVw_9kfX2ypRSq2uKZHEinB0KoTiBA4UCmPTRgB
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

timing-allow-origin
*
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
date
Mon, 04 Apr 2022 13:01:04 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
winResponse
prod-rtb.ad4mat.net/ Frame 486F 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prod-rtb.ad4mat.net/winResponse?a=1g97qn5dnnq7przvjyma5ntccw3ert37d04tg2w11x60mh665hmrpaypvcjy5h7ayq779b551908xvjwxaxh92dz67thnnxymvkv2gs872apdck1tqwneerp96b2p8jb9d25rx7ptxhz5kpwzd072x8bgv55ma2ptmxbwyj9zskma5hqe800y10hjjd866at39cx8ycx4ktnk3emet6x708avyzempfyc58tgn1kzwhe4qj2927smzvg2mrxjkeexsc84atmtr631mtk5m36mjntxhp4ew3r88jv8840z0strv75rveakeevfs0jjvyhfja54nj2qerpppcwperb2ck9nq9asqh75hzpmkag08j6y2s1548ec459qv9xqrm53vt61v31198g4nnj6s38csdt6cs9c&b=YkrsDwAJMBoKcbwyAA7s330a8D1baNrpIizYnA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:0:76b9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 04 Apr 2022 13:01:04 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-type
image/gif
dr
as.ad4m.at/ad/ Frame B211 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/dr?ed=1ka67n0wb4ryt38nr6jvz03qh4rhkb2yv6a2kpefbj3qz421jddy5e0bqb0nwsdsfbkt5teajbbdjka9vab1v2150ampzz8vc900cy1dve9mqhd8p9xxedzaarm8rh1nvmj53x9hgy8w526s4pvfbb7w2m882rgnq1wv6jqwgm3e6052rhkwqvgd0y853s1pdnx5qdx9jga2ggcyvx8xny9wnb240x9sz33f8yje6cs99d6feb189haevj3w781awkpkcr10fbe835513x5eeva96hc9t4bhxz54d4yc6z4kkrk20v0nhtmbj94fyyprm45wmfdw2xwxqzs07mbx5wbqa27my3d6r2k2h1mesc7da6byq9489eqpt8yv6291zjb5s6t7wvk7tty35sp9kb5036fyeypfy7h25z6zn4rtphttzcp88&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%26client%3Dca-pub-7500593236707325%26adurl%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
69fe3507454103e0f80720546a11348be584f70823b74e81d132d47438efc9d2
Security Headers
Name Value
Content-Security-Policy block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
6f6a3b0639069be6-FRA
content-encoding
br
content-security-policy
block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
unsafe-none
cross-origin-opener-policy
unsafe-none
cross-origin-resource-policy
cross-origin
date
Mon, 04 Apr 2022 13:01:04 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
0
feature-policy
geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
pragma
no-cache
referrer-policy
same-origin
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
server
cloudflare
strict-transport-security
max-age=86400; includeSubDomains; preload
surrogate-control
no-store
vary
accept-encoding
via
1.1 google
x-content-type-options
nosniff
x-download-options
noopen
x-xss-protection
1; mode=block
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame B3BA 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

age
25640
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=86400
content-encoding
gzip
content-length
724
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 04 Apr 2022 05:53:44 GMT
etag
48472445140208031
expires
Tue, 05 Apr 2022 05:53:44 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
um
cs.emxdgt.com/ Frame 3246 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cs.emxdgt.com/um?ssp=pbs&redirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D44%26userId%3D%24UID
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

content-length
0
content-type
text/html
date
Mon, 04 Apr 2022 13:01:03 GMT
usync.html
eus.rubiconproject.com/ Frame 2459
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=17632&endpoint=us-east
  • https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Mon, 04 Apr 2022 13:01:04 GMT
ETag
"402b2-119-5d32342a551c0"
Last-Modified
Tue, 14 Dec 2021 23:07:59 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Mon, 04 Apr 2022 13:01:04 GMT
location
https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
server
AkamaiGHost
uc.html
go.sonobi.com/ Frame E832 		43 B
575 B 		Document
General
Check archive.org
Download Go to
Full URL
https://go.sonobi.com/uc.html?pubid=e55fb5d7c2
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.148 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1.go.sonobi.com
Software
sonobi-go /
Resource Hash
bcdf010ba3dc61605c33de9b33e7e76dbc3bb4326dcec49f33970345e517fb25
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Cache-Control
no-cache, no-store, private
Content-Encoding
gzip
Content-Type
text/html
Date
Mon, 04 Apr 2022 13:01:04 GMT
Expires
Sat, 26 Jul 1997 05:00:00 GMT
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Pragma
no-cache
Server
sonobi-go
Tcn
Choice
Transfer-Encoding
chunked
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-8
X-Xss-Protection
0
cm
gift-connect-d.openx.net/w/1.0/ Frame FFD1 		0
83 B 		Document
General
Check archive.org
Download Go to
Full URL
https://gift-connect-d.openx.net/w/1.0/cm?id=fd531c74-f5ed-4e60-8874-939fb2acafa1&r=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D19%26userId%3D
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/18.0.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
20
content-type
text/html
date
Mon, 04 Apr 2022 13:01:04 GMT
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
via
1.1 google
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 6B02 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156319&userIdMacro=PM_UID&predirect=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D4%26userId%3DPM_UID
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.225.32 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a72-247-225-32.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges
bytes
cache-control
max-age=98375
content-encoding
gzip
content-length
5549
content-type
text/html; charset=UTF-8
date
Mon, 04 Apr 2022 13:01:04 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
expires
Tue, 05 Apr 2022 16:20:39 GMT
last-modified
Tue, 01 Feb 2022 06:38:00 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
i.gif
e.serverbid.com/udb/9969/sync/ Frame 36ED
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D28%26userId%3D%24UID
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=8615746979499682240
43 B
294 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=8615746979499682240
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
206.189.254.17 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0

Redirect headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:04 GMT
X-Proxy-Origin
185.213.155.169; 185.213.155.169; 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
234dc3b5-44d3-4b7c-96f9-803ab1a52c7e
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=28&userId=8615746979499682240
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
i.gif
e.serverbid.com/udb/9969/sync/ Frame 36ED
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=185073&cb=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D1%26userId%3D
  • https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D1%26userId%3D&s=185073&C=1
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=YkrsEIZYLJzLV1osrv.wvQAA%261143
43 B
294 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=YkrsEIZYLJzLV1osrv.wvQAA%261143
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
206.189.254.17 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0

Redirect headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:04 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=1&userId=YkrsEIZYLJzLV1osrv.wvQAA%261143
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
282
Expires
Mon, 04 Apr 2022 13:01:04 GMT
i.gif
e.serverbid.com/udb/9969/sync/ Frame 36ED
Redirect Chain
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fe.serverbid.com%2Fudb%2F9969%2Fsync%2Fi.gif%3FpartnerId%3D24%26userId%3D%24UID
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=ecc0e880e0d35add66c56dac
43 B
294 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=ecc0e880e0d35add66c56dac
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
206.189.254.17 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0

Redirect headers

Date
Mon, 04 Apr 2022 13:01:04 GMT
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=24&userId=ecc0e880e0d35add66c56dac
Access-Control-Allow-Credentials
true
Connection
close
X-Sovrn-Pod
ad_ap3ams1
Access-Control-Allow-Headers
X-Requested-With, Content-Type
usa
sync.go.sonobi.com/ Frame 36ED 		0
478 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/usa?https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=38&userId=
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.149 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:04 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/plain; charset=utf8
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
i.gif
e.serverbid.com/udb/9969/sync/ Frame 36ED
Redirect Chain
  • https://pixel.advertising.com/ups/56621/occ
  • https://pixel.advertising.com/ups/56621/occ?verify=true
  • https://ups.analytics.yahoo.com/ups/56621/occ?apid=UP48fcb14d-b417-11ec-a461-02c4a1bc5354
  • https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP48fcb14d-b417-11ec-a461-02c4a1bc5354
43 B
294 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP48fcb14d-b417-11ec-a461-02c4a1bc5354
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
H2
Server
206.189.254.17 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0

Redirect headers

location
https://e.serverbid.com/udb/9969/sync/i.gif?partnerId=29&userId=UP48fcb14d-b417-11ec-a461-02c4a1bc5354
date
Mon, 04 Apr 2022 13:01:04 GMT
server
ATS/9.1.0.33
age
0
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
us.gif
sync.go.sonobi.com/ Frame 36ED
Redirect Chain
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fsync.go.sonobi.com%2Fus.gif%3Fnw%3Dco%26nuid%3D
  • https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-a488ff72-6761-4746-a867-7bd37bcdf906
49 B
513 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-a488ff72-6761-4746-a867-7bd37bcdf906
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Server
178.162.133.149 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-sync.go.sonobi.com
Software
sonobi-go /
Resource Hash
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:04 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
xcp-ams-1-7-129
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
image/gif
Content-Length
49
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://sync.go.sonobi.com/us.gif?nw=co&nuid=ue1-sb1-a488ff72-6761-4746-a867-7bd37bcdf906
cache-control
no-cache
content-length
0
56939
i6.liadm.com/s/ Frame 36ED
Redirect Chain
  • https://e.serverbid.com/udb/9969/match?redir=https%3A%2F%2Fi.liadm.com%2Fs%2F56939%3Fbidder_id%3D203802%26bidder_uuid%3D
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-a488ff72-6761-4746-a867-7bd37bcdf906
  • https://i.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-a488ff72-6761-4746-a867-7bd37bcdf906&_li_chk=true&previous_uuid=04daad812d0e4038bceb3e87f0910835
  • https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-a488ff72-6761-4746-a867-7bd37bcdf906
43 B
419 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-a488ff72-6761-4746-a867-7bd37bcdf906
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Server
2600:1f18:444a:4602:2c20:3113:5c28:1366 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:05 GMT
Cache-Control
no-store
Connection
keep-alive
Content-Length
43
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/56939?bidder_id=203802&bidder_uuid=ue1-sb1-a488ff72-6761-4746-a867-7bd37bcdf906
Date
Mon, 04 Apr 2022 13:01:05 GMT
Connection
keep-alive
Content-Length
0
Strict-Transport-Security
max-age=31536000; includeSubDomains
request_content.php
hal900029.redintelligence.net/ Frame 8E36 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hal900029.redintelligence.net/request_content.php?s=58495700119238404380388011919029&a=b54eb72a
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.174.219.99.88.clients.your-server.de
Software
Apache /
Resource Hash
7ff5a06daa51558452cabcb83bf4c7aafd0be8abc6ce98d027496776b1cacdaf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Cache-Control
no-store, no-cache, must-revalidate, max-age=0
Connection
close
Content-Encoding
gzip
Content-Length
1419
Content-Type
text/html; charset=utf-8
Date
Mon, 04 Apr 2022 13:01:04 GMT
Expires
Mon, 04 Apr 2022 14:01:04 +0200
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma
no-cache
Server
Apache
Vary
Accept-Encoding
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 7EF6 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges
bytes
age
314
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 04 Apr 2022 12:55:50 GMT
expires
Tue, 04 Apr 2023 12:55:50 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame C33A 		783 B
533 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-7b120a5-9b871d4e.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
e724a3d2ddcbceff241a7a4ce807b115b69e36d56612ae5d954c236cff34daec
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-WSivsmUR9xJfinDLlEZeLg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=300
content-encoding
gzip
content-length
511
content-security-policy
script-src 'report-sample' 'nonce-WSivsmUR9xJfinDLlEZeLg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Mon, 04 Apr 2022 13:01:04 GMT
expires
Mon, 04 Apr 2022 13:01:04 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame BC13 		1 KB
749 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
URL: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

age
25640
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=86400
content-encoding
gzip
content-length
724
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 04 Apr 2022 05:53:44 GMT
etag
48472445140208031
expires
Tue, 05 Apr 2022 05:53:44 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 768E 		219 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
212cec1e3b733de905030f0f7defc66725a566cf795a3cf52c8eceea620fe6d7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type
image/png
usync.js
eus.rubiconproject.com/ Frame 1E28 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&gdpr=0&geo=eu&co=de
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
b7781f6fa62c80c336671d895754a77ce8d0f5e9fe30e0b1f40d08c66261408b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?&gdpr=0&geo=eu&co=de
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:04 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 16:28:01 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=10071
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9541
Expires
Mon, 04 Apr 2022 15:48:55 GMT
setuid
px.ads.linkedin.com/ Frame 4D7C
Redirect Chain
  • https://token.rubiconproject.com/token?pid=36584
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L1KQ0QWX-26-D7D2
0
142 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L1KQ0QWX-26-D7D2
Protocol
H2
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: CA85B511F78945BD9BFBB200C2ED95CD Ref B: FRAEDGE1209 Ref C: 2022-04-04T13:01:04Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAXb07iQ2jq7GhN+SEvZFQ==

Redirect headers

Location
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L1KQ0QWX-26-D7D2
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
704c1e4d3fcc922a3031d436b584678b
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
ecm3
aax-eu.amazon-adsystem.com/s/ Frame 4D7C
Redirect Chain
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=bPINqrwcT4SrJWi7sN-aiA&rk=usync-other
  • https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=bPINqrwcT4SrJWi7sN-aiA
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=bPINqrwcT4SrJWi7sN-aiA
Protocol
HTTP/1.1
Server
52.95.126.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:05 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
BJQE9BZ23GF6BHC68K1X
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=bPINqrwcT4SrJWi7sN-aiA
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
v1
ads.yahoo.com/cms/ Frame 4D7C
Redirect Chain
  • https://token.rubiconproject.com/token?pid=26594
  • https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L1KQ0QWX-26-D7D2&sigv=1&esig=2~3809cf217766b5f1fab158b7eaa37569d17c31eb
0
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L1KQ0QWX-26-D7D2&sigv=1&esig=2~3809cf217766b5f1fab158b7eaa37569d17c31eb
Protocol
H2
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
cache-control
no-store
x-content-type-options
nosniff
server
ATS
strict-transport-security
max-age=15552000
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection
1; mode=block

Redirect headers

Location
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L1KQ0QWX-26-D7D2&sigv=1&esig=2~3809cf217766b5f1fab158b7eaa37569d17c31eb
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
611afce88997db6fdd35eb213e662871
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
ecm3
s.amazon-adsystem.com/ Frame 4D7C
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=kVHNNGQPTey_hyNZH5MkoQ&rk=usync-na
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=kVHNNGQPTey_hyNZH5MkoQ
43 B
556 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=kVHNNGQPTey_hyNZH5MkoQ
Protocol
HTTP/1.1
Server
209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:05 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
9TEY4HKGP0KXZ6RNS9D1
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=kVHNNGQPTey_hyNZH5MkoQ
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
rubicon
match.adsrvr.org/track/cmf/ Frame 4D7C 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/rubicon
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pixel
cm.g.doubleclick.net/ Frame 4D7C
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLUTBRV1gtMjYtRDdEMg==
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLUTBRV1gtMjYtRDdEMg==
Protocol
H3
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLUTBRV1gtMjYtRDdEMg==
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
704c1e4d3fcc922a3031d436b584678b
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame 4D7C
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEG93iS7TIacJ3dQ7998l0uU&google_cver=1
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEG93iS7TIacJ3dQ7998l0uU&google_cver=1
Protocol
HTTP/1.1
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEG93iS7TIacJ3dQ7998l0uU&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
326
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
709414.gif
id.rlcdn.com/ Frame 4D7C 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/709414.gif
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers
/
track.adform.net/adfscript/ Frame 7DAE 		742 B
857 B 		Script
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/adfscript/?bn=53795659;click=https%3A%2F%2Fhal900018.redintelligence.net%2Fc%2Fprbs6f2vcy30aly%3Ftprde%3D
Requested by
Host: hal900018.redintelligence.net
URL: https://hal900018.redintelligence.net/request_content.php?s=72207300145112504380392011919018&a=572c741f
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.252 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
s1.adform.net
Software
nginx /
Resource Hash
3ceb2e84bb066f4a30a2419168d7b8ba1897760f0f0674bedcbe0594d9e43840
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/javascript; charset=utf-8
content-length
543
expires
-1
sync
ads.servenobid.com/ Frame 22E3 		0
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=317&uid=2855230096168324382&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.244.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-154-244-32.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
/
rtb-csync.smartadserver.com/redir/ Frame 22E3
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc...
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=Mjg1NTIzMDA5NjE2ODMyNDM4Mg==&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEOZbWEus1qSphqHPpDd-vOY&gdpr=0&gdpr_consent=&google_cver=1
43 B
426 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEOZbWEus1qSphqHPpDd-vOY&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
185.86.137.131 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
cache-control
no-cache,no-store
content-type
image/gif
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEOZbWEus1qSphqHPpDd-vOY&gdpr=0&gdpr_consent=&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
345
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
rtb-csync.smartadserver.com/redir/ Frame 22E3
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=560288&ev=1&rurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D92%26partneruserid%3D%25%25VGUID%25%25&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=obIgMiDSrxAT&ev=1&pid=560288&gdpr_consent=&gdpr=0
43 B
442 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=obIgMiDSrxAT&ev=1&pid=560288&gdpr_consent=&gdpr=0
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
HTTP/1.1
Server
185.86.137.131 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
cache-control
no-cache,no-store
content-type
image/gif
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
de-DE
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=obIgMiDSrxAT&ev=1&pid=560288&gdpr_consent=&gdpr=0
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-7597cd5c75-wtbzk
expires
-1
711890.gif
id.rlcdn.com/ Frame 22E3 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/711890.gif?credir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D136%26partneruserid%3D&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers
pixel
cm.g.doubleclick.net/ Frame 22E3
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_...
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=Mjg1NTIzMDA5NjE2ODMyNDM4Mg==&gdpr=0&gdpr_consent=
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=Mjg1NTIzMDA5NjE2ODMyNDM4Mg==&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol
H3
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssbsync.smartadserver.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=Mjg1NTIzMDA5NjE2ODMyNDM4Mg==&gdpr=0&gdpr_consent=
pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
/
track.adform.net/adfscript/ Frame 8E36 		742 B
856 B 		Script
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/adfscript/?bn=53795677;click=https%3A%2F%2Fhal900029.redintelligence.net%2Fc%2Fprg6stwo8ma7r22%3Ftprde%3D
Requested by
Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request_content.php?s=58495700119238404380388011919029&a=b54eb72a
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.252 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
s1.adform.net
Software
nginx /
Resource Hash
014e379f32a2f097092976500f992084d4cd65488d471572f5e2aaae82ded6f7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/javascript; charset=utf-8
content-length
542
expires
-1
usersync
rtb.gumgum.com/ Frame E4F5
Redirect Chain
  • https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID
  • https://rtb.gumgum.com/usersync?b=apn&i=8615746979499682240
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=apn&i=8615746979499682240
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:04 GMT
X-Proxy-Origin
185.213.155.169; 185.213.155.169; 728.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
1d018c82-7c14-4132-8f8e-e495b82d8ad9
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://rtb.gumgum.com/usersync?b=apn&i=8615746979499682240
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usersync
rtb.gumgum.com/ Frame E4F5
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_8ff9a716-3723-4370-a7dc-735986c075cb&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=61911d27-645c-4628-a192-91958e64f135
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=61911d27-645c-4628-a192-91958e64f135
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=a9c2a05d-cd6a-466d-8fe6-3078b59f77fc&ssp=gumgum2&expires=30&user_group=5&bsw_param=61911d27-645c-4628-a192-91958e64f135
  • https://rtb.gumgum.com/usersync?b=bsw&i=61911d27-645c-4628-a192-91958e64f135
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=bsw&i=61911d27-645c-4628-a192-91958e64f135
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
//rtb.gumgum.com/usersync?b=bsw&i=61911d27-645c-4628-a192-91958e64f135
Date
Mon, 04 Apr 2022 13:01:05 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
sync-iframe
cs-server-s2s.yellowblue.io/ Frame E4F5
Redirect Chain
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D
  • https://rtb.gumgum.com/usersync?b=obn&i=ENC%28A5B42hCKl2lsEYFHLaxhvsUxT0q_Gnf3fCiaEbiwGCQ6O4KKp5cQGbjxHHKtNphE%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26pla...
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_8ff9a716-3723-4370-a7dc-735986c075cb&obuid=ENC(A5B42hCKl2lsEYFHLaxhvsUxT0q_Gnf3fCiaEbiwGCQ6O4KKp5cQGbjxHHKtNphE)
  • https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
  • https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&redirect=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Drise%26uid%3D%5BpartnerId%5D%26obUid%3DA5...
0
323 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&redirect=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Drise%26uid%3D%5BpartnerId%5D%26obUid%3DA5B42hCKl2lsEYFHLaxhvsUxT0q_Gnf3fCiaEbiwGCQ6O4KKp5cQGbjxHHKtNphE%26gdpr%3D%24GDPR_APPLIES%26gdpr_consent%3D%24CONSNT_STRING
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
54.83.246.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-83-246-18.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:05 GMT
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
text/html
access-control-allow-origin
https://g2.gumgum.com/
x-reason
could not perform CS due to GDPR policy: gdpr is not applied
access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Location
https://cs-server-s2s.yellowblue.io/sync-iframe?gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&redirect=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Drise%26uid%3D%5BpartnerId%5D%26obUid%3DA5B42hCKl2lsEYFHLaxhvsUxT0q_Gnf3fCiaEbiwGCQ6O4KKp5cQGbjxHHKtNphE%26gdpr%3D%24GDPR_APPLIES%26gdpr_consent%3D%24CONSNT_STRING
Date
Mon, 04 Apr 2022 13:01:05 GMT
X-TraceId
14659809904b87f8b8d14ec38003d014
Content-Length
0
usersync
rtb.gumgum.com/ Frame E4F5
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
  • https://rtb.gumgum.com/usersync?b=opx&i=e8f46ef1-f059-4689-948b-ded9ed26d6ee
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=opx&i=e8f46ef1-f059-4689-948b-ded9ed26d6ee
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

date
Mon, 04 Apr 2022 13:01:04 GMT
content-encoding
gzip
server
OXGW/18.0.0
vary
Accept, Accept-Encoding
p3p
CP="CUR ADM OUR NOR STA NID"
location
https://rtb.gumgum.com/usersync?b=opx&i=e8f46ef1-f059-4689-948b-ded9ed26d6ee
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
via
1.1 google
usersync
rtb.gumgum.com/ Frame E4F5
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=sta&i=0-45af342e-9fe6-49dd-6feb-3c8fcb722e07$ip$185.213.155.169
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=sta&i=0-45af342e-9fe6-49dd-6feb-3c8fcb722e07$ip$185.213.155.169
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
https://rtb.gumgum.com/usersync?b=sta&i=0-45af342e-9fe6-49dd-6feb-3c8fcb722e07$ip$185.213.155.169
Date
Mon, 04 Apr 2022 13:01:05 GMT
Connection
keep-alive
Content-Length
124
Content-Type
text/html; charset=utf-8
usersync
rtb.gumgum.com/ Frame E4F5
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=oth&i=y-f0n8YzxE2pcvcZZLwVON3HyD64S.HODYWH5o~A
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=oth&i=y-f0n8YzxE2pcvcZZLwVON3HyD64S.HODYWH5o~A
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

date
Mon, 04 Apr 2022 13:01:04 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://rtb.gumgum.com/usersync?b=oth&i=y-f0n8YzxE2pcvcZZLwVON3HyD64S.HODYWH5o~A
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
usersync
rtb.gumgum.com/ Frame E4F5
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%...
  • https://rtb.gumgum.com/usersync?b=vnt&i=49647300-b417-11ec-aad8-9f94043e2d80
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=vnt&i=49647300-b417-11ec-aad8-9f94043e2d80
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Location
https://rtb.gumgum.com/usersync?b=vnt&i=49647300-b417-11ec-aad8-9f94043e2d80
Date
Mon, 04 Apr 2022 13:01:04 GMT
Server
Apache-Coyote/1.1
Connection
keep-alive
Content-Length
0
X-CI-RTID
49647301-b417-11ec-aad8-9f94043e2d80
services
sync.technoratimedia.com/ Frame E4F5 		0
292 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
193.122.130.38 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
via
1.1 varnish
server
nginx
age
0
access-control-allow-methods
POST,GET,HEAD,OPTIONS
x-varnish
8756817
access-control-allow-origin
https://g2.gumgum.com/
access-control-allow-credentials
true
142
match.deepintent.com/usersync/ Frame E4F5 		0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.deepintent.com/usersync/142
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
g.deepintent.com
Software
c /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
content-length
0
server
c
usersync
rtb.gumgum.com/ Frame E4F5
Redirect Chain
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=e_8ff9a716-3723-4370-a7dc-735986c075cb&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://stags.bluekai.com/site/23178?id=Jv2xJehK4WL00F5G5QTI&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2STWGJ4EUZLIJM2FOTBQGBDDKRZVKFKESJTVONPXA...
  • https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=Jv2xJehK4WL00F5G5QTI&us_privacy=1---
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=Jv2xJehK4WL00F5G5QTI&us_privacy=1---
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:05 GMT
P3p
CP="We do not support P3P header."
Location
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=Jv2xJehK4WL00F5G5QTI&us_privacy=1---
Cache-Control
no-cache, no-store, must-revalidate
Content-Type
text/html; charset=utf-8
Content-Length
118
Expires
Thu, 01 Dec 1994 16:00:00 GMT
usersync
usersync.gumgum.com/ Frame E4F5
Redirect Chain
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://usersync.gumgum.com/usersync?b=idi&i=d8cdf6db-a4ab-4ccf-b7a5-19b64a63bbf6
35 B
296 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=idi&i=d8cdf6db-a4ab-4ccf-b7a5-19b64a63bbf6
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Server
34.241.76.6 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-241-76-6.eu-west-1.compute.amazonaws.com
Software
envoy /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
server
envoy
content-type
image/gif
cache-control
private, no-store, must-revalidate, max-age=0
x-envoy-upstream-service-time
6
x-region
ireland
content-length
35
expires
0

Redirect headers

location
https://usersync.gumgum.com/usersync?b=idi&i=d8cdf6db-a4ab-4ccf-b7a5-19b64a63bbf6
date
Mon, 04 Apr 2022 13:01:04 GMT
access-control-allow-origin
*
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
usersync
rtb.gumgum.com/ Frame E4F5
Redirect Chain
  • https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent=
  • https://sync.1rx.io/usersync2/floor6?zcc=1&cb=1649077265298
  • https://rtb.gumgum.com/usersync?b=rhy&i=OPTOUT
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=rhy&i=OPTOUT
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:06 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
server
Tengine
etag
OPTOUT
content-type
text/html
location
https://rtb.gumgum.com/usersync?b=rhy&i=OPTOUT
cache-control
no-store, no-cache, must-revalidate
expires
0
usersync
rtb.gumgum.com/ Frame E4F5
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
  • https://rtb.gumgum.com/usersync?b=pln&i=2IKe9qZajXLw&ev=1&pid=558355
35 B
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.gumgum.com/usersync?b=pln&i=2IKe9qZajXLw&ev=1&pid=558355
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
server
nginx
content-type
image/gif;charset=UTF-8
cache-control
private, no-store, must-revalidate, max-age=0
timing-allow-origin
*
content-length
35
expires
0

Redirect headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
de-DE
location
https://rtb.gumgum.com/usersync?b=pln&i=2IKe9qZajXLw&ev=1&pid=558355
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-7597cd5c75-tm6fj
expires
-1
sync
ssbsync.smartadserver.com/api/ Frame E4F5 		0
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=15
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.137.108 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:03 GMT
content-length
0
sync
ads.servenobid.com/ Frame E4F5 		0
358 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=309&uid=e_8ff9a716-3723-4370-a7dc-735986c075cb
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.244.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-154-244-32.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
activeview
pagead2.googlesyndication.com/pcs/ Frame 901A 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvkoGoWwN5d4H4P4Jgz4TZw70h2S0aA-EkZto5rIZC3t2iUzeOTbMdzDEUTw7v1Virkku_C5jDOSUjKVhS23KGeFAlgC30Wd0w0iA2VNNf1VkA5j0rf&sig=Cg0ArKJSzLUxskgHVqx-EAE&id=lidar2&mcvt=1132&p=0,0,250,300&mtos=1132,1132,1132,1132,1132&tos=1132,0,0,0,0&v=20220330&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=1414505084&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1649077260217&rpt=2480&met=ie&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
usync.js
eus.rubiconproject.com/ Frame 2459 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
b7781f6fa62c80c336671d895754a77ce8d0f5e9fe30e0b1f40d08c66261408b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=17632&endpoint=us-east
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:04 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 16:28:01 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=10071
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9541
Expires
Mon, 04 Apr 2022 15:48:55 GMT
viewability
hal900018.redintelligence.net/ Frame 7DAE 		0
150 B 		Script
General
Check archive.org
Download Go to
Full URL
https://hal900018.redintelligence.net/viewability?s=72207300145112504380392011919018&a=d61442d3&vb=m
Requested by
Host: hal900018.redintelligence.net
URL: https://hal900018.redintelligence.net/request_content.php?s=72207300145112504380392011919018&a=572c741f
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
144.76.91.199 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.199.91.76.144.clients.your-server.de
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/request_content.php?s=72207300145112504380392011919018&a=572c741f
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:04 GMT
Server
Apache
Connection
close
Content-Length
0
Content-Type
text/html; charset=UTF-8
default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame B211 		81 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1ka67n0wb4ryt38nr6jvz03qh4rhkb2yv6a2kpefbj3qz421jddy5e0bqb0nwsdsfbkt5teajbbdjka9vab1v2150ampzz8vc900cy1dve9mqhd8p9xxedzaarm8rh1nvmj53x9hgy8w526s4pvfbb7w2m882rgnq1wv6jqwgm3e6052rhkwqvgd0y853s1pdnx5qdx9jga2ggcyvx8xny9wnb240x9sz33f8yje6cs99d6feb189haevj3w781awkpkcr10fbe835513x5eeva96hc9t4bhxz54d4yc6z4kkrk20v0nhtmbj94fyyprm45wmfdw2xwxqzs07mbx5wbqa27my3d6r2k2h1mesc7da6byq9489eqpt8yv6291zjb5s6t7wvk7tty35sp9kb5036fyeypfy7h25z6zn4rtphttzcp88&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%26client%3Dca-pub-7500593236707325%26adurl%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://as.ad4m.at/ad/dr?ed=1ka67n0wb4ryt38nr6jvz03qh4rhkb2yv6a2kpefbj3qz421jddy5e0bqb0nwsdsfbkt5teajbbdjka9vab1v2150ampzz8vc900cy1dve9mqhd8p9xxedzaarm8rh1nvmj53x9hgy8w526s4pvfbb7w2m882rgnq1wv6jqwgm3e6052rhkwqvgd0y853s1pdnx5qdx9jga2ggcyvx8xny9wnb240x9sz33f8yje6cs99d6feb189haevj3w781awkpkcr10fbe835513x5eeva96hc9t4bhxz54d4yc6z4kkrk20v0nhtmbj94fyyprm45wmfdw2xwxqzs07mbx5wbqa27my3d6r2k2h1mesc7da6byq9489eqpt8yv6291zjb5s6t7wvk7tty35sp9kb5036fyeypfy7h25z6zn4rtphttzcp88&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%26client%3Dca-pub-7500593236707325%26adurl%3D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age
593281
cross-origin-embedder-policy
unsafe-none
cf-polished
origSize=83581
surrogate-control
no-store
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=86400; includeSubDomains; preload
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
same-origin
last-modified
Mon, 28 Mar 2022 16:13:03 GMT
server
cloudflare
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
accept-encoding
x-download-options
noopen
content-type
text/css; charset=utf-8
expires
0
cache-control
max-age=3600, must-revalidate, proxy-revalidate
cf-ray
6f6a3b07d8189b71-FRA
cf-bgj
minify
r62eglto.js
ad4m.at/ Frame B211 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/r62eglto.js
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/dr?ed=1ka67n0wb4ryt38nr6jvz03qh4rhkb2yv6a2kpefbj3qz421jddy5e0bqb0nwsdsfbkt5teajbbdjka9vab1v2150ampzz8vc900cy1dve9mqhd8p9xxedzaarm8rh1nvmj53x9hgy8w526s4pvfbb7w2m882rgnq1wv6jqwgm3e6052rhkwqvgd0y853s1pdnx5qdx9jga2ggcyvx8xny9wnb240x9sz33f8yje6cs99d6feb189haevj3w781awkpkcr10fbe835513x5eeva96hc9t4bhxz54d4yc6z4kkrk20v0nhtmbj94fyyprm45wmfdw2xwxqzs07mbx5wbqa27my3d6r2k2h1mesc7da6byq9489eqpt8yv6291zjb5s6t7wvk7tty35sp9kb5036fyeypfy7h25z6zn4rtphttzcp88&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%26client%3Dca-pub-7500593236707325%26adurl%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ddcdb425051dbc349b91079fe450031f1c28e182aa24974ddfa20a92b4facbd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-goog-hash
crc32c=i40RNw==, md5=nlnmslSy2ZaL7/XdQ+Tixw==
date
Mon, 04 Apr 2022 13:01:04 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
77500
x-guploader-uploadid
ADPycdud40uO2Mf_WWaUQzp9I1nh9IXeGBItqXtMCs0VcfCRXQz1OChOrnOKdaxujHYAlenXrW_xURgYSHENuQAL-YN_EnuFLw
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
cf-bgj
minify
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Tue, 15 Mar 2022 15:28:50 GMT
server
cloudflare
etag
W/"9e59e6b254b2d9968beff5dd43e4e2c7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5Pq0wdQVx8%2BFNv99RMdGKLAOUuVErN%2BMqZymDxd9f59WfZf5mgn3wLzv8Shwswh%2FmqRTpyJ2ug3jFhHH%2Bvx2L%2BicvomJRsSpvwAqbbURxM2%2BeqsjGukC3BtMOGRoEfirwvL6Vbo%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1647358130172556
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=3600, must-revalidate, stale-while-revalidate=300
x-goog-stored-content-length
11881
cf-ray
6f6a3b07dd469be6-FRA
expires
Sun, 03 Apr 2022 15:29:24 GMT
dcm
s.amazon-adsystem.com/ Frame 03A2
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB
  • https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&dcc=t
43 B
645 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&dcc=t
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
HTTP/1.1
Server
209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:05 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
YCZBT71FJP10X646YQE7
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:04 GMT
Vary
Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server
Server
x-amz-rid
8YEQQ6ZGPXWTKSE8YQG3
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&dcc=t
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy
interest-cohort=()
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
casale
match.adsrvr.org/track/cmf/ Frame 03A2 		70 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
crum
dsum-sec.casalemedia.com/ Frame 03A2
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
  • https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YkrsEIZYLJzLV1osrv.wvQAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEI8m9HK0cgvzxifD2svdZpw&google_cver=1&gdpr=1&google_hm=2
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEI8m9HK0cgvzxifD2svdZpw&google_cver=1&gdpr=1&google_hm=2
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
HTTP/1.1
Server
72.247.225.98 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a72-247-225-98.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:05 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 04 Apr 2022 13:01:05 GMT

Redirect headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEI8m9HK0cgvzxifD2svdZpw&google_cver=1&gdpr=1&google_hm=2
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
341
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 03A2 		170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&gdpr_consent=&us_privacy=&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ZMAwryCI
sync-tm.everesttech.net/upi/pid/ Frame 03A2 		0
66 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
via
1.1 varnish
server
Varnish
x-timer
S1649077265.741923,VS0,VE0
x-cache
MISS
cache-control
no-cache
x-cache-hits
0
accept-ranges
bytes
content-length
0
retry-after
0
x-served-by
cache-hhn4061-HHN
crum
dsum-sec.casalemedia.com/ Frame 03A2
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=CASALE&rurl=https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=_wfivefivec_&gdpr=1
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=FuM1Z2B31NBmkn5&gdpr=1
43 B
987 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=FuM1Z2B31NBmkn5&gdpr=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
HTTP/1.1
Server
72.247.225.98 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a72-247-225-98.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:04 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 04 Apr 2022 13:01:04 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:03 GMT
Server
PingMatch/v2.0.30-713-gdae83a2#rel-ec2-master i-0ae965e2f8a6b4310@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=47&external_user_id=FuM1Z2B31NBmkn5&gdpr=1
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
no_match_opted_out
um.simpli.fi/ Frame 03A2
Redirect Chain
  • https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID&gdpr=1
  • https://um.simpli.fi/no_match_opted_out
0
272 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://um.simpli.fi/no_match_opted_out
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
H2
Server
169.50.137.184 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
b8.89.32a9.ip4.static.sl-reverse.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 04 Apr 2022 13:01:04 GMT
x-content-type-options
nosniff
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS

Redirect headers

date
Mon, 04 Apr 2022 13:01:04 GMT
x-content-type-options
nosniff
server
nginx
location
/no_match_opted_out
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
138
expires
Sun, 03 Apr 2022 13:01:04 GMT
crum
dsum-sec.casalemedia.com/ Frame 03A2
Redirect Chain
  • https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1
  • https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1&prevuid=&knw=0
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
HTTP/1.1
Server
72.247.225.98 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a72-247-225-98.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:05 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Mon, 04 Apr 2022 13:01:05 GMT

Redirect headers

date
Mon, 04 Apr 2022 13:01:04 GMT
server
nginx
access-control-allow-origin
*
transfer-encoding
chunked
access-control-allow-methods
POST, GET, OPTIONS
p3p
CP="NOI DEV OUR BUS UNI"
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
cache-control
no-cache
content-type
text/html; charset=UTF-8
access-control-allow-headers
Origin
keep-alive
timeout=10
sync
ads.servenobid.com/ Frame 03A2 		0
356 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.servenobid.com/sync?pid=333&uid=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.244.32 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-154-244-32.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
amp-access-control-allow-source-origin
*
content-type
image/avif;charset=ISO-8859-1
access-control-allow-origin
*
access-control-expose-headers
AMP-Access-Control-Allow-Source-Origin
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials
true
content-length
0
viewability
hal900029.redintelligence.net/ Frame 8E36 		0
150 B 		Script
General
Check archive.org
Download Go to
Full URL
https://hal900029.redintelligence.net/viewability?s=58495700119238404380388011919029&a=88e3f92d&vb=m
Requested by
Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request_content.php?s=58495700119238404380388011919029&a=b54eb72a
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.174.219.99.88.clients.your-server.de
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/request_content.php?s=58495700119238404380388011919029&a=b54eb72a
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:04 GMT
Server
Apache
Connection
close
Content-Length
0
Content-Type
text/html; charset=UTF-8
usersync
rtb.gumgum.com/ Frame 581F
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
  • https://rtb.gumgum.com/usersync?b=mmh&i=398a624a-ec0e-4b01-a32f-29671dd4853d&gdpr=0&gdpr_consent=
35 B
208 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=mmh&i=398a624a-ec0e-4b01-a32f-29671dd4853d&gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

cache-control
private, no-store, must-revalidate, max-age=0
content-length
35
content-type
image/gif;charset=UTF-8
date
Mon, 04 Apr 2022 13:01:04 GMT
expires
0
pragma
no-cache
server
nginx
timing-allow-origin
*

Redirect headers

Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
Date
Mon, 04 Apr 2022 13:01:04 GMT
Expires
Mon, 04 Apr 2022 13:01:03 GMT
Keep-Alive
timeout=360
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server
MT3 4320 2f2dfe5 master cdg-pixel-x26 config:1.0.0
location
https://rtb.gumgum.com/usersync?b=mmh&i=398a624a-ec0e-4b01-a32f-29671dd4853d&gdpr=0&gdpr_consent=
usersync
usersync.gumgum.com/ Frame 1ECF
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=atm&i=YkrsDAAAAJKdVwQA&gdpr=0&gdpr_consent=
35 B
296 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=atm&i=YkrsDAAAAJKdVwQA&gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.241.76.6 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-241-76-6.eu-west-1.compute.amazonaws.com
Software
envoy /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

cache-control
private, no-store, must-revalidate, max-age=0
content-length
35
content-type
image/gif
date
Mon, 04 Apr 2022 13:01:04 GMT
expires
0
pragma
no-cache
server
envoy
x-envoy-upstream-service-time
6
x-region
ireland

Redirect headers

accept-ranges
bytes
cache-control
no-cache
content-length
0
date
Mon, 04 Apr 2022 13:01:04 GMT
location
https://usersync.gumgum.com/usersync?b=atm&i=YkrsDAAAAJKdVwQA&gdpr=0&gdpr_consent=
pragma
no-cache
retry-after
0
server
Varnish
via
1.1 varnish
x-cache
HIT
x-cache-hits
0
x-served-by
cache-hhn4061-HHN
x-timer
S1649077265.722540,VS0,VE0
pixel
cm.g.doubleclick.net/ Frame 6724 		170 B
188 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV84ZmY5YTcxNi0zNzIzLTQzNzAtYTdkYy03MzU5ODZjMDc1Y2I=&gdpr=0&gdpr_consent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-length
170
content-type
image/png
cross-origin-resource-policy
cross-origin
date
Mon, 04 Apr 2022 13:01:04 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
server
HTTP server (unknown)
x-xss-protection
0
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 74E4 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
72.247.225.32 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a72-247-225-32.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges
bytes
cache-control
max-age=98375
content-encoding
gzip
content-length
5549
content-type
text/html; charset=UTF-8
date
Mon, 04 Apr 2022 13:01:04 GMT
etag
"1300708-3de4-5d6ef246ef4cf"
expires
Tue, 05 Apr 2022 16:20:39 GMT
last-modified
Tue, 01 Feb 2022 06:38:00 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
usersync
rtb.gumgum.com/ Frame 6D5E
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/usersync?b=ttd&i=ba772fae-fb7e-433d-b9e8-18ab9acb3f0c&t=1651669264
35 B
208 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=ttd&i=ba772fae-fb7e-433d-b9e8-18ab9acb3f0c&t=1651669264
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

cache-control
private, no-store, must-revalidate, max-age=0
content-length
35
content-type
image/gif;charset=UTF-8
date
Mon, 04 Apr 2022 13:01:04 GMT
expires
0
pragma
no-cache
server
nginx
timing-allow-origin
*

Redirect headers

cache-control
private,no-cache, must-revalidate
content-length
209
content-type
text/html
date
Mon, 04 Apr 2022 13:01:04 GMT
location
https://rtb.gumgum.com/usersync?b=ttd&i=ba772fae-fb7e-433d-b9e8-18ab9acb3f0c&t=1651669264
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma
no-cache
x-aspnet-version
4.0.30319
usync.html
eus.rubiconproject.com/ Frame A022
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
  • https://eus.rubiconproject.com/usync.html?p=gumgum
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Mon, 04 Apr 2022 13:01:04 GMT
ETag
"402b2-119-5d32342a551c0"
Last-Modified
Tue, 14 Dec 2021 23:07:59 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Mon, 04 Apr 2022 13:01:04 GMT
location
https://eus.rubiconproject.com/usync.html?p=gumgum
server
AkamaiGHost
usersync
usersync.gumgum.com/ Frame 4EC7
Redirect Chain
  • https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID&gdpr=0&gdpr_consent=
  • https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24EMXUID
  • https://cs.emxdgt.com/umcheck?apnxid=8615746979499682240&redirect=https://usersync.gumgum.com/usersync?b=emx&i=$EMXUID
  • https://usersync.gumgum.com/usersync?b=emx&uid=8615746979499682240brt21431649077264722786f1
35 B
296 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=emx&uid=8615746979499682240brt21431649077264722786f1
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.241.76.6 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-241-76-6.eu-west-1.compute.amazonaws.com
Software
envoy /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

cache-control
private, no-store, must-revalidate, max-age=0
content-length
35
content-type
image/gif
date
Mon, 04 Apr 2022 13:01:04 GMT
expires
0
pragma
no-cache
server
envoy
x-envoy-upstream-service-time
1
x-region
ireland

Redirect headers

content-length
0
content-type
text/html
date
Mon, 04 Apr 2022 13:01:03 GMT
location
https://usersync.gumgum.com/usersync?b=emx&uid=8615746979499682240brt21431649077264722786f1
usersync
rtb.gumgum.com/ Frame 8E50
Redirect Chain
  • https://tg.socdm.com/aux/idsync?proto=gumgum
  • https://rtb.gumgum.com/usersync?b=sus&i=YkrsEcCo5ugAAO1d15kAAAAA
35 B
208 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=sus&i=YkrsEcCo5ugAAO1d15kAAAAA
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

cache-control
private, no-store, must-revalidate, max-age=0
content-length
35
content-type
image/gif;charset=UTF-8
date
Mon, 04 Apr 2022 13:01:05 GMT
expires
0
pragma
no-cache
server
nginx
timing-allow-origin
*

Redirect headers

Cache-Control
private
Connection
keep-alive
Content-Length
0
Date
Mon, 04 Apr 2022 13:01:05 GMT
Location
https://rtb.gumgum.com/usersync?b=sus&i=YkrsEcCo5ugAAO1d15kAAAAA
P3P
CP="See also http://www.scaleout.jp/privacy/"
Server
nginx
X-SO-Ads-Time
3
X-SO-Cluster-ID
47
X-SO-HostName
m-ad239.dc4p.scaleout.jp
X-SO-IP
185.213.155.169
X-SO-Key
YkrsEcCo5ugAAO1d15kAAAAA
X-SO-LB-Data
{"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":47,"gdpr":true,"ipv4":"0.0.0.0","key":"YkrsEcCo5ugAAO1d15kAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad239"}
X-SO-LB-Hostname
a-tgng40017.dc2p.scaleout.jp
X-SO-Upstream-ID
m-ad239
usersync
rtb.gumgum.com/ Frame F834
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=gumgum
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1
  • https://rtb.gumgum.com/usersync?b=rth&i=aRT0vZg4C1cQyGAlw60s&pi=gumgum&tc=1
35 B
208 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usersync?b=rth&i=aRT0vZg4C1cQyGAlw60s&pi=gumgum&tc=1
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://g2.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

cache-control
private, no-store, must-revalidate, max-age=0
content-length
35
content-type
image/gif;charset=UTF-8
date
Mon, 04 Apr 2022 13:01:04 GMT
expires
0
pragma
no-cache
server
nginx
timing-allow-origin
*

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Mon, 04 Apr 2022 13:01:04 GMT Mon, 04 Apr 2022 13:01:04 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://rtb.gumgum.com/usersync?b=rth&i=aRT0vZg4C1cQyGAlw60s&pi=gumgum&tc=1
pragma
no-cache
bootstrap.js
s1.adform.net/stoat/626/s1.adform.net/ Frame 7DAE 		33 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Requested by
Host: track.adform.net
URL: https://track.adform.net/adfscript/?bn=53795659;click=https%3A%2F%2Fhal900018.redintelligence.net%2Fc%2Fprbs6f2vcy30aly%3Ftprde%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
3d0bf782b47dcd079eedf6bb34ecb0742c114a4e4b90e37a58a412482101b475

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
content-encoding
gzip
last-modified
Thu, 10 Feb 2022 15:16:56 GMT
server
nginx
x-cache-status
HIT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=100000
expires
Tue, 05 Apr 2022 16:03:42 GMT
truncated
/ Frame 486F 		221 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
43c3db268dcffacbd978d28973c2448bbc5550f030d3289891624a6df871c500

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type
image/png
bootstrap.js
s1.adform.net/stoat/626/s1.adform.net/ Frame 8E36 		33 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Requested by
Host: track.adform.net
URL: https://track.adform.net/adfscript/?bn=53795677;click=https%3A%2F%2Fhal900029.redintelligence.net%2Fc%2Fprg6stwo8ma7r22%3Ftprde%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
3d0bf782b47dcd079eedf6bb34ecb0742c114a4e4b90e37a58a412482101b475

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
content-encoding
gzip
last-modified
Thu, 10 Feb 2022 15:16:56 GMT
server
nginx
x-cache-status
HIT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=100000
expires
Tue, 05 Apr 2022 16:03:42 GMT
pixel
cm.g.doubleclick.net/ Frame B3BA
Redirect Chain
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEC_KcHrgv3gVHkzW3Wqm35Q&google_cver=1&google_push=AYg5qPJAO3jX-4xeMtOnWTJGygTLHQiAcJ146rgFNr1xUz2BJWASixZG0c...
  • https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPJAO3jX-4xeMtOnWTJGygTLHQiAcJ146rgFNr1xUz2BJWASixZG0cyyCWWexWmjhjTHHyMJsNNvIdgDVKBFqJoZG5n5-Euj&google_hm=lbGvMEqid3PY...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPJAO3jX-4xeMtOnWTJGygTLHQiAcJ146rgFNr1xUz2BJWASixZG0cyyCWWexWmjhjTHHyMJsNNvIdgDVKBFqJoZG5n5-Euj&google_hm=lbGvMEqid3PYBj1vA7ajxw
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
Protocol
H3
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AYg5qPJAO3jX-4xeMtOnWTJGygTLHQiAcJ146rgFNr1xUz2BJWASixZG0cyyCWWexWmjhjTHHyMJsNNvIdgDVKBFqJoZG5n5-Euj&google_hm=lbGvMEqid3PYBj1vA7ajxw
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
dds
rtb.openx.net/sync/ Frame B3BA 		43 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.openx.net/sync/dds?google_gid=CAESEENLrC6yuO_i1jzEy7y3K-U&google_cver=1&google_push=AYg5qPLkDtt38Tb3Y_-88ca7MdEygjArRg064G4OJvjAD35z_1vKjixXoLDJgiDGEDEVRlhNXYdOM9efdbzPZdA6kLohDm7mH9D1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
211.253.186.35.bc.googleusercontent.com
Software
Cowboy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
via
1.1 google
server
Cowboy
vary
Origin
p3p
CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin
null
access-control-expose-headers
cache-control
private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
x-request-id
p0s42sruuqfgqinen2a4jhg8s1asc2vo
pixel
cm.g.doubleclick.net/ Frame B3BA
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=fBxLFmr7TM6HbB7dWPRe9Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=fBxLFmr7TM6HbB7dWPRe9Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKE8k0jGq8B-xJJIC4Lfn09QteX_BXro8-zfovSXnFabS_iv1dhZHz0TPUnxOsaHXjggB13rOeID7iK-UYYz8cAhrnomtv1
Protocol
H3
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=fBxLFmr7TM6HbB7dWPRe9Q%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKE8k0jGq8B-xJJIC4Lfn09QteX_BXro8-zfovSXnFabS_iv1dhZHz0TPUnxOsaHXjggB13rOeID7iK-UYYz8cAhrnomtv1
date
Mon, 04 Apr 2022 13:01:04 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame B3BA
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKZdeoA-Qo7ycYgD9dfW-WQ&google_cver=1&google_push=AYg5qPKlKho_YAsoVqQtFnbLTZEQCuq3WdDMwFGqmcsMdOvKN0y58e7Kd7fVi2f3C85BXctHslm...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLUTBRV1gtMjYtRDdEMg==&google_push=AYg5qPKlKho_YAsoVqQtFnbLTZEQCuq3WdDMwFGqmcsMdOvKN0y58e7Kd7fVi2f3C85BXctHslmGf1KwOk7tOqoeBLts5dvuTqag
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLUTBRV1gtMjYtRDdEMg==&google_push=AYg5qPKlKho_YAsoVqQtFnbLTZEQCuq3WdDMwFGqmcsMdOvKN0y58e7Kd7fVi2f3C85BXctHslmGf1KwOk7tOqoeBLts5dvuTqag
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
Protocol
H3
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFLUTBRV1gtMjYtRDdEMg==&google_push=AYg5qPKlKho_YAsoVqQtFnbLTZEQCuq3WdDMwFGqmcsMdOvKN0y58e7Kd7fVi2f3C85BXctHslmGf1KwOk7tOqoeBLts5dvuTqag
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
Expires
0
pixel
cm.g.doubleclick.net/ Frame B3BA
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJ...
0
0
attr
cm.g.doubleclick.net/pixel/ Frame B3BA 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LVFSx05T3rIrlhSQ4b-Q5knHLyc9JGwqnw9UicjI4x-gpXR-flAfSO6Q0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=7286959315&adk=2838937357&adf=776186318&pi=t.ma~as.7286959315&w=300&psa=0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077261533&bpp=10&bdt=1317&idt=582&shv=r20220330&mjsv=m202203280101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=1&ga_vid=444449005.1649077256&ga_sid=1649077263&ga_hid=1560024698&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1082&ady=256&biw=1600&bih=1200&isw=300&ish=250&ifk=2005993957&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760333%2C44761044%2C31065741%2C31065971%2C31065721&oid=2&pvsid=403622214229593&pem=251&tmod=1482112515&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.1o00dps8l909&fsb=1&dtd=1317
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
/
google2waycm.netmng.com/cm/ Frame BC13 		0
0
i.match
s.tribalfusion.com/z/ Frame BC13
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b6&u=CAESEE3mM9EIVCs6NZXDC280Uf0&google_cver=1&google_push=AYg5qPJt6-2ryRUQ0B4ZKSNnigLYZMJD7IW5ZNf1gYH-TQgb_GxZFgltuHXJMFDPY7Wk1P8eDU6ZyanJLyxwScIujbeukUBi0mF6&...
  • https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEE3mM9EIVCs6NZXDC280Uf0&google_cver=1&google_push=AYg5qPJt6-2ryRUQ0B4ZKSNnigLYZMJD7IW5ZNf1gYH-TQgb_GxZFgltuHXJMFDPY7Wk1P8eDU6ZyanJLyxwScIujbeukUBi0mF...
43 B
421 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEE3mM9EIVCs6NZXDC280Uf0&google_cver=1&google_push=AYg5qPJt6-2ryRUQ0B4ZKSNnigLYZMJD7IW5ZNf1gYH-TQgb_GxZFgltuHXJMFDPY7Wk1P8eDU6ZyanJLyxwScIujbeukUBi0mF6&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPJt6-2ryRUQ0B4ZKSNnigLYZMJD7IW5ZNf1gYH-TQgb_GxZFgltuHXJMFDPY7Wk1P8eDU6ZyanJLyxwScIujbeukUBi0mF6%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by
Host: ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
URL: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H2
Server
2606:4700::6812:d05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
cf-cache-status
DYNAMIC
x-function
302
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
6f6a3b0b9d3c9bf2-FRA
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
content-type
image/gif; charset=utf-8
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
cf-cache-status
DYNAMIC
x-function
206
server
cloudflare
x-reuse-index
15396
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
6f6a3b09afca9bf2-FRA
p3p
CP="NOI DEVo TAIa OUR BUS"
location
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEE3mM9EIVCs6NZXDC280Uf0&google_cver=1&google_push=AYg5qPJt6-2ryRUQ0B4ZKSNnigLYZMJD7IW5ZNf1gYH-TQgb_GxZFgltuHXJMFDPY7Wk1P8eDU6ZyanJLyxwScIujbeukUBi0mF6&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPJt6-2ryRUQ0B4ZKSNnigLYZMJD7IW5ZNf1gYH-TQgb_GxZFgltuHXJMFDPY7Wk1P8eDU6ZyanJLyxwScIujbeukUBi0mF6%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control
no-cache, private
content-type
text/html
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Thu, 01 Jan 1970 00:00:00 GMT
match
um.wbtrk.net/doubleclick/user/ Frame BC13 		0
0
pixel
cm.g.doubleclick.net/ Frame BC13
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQp...
0
0
pixel
cm.g.doubleclick.net/ Frame BC13
Redirect Chain
  • https://match.360yield.com/match/ebda?google_gid=CAESEL46OezEDJUMdEAamrM5Aro&google_cver=1&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyX...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5R...
0
0
sync
rtb2-useast.torchad.com/ Frame BC13 		42 B
233 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb2-useast.torchad.com/sync?exchange=309&google_gid=CAESEDp_9be7IZCQ_2dKZ2TLOJI&google_cver=1&google_push=AYg5qPIIZLLxsaJrq84sAeW7_nUUwY4HOgubFY77QCpupZ3v0KS4a_PBZwxYwJ9CA6Fk5vrzmeeTwrZzKfPxXZeuFSlRfZrrdWnd
Requested by
Host: ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
URL: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2604:9e00:1:129::2:a01 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:05 GMT
Server
nginx
Age
0
Content-Type
image/gif
Cache-Control
no-store
Connection
keep-alive
Content-Length
42
sync
ssbsync.smartadserver.com/api/ Frame BC13 		0
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEFH70lccMB5EVBvEiUdLWIo&google_cver=1&google_push=AYg5qPIchpsE4Z3116XbJSpdKj9VusY3LqWW5li87S_9OG9tEXiAlH-HZqWCks12hFVsKVaERSukkW1vUvZ1ykSs9aMK8tcQHsz3IA
Requested by
Host: ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
URL: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.137.108 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
content-length
0
attr
cm.g.doubleclick.net/pixel/ Frame BC13 		0
12 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JwdCtt0s42oS0GBI_L9kDJi2pvyF3vQeddoIiyDxPyZQ2I8aSmA_3Mi46brFaev1aoZFo5
Requested by
Host: ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
URL: https://ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:04 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
content-type
text/html
sodar
pagead2.googlesyndication.com/pagead/ Frame C33A 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220330&jk=403622214229593&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers
async_usersync
ib.adnxs.com/ Frame 6001 		0
747 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.87 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:04 GMT
X-Proxy-Origin
185.213.155.169; 185.213.155.169; 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
f89614e9-1cd7-4bbb-8f04-e5f87cacd5b4
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usync.js
eus.rubiconproject.com/ Frame A022 		32 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.78.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-78-125.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
b7781f6fa62c80c336671d895754a77ce8d0f5e9fe30e0b1f40d08c66261408b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:04 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Mar 2022 16:28:01 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=10071
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Content-Length
9541
Expires
Mon, 04 Apr 2022 15:48:55 GMT
adchoices_default.png
static-de.ad4mat.net/ads/img/ad_markers_folder/ Frame B211 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static-de.ad4mat.net/ads/img/ad_markers_folder/adchoices_default.png
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:444e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-goog-hash
crc32c=v7nNsg==, md5=eUyE0w4hPsahRNZCFfB1UQ==
date
Mon, 04 Apr 2022 13:01:05 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3012296
x-guploader-uploadid
ADPycdsAM1RKIW8NW9FXGsxgzhi5bSYe4VqqEbCt8J5Oc8iEgAF2SjSQc54Zb1FETUd5c-MZGmZZMUkSoxlmANI9NVVBPD3Irw
x-goog-storage-class
STANDARD
x-goog-custom-time
1970-01-01T00:00:00Z
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3262
x-goog-meta-
last-modified
Wed, 09 Jun 2021 12:35:14 GMT
server
cloudflare
etag
"794c84d30e213ec6a144d64215f07551"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j6bdkBn4xtiKyw4HuXns3gj%2FVl6dmNhpAY5ydSZO9esywJfeKnO2dh2lGLYuZiWahL9rgwtj9iSdPAoDNO1KDp9%2FeZztNwKn1BG6JjSOVvlu27vVrSZbjNlBMnGAkGmNOA0OsXJCJyK0PNJXOS7Skv97"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1623242114099744
content-type
image/png
cache-control
public, max-age=31536000, immutable
x-goog-stored-content-length
3262
accept-ranges
bytes
cf-ray
6f6a3b0aef129134-FRA
expires
Tue, 28 Feb 2023 16:16:09 GMT
sync.php
pixel-us-east.rubiconproject.com/exchange/ Frame 2459 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=17632&khaos=L1KQ0QWX-26-D7D2
Requested by
Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
URL: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
382e2818ca015d35b02cd449aa60881d
Content-Type
image/gif
/
track.adform.net/adfserve/ Frame 7DAE 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/adfserve/?bn=53795659;click=https%3A%2F%2Fhal900018.redintelligence.net%2Fc%2Fprbs6f2vcy30aly%3Ftprde%3D;js=1;adfxid=1x;2268;set=en-US|en-US|1600X1200|0|950|100|24|8|3|7|1|;cmpgdpr=;cmpgdprconsent=;fd=0|0&CREFURL=https%3A%2F%2Fthreatpost.com
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.252 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
s1.adform.net
Software
nginx /
Resource Hash
08973f5319888f5bc472fa88bf6b84fddab2ee8292cb1160ab280b898743e45f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/javascript; charset=utf-8
content-length
2007
expires
-1
V_I9kkE0weacsZYJ7hXHsf1U2l7Bs5zHQi7wjQJaUfA.js
pagead2.googlesyndication.com/bg/ Frame 7EF6 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/V_I9kkE0weacsZYJ7hXHsf1U2l7Bs5zHQi7wjQJaUfA.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
57f23d924134c1e69cb19609ee15c7b1fd54da5ec1b39cc7422ef08d025a51f0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 07:39:24 GMT
content-encoding
br
x-content-type-options
nosniff
age
19301
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13731
x-xss-protection
0
last-modified
Mon, 28 Mar 2022 10:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 04 Apr 2023 07:39:24 GMT
/
track.adform.net/adfserve/ Frame 8E36 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/adfserve/?bn=53795677;click=https%3A%2F%2Fhal900029.redintelligence.net%2Fc%2Fprg6stwo8ma7r22%3Ftprde%3D;js=1;adfxid=1x;8235;set=en-US|en-US|1600X1200|0|300|600|24|8|3|7|1|;cmpgdpr=;cmpgdprconsent=;fd=0|0&CREFURL=https%3A%2F%2Fthreatpost.com
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.252 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
s1.adform.net
Software
nginx /
Resource Hash
1cd86a0f1c2f19383dca65854e869a95316faea14a0a976c6d84969c4185b2c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/javascript; charset=utf-8
content-length
2006
expires
-1
activeview
pagead2.googlesyndication.com/pcs/ Frame BDC7 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss3hIGWlmpbsZELVvusuVgcKk5P4ttYM2R2tM-2AKWXDA_6J9oPR7AG9_DUohBb5uOYu7D8qSeNCEJ45Qi6LC-XW33AFh5p5jor0KxBLDbhEy0dTmao&sig=Cg0ArKJSzCXSc8B0cyxiEAE&id=lidar2&mcvt=1176&p=8,315,98,1285&mtos=1176,1176,1176,1176,1176&tos=1176,0,0,0,0&v=20220330&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=4166723991&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1649077260143&rpt=3186&isd=0&lsd=0&met=mue&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
frame.html
ad4m.at/ Frame E86C 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/frame.html
Requested by
Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d12a71cd626ac8f0fc91e6f1b98280cfb49fd724f2dcc118d192adff9a0154b4

Request headers

Accept-Language
de-DE,de;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

age
624745
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
public, max-age=3600
cf-cache-status
HIT
cf-ray
6f6a3b0b99719b71-FRA
content-encoding
br
content-language
en
content-type
text/html; charset=utf-8
date
Mon, 04 Apr 2022 13:01:05 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
Mon, 04 Apr 2022 14:01:05 GMT
last-modified
Wed, 06 May 2020 15:09:30 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5lYnn0JomLP%2FUGz2x793zg05kkzdRh9YOXeeyXzDyAGnDdmgXW8dG8BcFsR2MBINz8Ap20S53UgNEDn6c6K1tCe1HmX6hCexQdACDsB5vS8ELg9B0EIn8D5DfvF7cWm6U4kas6s%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-goog-custom-time
1970-01-01T00:00:00Z
x-goog-generation
1588777770164783
x-goog-hash
crc32c=iTDHew== md5=c2ZaqCqAXxKd4MgeeQDU8g==
x-goog-meta-
x-goog-metageneration
3
x-goog-storage-class
MULTI_REGIONAL
x-goog-stored-content-encoding
identity
x-goog-stored-content-length
1681
x-guploader-uploadid
ADPycds-8sQtq3wpa_8FZA4_lJm2l0V1rVRE94pQrLxNSzcoOyWFTKcSCQQ1tfbcjuocIbHYIVQdYrNUUHn7EVvK_wY
generate_204
tpc.googlesyndication.com/ Frame D553 		0
9 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?79Z7sg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
Standard
s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/ Frame 7DAE 		90 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
f7e06ae449bdd4ebece6e26cdb36840f7cb19f28b57bbb6b8647a54535557d3f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:05 GMT
content-encoding
gzip
last-modified
Thu, 10 Feb 2022 15:16:56 GMT
server
nginx
x-cache-status
HIT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=100000
expires
Tue, 05 Apr 2022 16:04:24 GMT
truncated
/ Frame 7DAE 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type
image/gif
addDoubleBorder.js
cdn.contentspread.net/24i/tools/js/ Frame 7DAE 		851 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.contentspread.net/24i/tools/js/addDoubleBorder.js
Requested by
Host: hal900018.redintelligence.net
URL: https://hal900018.redintelligence.net/request_content.php?s=72207300145112504380392011919018&a=572c741f
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
85.114.131.235 Rheinfelden, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS
srv21039.dus4.fastwebserver.de
Software
nginx /
Resource Hash
abaa484421865309a7781e540844f1b5260ed131080f8dd9f083d8f18beea107

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:05 GMT
Last-Modified
Tue, 03 May 2016 20:54:50 GMT
Server
nginx
ETag
"5729101a-353"
Content-Type
application/javascript
Connection
close
Accept-Ranges
bytes
Content-Length
851
truncated
/ Frame 8E36 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Content-Type
image/gif
Standard
s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/ Frame 8E36 		90 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
f7e06ae449bdd4ebece6e26cdb36840f7cb19f28b57bbb6b8647a54535557d3f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:05 GMT
content-encoding
gzip
last-modified
Thu, 10 Feb 2022 15:16:56 GMT
server
nginx
x-cache-status
HIT
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=100000
expires
Tue, 05 Apr 2022 16:04:24 GMT
sync.php
pixel.rubiconproject.com/exchange/ Frame A022 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=L1KQ0QWX-26-D7D2
Requested by
Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
a66cbf3142c6ef39e3614b84a34262cf
Content-Type
image/gif
/
track.adform.net/csimpr/ Frame 7DAE 		35 B
478 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/csimpr/?bn=53795659&csi=JUPG5xLUwC4YhwcVEK-83cEC_kBJn4iAmoGpSmqCskMJDwKV3Zer3AbVPFfxctBNgTSu7zkjfihaiJPF1yW9196vWmW1dlSa0
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.252 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
s1.adform.net
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://hal900018.redintelligence.net/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
server
nginx
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://hal900018.redintelligence.net
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
/
track.adform.net/csimpr/ Frame 8E36 		35 B
469 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/csimpr/?bn=53795677&csi=cF9sc_wGFk76kTcSP2aAaJl8XLTictktmoGpSmqCskMJDwKV3Zer3AbVPFfxctBNZtFC4LKJdGdHbtx2YSMrX96vWmW1dlSa0
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.252 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
s1.adform.net
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://hal900029.redintelligence.net/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
server
nginx
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://hal900029.redintelligence.net
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
10998795.js
s1.adform.net/Banners/Elements/Files/160090/10998795/ Frame 9CE8 		111 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998795/10998795.js?ADFassetID=10998795&bv=258
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
9ba52dcd38164c8f4e406ddfafc28471ef5c92e052c95451b8bbee6c4b6d01f9
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:05 GMT
content-encoding
gzip
last-modified
Fri, 11 Mar 2022 09:43:56 GMT
server
nginx
etag
W/"622b19dc-1bbaf"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
10998790.js
s1.adform.net/Banners/Elements/Files/160090/10998790/ Frame DDDA 		105 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998790/10998790.js?ADFassetID=10998790&bv=258
Requested by
Host: threatpost.com
URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
08392ff877c5d17c9e4794b9c47c1b671b9501fbfeb78c906438008ee78aa87d
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:05 GMT
content-encoding
gzip
last-modified
Fri, 11 Mar 2022 09:43:54 GMT
server
nginx
etag
W/"622b19da-1a44c"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
rs
ad4m.at/ Frame B211 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/rs
Requested by
Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4643cdf224ae55f57457b86b0ec9f2a92d25aa1ae8b550f81091c70854c6cb9e

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
application/json

Response headers

cf-ray
6f6a3b0e283d911f-FRA
date
Mon, 04 Apr 2022 13:01:05 GMT
via
1.1 google
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O0I1jmQ4Bexo2mRxM2w8DWxYGJAOMhGapMIaUO%2BqAdq9F9%2FXlwj%2Bd8LrC%2Bi%2FK%2Brpf%2Bg8LpRAuG%2Bm%2FQJVN5ahAyaOAbmFR0Hqc6MEsgwAwapqRoGLDfv5gCLw2OBFbn6d%2BTz0WqU%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain
access-control-allow-origin
https://as.ad4m.at
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
access-control-allow-credentials
true
content-encoding
br
x-backend-server
aa-reachservice-group-europe-west1-w0m7
rs
ad4m.at/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://ad4m.at/rs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:bd1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://as.ad4m.at
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-origin
https://as.ad4m.at
access-control-max-age
1800
allow
HEAD,POST,GET,OPTIONS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
6f6a3b0daeaa911f-FRA
content-length
24
content-type
text/plain
date
Mon, 04 Apr 2022 13:01:05 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NXAu659CVmPRGsQ7XRR%2BouwrXWPUuD%2FPnCs9xFx8lth1N8KEQkmNixXnWaMGTzPCo%2FWxSl8sCb%2BZj9IIq%2BptFkxptiCrx2ZCv%2FHz%2F8Mhdkf1iDNfml%2BGJLsyx9PUXYHaH%2BTKbws%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
via
1.1 google
x-backend-server
aa-reachservice-group-europe-west1-w0m7
Adform.DHTML.js
s1.adform.net/banners/scripts/rmb/ Frame 9CE8 		30 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js?bv=626
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
bea63616949c80ff0dfdbb1e8547f1585882fc691483317b06441688e3e5f14a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:05 GMT
content-encoding
gzip
last-modified
Fri, 14 May 2021 12:35:38 GMT
server
nginx
etag
W/"609e6e9a-76d9"
x-cache-status
HIT
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
Enabler.js
s0.2mdn.net/ads/studio/ Frame 9CE8 		134 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/ads/studio/Enabler.js
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3705d0878203cc0b2525dcb0f874d85cc6b881d1fca1869191da4e599c768241
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 12:59:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
117
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46435
x-xss-protection
0
last-modified
Wed, 02 Mar 2022 23:47:21 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=900
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Mon, 04 Apr 2022 13:14:08 GMT
Adform.DHTML.js
s1.adform.net/banners/scripts/rmb/ Frame DDDA 		30 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js?bv=626
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
bea63616949c80ff0dfdbb1e8547f1585882fc691483317b06441688e3e5f14a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:05 GMT
content-encoding
gzip
last-modified
Fri, 14 May 2021 12:35:38 GMT
server
nginx
etag
W/"609e6e9a-76d9"
x-cache-status
HIT
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
content-type
application/x-javascript
Enabler.js
s0.2mdn.net/ads/studio/ Frame DDDA 		134 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/ads/studio/Enabler.js
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3705d0878203cc0b2525dcb0f874d85cc6b881d1fca1869191da4e599c768241
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 12:59:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
117
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46435
x-xss-protection
0
last-modified
Wed, 02 Mar 2022 23:47:21 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=900
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Mon, 04 Apr 2022 13:14:08 GMT
generate_204
tpc.googlesyndication.com/ Frame 7EF6 		0
9 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?-Iwlpg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
activeview
pagead2.googlesyndication.com/pcs/ Frame 486F 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuQE8eEpJR3YTyvUDcdMQ8jGPZObMMihYC2qTVaS3qTEiw4sQs12aw7TAZwRAeSSfK-p62uiSV59HCVu1c2JTB5ZQ&sig=Cg0ArKJSzMq1tky5N2SWEAE&cid=CAASF-RocssowUvDUDetP8A0f7cW7oJ8T_fm&id=lidar2&mcvt=1001&p=0,0,250,300&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20220330&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2838937357&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1649077262880&rpt=1081&met=ie&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:05 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rar
as.ad4m.at/ad/ Frame 7A02 		9 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/rar?a=19458%2C183570%2C25177&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2Cz4pFRfEYaqR47upHBHMtqtedETJTwTrkSW%2CVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQ&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2C8QjCDfM8FR2wQtgHJHEtqC7gRtPTwT1MUk%2CmE6TefgGH9JPFmHZHZtQC2WKaDTwT41FA&c=300&d=250&e=ipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_&g=12bc4966941cd995447e84927e34b7d0%2F12633427948423530538&i=20774%2C9731%2C27543&j=14%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1649077265653&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jq0r83tf9ms6z5xgr6t9fcrw7zebynp0hvtmw1f48fzkmb7wexqm8dqsfdt5xb6v2k6y81s3qgbp4dtgkdyqng0x0y4hbav0j98qn9ey4fh0rpt3f5hr94q8nhkkxcc5722m7yfvjqbpahjxt462fgs7msz4nvzkgzjqrg8a3dgqar8md6h06yvvb37pdjzejbr6psf8da6h406ht69cq62ykx2fr8276w4hhtr9g8w6qgq32befh9kbzzn9e9ykwgbzcd9q7mdmh1j6thg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%2526client%253Dca-pub-7500593236707325%2526adurl%253D&y=1&z=0
Requested by
Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
399ffea8046b8f3d49b79ad4a17ea689aac73c73abc3f6288988758fcc2e924d
Security Headers
Name Value
Content-Security-Policy block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://as.ad4m.at/ad/dr?ed=1ka67n0wb4ryt38nr6jvz03qh4rhkb2yv6a2kpefbj3qz421jddy5e0bqb0nwsdsfbkt5teajbbdjka9vab1v2150ampzz8vc900cy1dve9mqhd8p9xxedzaarm8rh1nvmj53x9hgy8w526s4pvfbb7w2m882rgnq1wv6jqwgm3e6052rhkwqvgd0y853s1pdnx5qdx9jga2ggcyvx8xny9wnb240x9sz33f8yje6cs99d6feb189haevj3w781awkpkcr10fbe835513x5eeva96hc9t4bhxz54d4yc6z4kkrk20v0nhtmbj94fyyprm45wmfdw2xwxqzs07mbx5wbqa27my3d6r2k2h1mesc7da6byq9489eqpt8yv6291zjb5s6t7wvk7tty35sp9kb5036fyeypfy7h25z6zn4rtphttzcp88&x=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%26client%3Dca-pub-7500593236707325%26adurl%3D
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status
DYNAMIC
cf-ray
6f6a3b0f7b789b71-FRA
content-encoding
br
content-security-policy
block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
unsafe-none
cross-origin-opener-policy
unsafe-none
cross-origin-resource-policy
cross-origin
date
Mon, 04 Apr 2022 13:01:05 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
0
feature-policy
geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
pragma
no-cache
referrer-policy
same-origin
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
server
cloudflare
strict-transport-security
max-age=86400; includeSubDomains; preload
surrogate-control
no-store
vary
accept-encoding
via
1.1 google
x-content-type-options
nosniff
x-download-options
noopen
x-xss-protection
1; mode=block
viewability
hal900018.redintelligence.net/ Frame 7DAE 		0
150 B 		Script
General
Check archive.org
Download Go to
Full URL
https://hal900018.redintelligence.net/viewability?s=72207300145112504380392011919018&a=d61442d3&vb=v
Requested by
Host: hal900018.redintelligence.net
URL: https://hal900018.redintelligence.net/request_content.php?s=72207300145112504380392011919018&a=572c741f
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
144.76.91.199 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.199.91.76.144.clients.your-server.de
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/request_content.php?s=72207300145112504380392011919018&a=572c741f
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:05 GMT
Server
Apache
Connection
close
Content-Length
0
Content-Type
text/html; charset=UTF-8
default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame 7A02 		81 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C183570%2C25177&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2Cz4pFRfEYaqR47upHBHMtqtedETJTwTrkSW%2CVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQ&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2C8QjCDfM8FR2wQtgHJHEtqC7gRtPTwT1MUk%2CmE6TefgGH9JPFmHZHZtQC2WKaDTwT41FA&c=300&d=250&e=ipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_&g=12bc4966941cd995447e84927e34b7d0%2F12633427948423530538&i=20774%2C9731%2C27543&j=14%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1649077265653&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jq0r83tf9ms6z5xgr6t9fcrw7zebynp0hvtmw1f48fzkmb7wexqm8dqsfdt5xb6v2k6y81s3qgbp4dtgkdyqng0x0y4hbav0j98qn9ey4fh0rpt3f5hr94q8nhkkxcc5722m7yfvjqbpahjxt462fgs7msz4nvzkgzjqrg8a3dgqar8md6h06yvvb37pdjzejbr6psf8da6h406ht69cq62ykx2fr8276w4hhtr9g8w6qgq32befh9kbzzn9e9ykwgbzcd9q7mdmh1j6thg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%2526client%253Dca-pub-7500593236707325%2526adurl%253D&y=1&z=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://as.ad4m.at/ad/rar?a=19458%2C183570%2C25177&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2Cz4pFRfEYaqR47upHBHMtqtedETJTwTrkSW%2CVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQ&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2C8QjCDfM8FR2wQtgHJHEtqC7gRtPTwT1MUk%2CmE6TefgGH9JPFmHZHZtQC2WKaDTwT41FA&c=300&d=250&e=ipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_&g=12bc4966941cd995447e84927e34b7d0%2F12633427948423530538&i=20774%2C9731%2C27543&j=14%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1649077265653&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jq0r83tf9ms6z5xgr6t9fcrw7zebynp0hvtmw1f48fzkmb7wexqm8dqsfdt5xb6v2k6y81s3qgbp4dtgkdyqng0x0y4hbav0j98qn9ey4fh0rpt3f5hr94q8nhkkxcc5722m7yfvjqbpahjxt462fgs7msz4nvzkgzjqrg8a3dgqar8md6h06yvvb37pdjzejbr6psf8da6h406ht69cq62ykx2fr8276w4hhtr9g8w6qgq32befh9kbzzn9e9ykwgbzcd9q7mdmh1j6thg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%2526client%253Dca-pub-7500593236707325%2526adurl%253D&y=1&z=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:05 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age
593282
cross-origin-embedder-policy
unsafe-none
cf-polished
origSize=83581
surrogate-control
no-store
report-to
{"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=86400; includeSubDomains; preload
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
same-origin
last-modified
Mon, 28 Mar 2022 16:13:03 GMT
server
cloudflare
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
accept-encoding
x-download-options
noopen
content-type
text/css; charset=utf-8
expires
0
cache-control
max-age=3600, must-revalidate, proxy-revalidate
cf-ray
6f6a3b0fcc599b71-FRA
cf-bgj
minify
D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
assets.ad4m.at/logo/ Frame 7A02 		53 KB
54 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/logo/D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C183570%2C25177&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2Cz4pFRfEYaqR47upHBHMtqtedETJTwTrkSW%2CVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQ&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2C8QjCDfM8FR2wQtgHJHEtqC7gRtPTwT1MUk%2CmE6TefgGH9JPFmHZHZtQC2WKaDTwT41FA&c=300&d=250&e=ipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_&g=12bc4966941cd995447e84927e34b7d0%2F12633427948423530538&i=20774%2C9731%2C27543&j=14%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1649077265653&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jq0r83tf9ms6z5xgr6t9fcrw7zebynp0hvtmw1f48fzkmb7wexqm8dqsfdt5xb6v2k6y81s3qgbp4dtgkdyqng0x0y4hbav0j98qn9ey4fh0rpt3f5hr94q8nhkkxcc5722m7yfvjqbpahjxt462fgs7msz4nvzkgzjqrg8a3dgqar8md6h06yvvb37pdjzejbr6psf8da6h406ht69cq62ykx2fr8276w4hhtr9g8w6qgq32befh9kbzzn9e9ykwgbzcd9q7mdmh1j6thg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%2526client%253Dca-pub-7500593236707325%2526adurl%253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7cdf71044448cb736733f5163fff96081d51ba4101567d61d22ee5998a7a399

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-goog-hash
crc32c=V11ayA==, md5=Cid9We/KA2mmmDZF4nNlng==
date
Mon, 04 Apr 2022 13:01:05 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
924106
cf-polished
origFmt=png, origSize=115129
x-guploader-uploadid
ADPycdu2006smSesXiveZaa2Az4i9sGYaBPI0xmal6HBq0tmwOZ_yWy7vl69EL6RrSaqwr-MWMk_uN1q2OZZiAv70pA
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
54564
last-modified
Tue, 09 Feb 2021 15:11:24 GMT
server
cloudflare
etag
"0a277d59efca0369a6983645e273659e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0JXUpYMgY6cJbJVqe4avwbZzvPmH9iFgoidfv%2BD4FTEAKrclVnJ6q%2BFkWtNbgo74NKkJ7Qiy72VYWxAAF6zaamZFsk%2FBorMKI5NqCJNpVJGViF5rdgxD5UdrGR5Q67dYJJ%2Bb6iVpUcXcjHBG"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1612883484779402
content-type
image/webp
expires
Tue, 05 Apr 2022 13:01:05 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
115129
accept-ranges
bytes
cf-ray
6f6a3b0fda259be6-FRA
cf-bgj
imgq:85,h2pri
1D53E9CF3821E81F5644C8C6FD10FC3C1E53F2F21748B14D50333BD8E08058E50BE70BEE9D071C4FD38992D3B57467DAA70308BF0B8E9E5A740263D0F5C9EE6D
assets.ad4m.at/product_image/ Frame 7A02 		21 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/product_image/1D53E9CF3821E81F5644C8C6FD10FC3C1E53F2F21748B14D50333BD8E08058E50BE70BEE9D071C4FD38992D3B57467DAA70308BF0B8E9E5A740263D0F5C9EE6D
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C183570%2C25177&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2Cz4pFRfEYaqR47upHBHMtqtedETJTwTrkSW%2CVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQ&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2C8QjCDfM8FR2wQtgHJHEtqC7gRtPTwT1MUk%2CmE6TefgGH9JPFmHZHZtQC2WKaDTwT41FA&c=300&d=250&e=ipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_&g=12bc4966941cd995447e84927e34b7d0%2F12633427948423530538&i=20774%2C9731%2C27543&j=14%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1649077265653&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jq0r83tf9ms6z5xgr6t9fcrw7zebynp0hvtmw1f48fzkmb7wexqm8dqsfdt5xb6v2k6y81s3qgbp4dtgkdyqng0x0y4hbav0j98qn9ey4fh0rpt3f5hr94q8nhkkxcc5722m7yfvjqbpahjxt462fgs7msz4nvzkgzjqrg8a3dgqar8md6h06yvvb37pdjzejbr6psf8da6h406ht69cq62ykx2fr8276w4hhtr9g8w6qgq32befh9kbzzn9e9ykwgbzcd9q7mdmh1j6thg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%2526client%253Dca-pub-7500593236707325%2526adurl%253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ea39dba2b498dfe4e18255e241acf246f9229c8deb54e5b2530cadb51a25bd58

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-goog-hash
crc32c=dV1e1g==, md5=OdUvFkjawxXrzJxPpO1XKA==
date
Mon, 04 Apr 2022 13:01:05 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
923524
cf-polished
qual=85, origFmt=jpeg, origSize=60655
x-guploader-uploadid
ADPycdsSDs1dYyP2N0Cpd83pocalkr9_Zf8bRDA2PzVWAZ01SwEY_MAv7SIqk5yQAUx8NdYmTsCVfj3AjdKLjm_SXws
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
21982
last-modified
Fri, 11 Dec 2020 13:58:13 GMT
server
cloudflare
etag
"39d52f1648dac315ebcc9c4fa4ed5728"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MkYhNnRs3B4aLgfnviNZFgIrn%2BjDp0JpLyZlSSWsxqfTgJW4YuKYefGDkPXlPD4UBHITvJ8dgu37YOAb%2FsixOGak3OBtDfjPM%2Bb0z5oojvsroqd8z%2B2XO7zxGXRimhEUtJKhVtZzr0AYmRoH"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1607695093714344
content-type
image/webp
expires
Tue, 05 Apr 2022 13:01:05 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
60655
accept-ranges
bytes
cf-ray
6f6a3b0fda279be6-FRA
cf-bgj
imgq:85,h2pri
/
partner.o2online.de/a/ Frame 7A02
Redirect Chain
  • https://www.telefonica-partner.de/tpv.php?t=117679V1226132702M&subid=oneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_asuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_...
  • https://www.lead-alliance.net/tpv.php?t=117679V1226132702M&subid=oneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_asuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_cons...
  • https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022040415010566683329143X117679V1226132702MSoneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidipmqbsg...
49 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022040415010566683329143X117679V1226132702MSoneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_asuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022040415010566683329143X117679V1226132702MSoneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_asuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C183570%2C25177&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2Cz4pFRfEYaqR47upHBHMtqtedETJTwTrkSW%2CVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQ&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2C8QjCDfM8FR2wQtgHJHEtqC7gRtPTwT1MUk%2CmE6TefgGH9JPFmHZHZtQC2WKaDTwT41FA&c=300&d=250&e=ipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_&g=12bc4966941cd995447e84927e34b7d0%2F12633427948423530538&i=20774%2C9731%2C27543&j=14%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1649077265653&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jq0r83tf9ms6z5xgr6t9fcrw7zebynp0hvtmw1f48fzkmb7wexqm8dqsfdt5xb6v2k6y81s3qgbp4dtgkdyqng0x0y4hbav0j98qn9ey4fh0rpt3f5hr94q8nhkkxcc5722m7yfvjqbpahjxt462fgs7msz4nvzkgzjqrg8a3dgqar8md6h06yvvb37pdjzejbr6psf8da6h406ht69cq62ykx2fr8276w4hhtr9g8w6qgq32befh9kbzzn9e9ykwgbzcd9q7mdmh1j6thg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%2526client%253Dca-pub-7500593236707325%2526adurl%253D&y=1&z=0
Protocol
HTTP/1.1
Server
78.46.85.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
nonstopads1.sunbonet.de
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date
Mon, 04 Apr 2022 13:01:06 GMT
X-NODEIP
78.46.85.162
Server
nginx/1.10.3 (Ubuntu)
RM-PrivacyPolicy
https://www.nonstoppartner.net/
P3P
policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection
keep-alive
Content-Type
image/gif
Keep-Alive
timeout=10
Content-Length
49

Redirect headers

location
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022040415010566683329143X117679V1226132702MSoneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_asuid__suite_Netmix_Reach43_TopRotaMonth&spid=2022040415010566683329143X117679V1226132702MSoneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_asuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679
date
Mon, 04 Apr 2022 13:01:05 GMT
x-content-type-options
nosniff
server
nginx
x-xss-protection
1; mode=block
content-type
text/html; charset=UTF-8
9A9ADF83B45794E13DEF06C9B0B5410DA6614B5DA6F29CA7C7FCE5982BD017218CA8FAE6412BC5B53B66E11AC031DF4682E27B17DD0CABBDA89B4BBB14670888
assets.ad4m.at/logo/ Frame 7A02 		16 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/logo/9A9ADF83B45794E13DEF06C9B0B5410DA6614B5DA6F29CA7C7FCE5982BD017218CA8FAE6412BC5B53B66E11AC031DF4682E27B17DD0CABBDA89B4BBB14670888
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C183570%2C25177&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2Cz4pFRfEYaqR47upHBHMtqtedETJTwTrkSW%2CVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQ&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2C8QjCDfM8FR2wQtgHJHEtqC7gRtPTwT1MUk%2CmE6TefgGH9JPFmHZHZtQC2WKaDTwT41FA&c=300&d=250&e=ipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_&g=12bc4966941cd995447e84927e34b7d0%2F12633427948423530538&i=20774%2C9731%2C27543&j=14%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1649077265653&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jq0r83tf9ms6z5xgr6t9fcrw7zebynp0hvtmw1f48fzkmb7wexqm8dqsfdt5xb6v2k6y81s3qgbp4dtgkdyqng0x0y4hbav0j98qn9ey4fh0rpt3f5hr94q8nhkkxcc5722m7yfvjqbpahjxt462fgs7msz4nvzkgzjqrg8a3dgqar8md6h06yvvb37pdjzejbr6psf8da6h406ht69cq62ykx2fr8276w4hhtr9g8w6qgq32befh9kbzzn9e9ykwgbzcd9q7mdmh1j6thg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%2526client%253Dca-pub-7500593236707325%2526adurl%253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
29284f710388112ccdaed4a1e4a8a49ebaf44178a8e6cbad631ad174989bcec4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-goog-hash
crc32c=x4C8dA==, md5=3/lI4XXTmzmK8qUaw6GaTA==
date
Mon, 04 Apr 2022 13:01:05 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
933119
cf-polished
origFmt=png, origSize=30312
x-guploader-uploadid
ADPycduTPVV_8H_j7ScoOiGyMIF6PWP5w28pcIwbAmktJ8mCFgAE3cYj5KtTgae_aRd0lgFRymksDMKpD1oAelqfdBA
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
16510
last-modified
Wed, 22 Jan 2020 13:15:15 GMT
server
cloudflare
etag
"dff948e175d39b398af2a51ac3a19a4c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3XqDwIo%2BAz8k4C%2BOuJIUqiy6Om8R1Yxbz7OQ8uyN0u6TSp1DzJF2X2KuewrrJIw254U0BFhhrJSxbw7tjLuWqjyat1smoJKAd7cmpvagkxnUiev7g21AcKHShd7R9l2toLkO30ToD0ct8Gq2"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1579698915223063
content-type
image/webp
expires
Tue, 05 Apr 2022 13:01:05 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
30312
accept-ranges
bytes
cf-ray
6f6a3b0fda2a9be6-FRA
cf-bgj
imgq:85,h2pri
B64A72127C98A5B7E616D98AF9DE116F5880664F361E9B13B7269705B7FE581554B1D072F871E5674A537C154D3B4ECB4B354599426827F76CF2153006E3FC0E
assets.ad4m.at/product_image/ Frame 7A02 		318 KB
319 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/product_image/B64A72127C98A5B7E616D98AF9DE116F5880664F361E9B13B7269705B7FE581554B1D072F871E5674A537C154D3B4ECB4B354599426827F76CF2153006E3FC0E
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C183570%2C25177&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2Cz4pFRfEYaqR47upHBHMtqtedETJTwTrkSW%2CVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQ&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2C8QjCDfM8FR2wQtgHJHEtqC7gRtPTwT1MUk%2CmE6TefgGH9JPFmHZHZtQC2WKaDTwT41FA&c=300&d=250&e=ipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_&g=12bc4966941cd995447e84927e34b7d0%2F12633427948423530538&i=20774%2C9731%2C27543&j=14%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1649077265653&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jq0r83tf9ms6z5xgr6t9fcrw7zebynp0hvtmw1f48fzkmb7wexqm8dqsfdt5xb6v2k6y81s3qgbp4dtgkdyqng0x0y4hbav0j98qn9ey4fh0rpt3f5hr94q8nhkkxcc5722m7yfvjqbpahjxt462fgs7msz4nvzkgzjqrg8a3dgqar8md6h06yvvb37pdjzejbr6psf8da6h406ht69cq62ykx2fr8276w4hhtr9g8w6qgq32befh9kbzzn9e9ykwgbzcd9q7mdmh1j6thg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%2526client%253Dca-pub-7500593236707325%2526adurl%253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
62c667b703ed49159b52915cd57967e979d2d0a108794fe8722e7aa7357566f7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-goog-hash
crc32c=ihTZ8A==, md5=sIuwu/Pjn1MTPjPkQ2vAmA==
date
Mon, 04 Apr 2022 13:01:05 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1009879
cf-polished
origFmt=png, origSize=538642
x-guploader-uploadid
ADPycduvQI4_OA7V9cG7s6MAP-ppOnpYQz200V89_C0YnztvEC5jPgMvJgkerp3stTgDDhLvNSqr3M2KjjEXCPaXveT_zP32Pg
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
325456
last-modified
Wed, 23 Mar 2022 08:06:47 GMT
server
cloudflare
etag
"b08bb0bbf3e39f53133e33e4436bc098"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TKk5eP7nR8Z4e6Obyu5fvshekF%2FsUXn6KT69mxjNrJlcPRQli58tG122Oi9vuevn0361%2FqFg3NuDgF%2F%2FFFLNzI%2FBTySurYSf37rUwNK5torsxvJHKW9o5zRgcp0MGqtRhl43k1C7CUmJBHF9"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1648022807785365
content-type
image/webp
expires
Tue, 05 Apr 2022 13:01:05 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
538642
accept-ranges
bytes
cf-ray
6f6a3b0fda2f9be6-FRA
cf-bgj
imgq:85,h2pri
cshow.php
www.awin1.com/ Frame 7A02 		43 B
703 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.awin1.com/cshow.php?s=2342692&v=11601&q=357532&r=412871&pv=1&pref3=oneidz4pFRfEYaqR47upHBHMtqtedETJTwTrkSWoneid__asuidipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_asuid__suite_Netmix_Reach43_TopRotaMonth&gdpr_consent=&gdpr=0&gdpr_pd=0
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C183570%2C25177&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2Cz4pFRfEYaqR47upHBHMtqtedETJTwTrkSW%2CVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQ&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2C8QjCDfM8FR2wQtgHJHEtqC7gRtPTwT1MUk%2CmE6TefgGH9JPFmHZHZtQC2WKaDTwT41FA&c=300&d=250&e=ipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_&g=12bc4966941cd995447e84927e34b7d0%2F12633427948423530538&i=20774%2C9731%2C27543&j=14%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1649077265653&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jq0r83tf9ms6z5xgr6t9fcrw7zebynp0hvtmw1f48fzkmb7wexqm8dqsfdt5xb6v2k6y81s3qgbp4dtgkdyqng0x0y4hbav0j98qn9ey4fh0rpt3f5hr94q8nhkkxcc5722m7yfvjqbpahjxt462fgs7msz4nvzkgzjqrg8a3dgqar8md6h06yvvb37pdjzejbr6psf8da6h406ht69cq62ykx2fr8276w4hhtr9g8w6qgq32befh9kbzzn9e9ykwgbzcd9q7mdmh1j6thg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%2526client%253Dca-pub-7500593236707325%2526adurl%253D&y=1&z=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.67.134.223 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-67-134-223.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 04 Apr 2022 13:01:05 GMT
Strict-Transport-Security
max-age=86400
P3P
policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control
no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set
default
Node
Helix
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
0
AF8787BD1FB71C657E75BE73EF390A57963C77F351C62000D0970FA8B43C67E4383DE862B0D5C60C145C5F0835701FA41B246F0C35DB1C5DCBE5FA06698AB41D
assets.ad4m.at/logo/ Frame 7A02 		20 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/logo/AF8787BD1FB71C657E75BE73EF390A57963C77F351C62000D0970FA8B43C67E4383DE862B0D5C60C145C5F0835701FA41B246F0C35DB1C5DCBE5FA06698AB41D
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C183570%2C25177&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2Cz4pFRfEYaqR47upHBHMtqtedETJTwTrkSW%2CVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQ&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2C8QjCDfM8FR2wQtgHJHEtqC7gRtPTwT1MUk%2CmE6TefgGH9JPFmHZHZtQC2WKaDTwT41FA&c=300&d=250&e=ipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_&g=12bc4966941cd995447e84927e34b7d0%2F12633427948423530538&i=20774%2C9731%2C27543&j=14%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1649077265653&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jq0r83tf9ms6z5xgr6t9fcrw7zebynp0hvtmw1f48fzkmb7wexqm8dqsfdt5xb6v2k6y81s3qgbp4dtgkdyqng0x0y4hbav0j98qn9ey4fh0rpt3f5hr94q8nhkkxcc5722m7yfvjqbpahjxt462fgs7msz4nvzkgzjqrg8a3dgqar8md6h06yvvb37pdjzejbr6psf8da6h406ht69cq62ykx2fr8276w4hhtr9g8w6qgq32befh9kbzzn9e9ykwgbzcd9q7mdmh1j6thg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%2526client%253Dca-pub-7500593236707325%2526adurl%253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
806690292ecf78098ce849f7322b2f087a113a7ac8021b01425bbacec108b8c8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-goog-hash
crc32c=pm4Ewg==, md5=BK+hGBG9S8jYsog+OLjLBw==
date
Mon, 04 Apr 2022 13:01:05 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
923596
cf-polished
qual=85, origFmt=jpeg, origSize=65465
x-guploader-uploadid
ADPycdtegZIzMlzUGa5jxMhksrQwEAebWf15YgMYPkCaHyjya9Szn5n6IPykTXT5kzM87MMq5Z-VtGrmQSECyzQtnpy2bH1T4w
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
20670
last-modified
Wed, 27 May 2020 12:34:14 GMT
server
cloudflare
etag
"04afa11811bd4bc8d8b2883e38b8cb07"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5ztE5Uk6%2By%2F1sfAYQg9VaNBT6O4h5ZGs6C4jLH3Af%2FruvGsXm3bRrFYNYz2JRpC080MDZaTxM8F4h81Q87iC2bIpeDvuc6AikATmbDkchpjUMEZm72pvACoSU4Z0w8LUki38CdPtOzgF4rVD"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1590582854549036
content-type
image/webp
expires
Tue, 05 Apr 2022 13:01:05 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
65465
accept-ranges
bytes
cf-ray
6f6a3b0fda299be6-FRA
cf-bgj
imgq:85,h2pri
63ABE091DE9109998DEEBC1EAF81FEFC9DDBA3890BCCFEBB3FC705810E9119DC917F724CC48A484154ABCB1B624A02E2BB3A0679125C19EE72338DAEF6751444
assets.ad4m.at/product_image/ Frame 7A02 		258 KB
259 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.ad4m.at/product_image/63ABE091DE9109998DEEBC1EAF81FEFC9DDBA3890BCCFEBB3FC705810E9119DC917F724CC48A484154ABCB1B624A02E2BB3A0679125C19EE72338DAEF6751444
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C183570%2C25177&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2Cz4pFRfEYaqR47upHBHMtqtedETJTwTrkSW%2CVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQ&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2C8QjCDfM8FR2wQtgHJHEtqC7gRtPTwT1MUk%2CmE6TefgGH9JPFmHZHZtQC2WKaDTwT41FA&c=300&d=250&e=ipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_&g=12bc4966941cd995447e84927e34b7d0%2F12633427948423530538&i=20774%2C9731%2C27543&j=14%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1649077265653&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jq0r83tf9ms6z5xgr6t9fcrw7zebynp0hvtmw1f48fzkmb7wexqm8dqsfdt5xb6v2k6y81s3qgbp4dtgkdyqng0x0y4hbav0j98qn9ey4fh0rpt3f5hr94q8nhkkxcc5722m7yfvjqbpahjxt462fgs7msz4nvzkgzjqrg8a3dgqar8md6h06yvvb37pdjzejbr6psf8da6h406ht69cq62ykx2fr8276w4hhtr9g8w6qgq32befh9kbzzn9e9ykwgbzcd9q7mdmh1j6thg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%2526client%253Dca-pub-7500593236707325%2526adurl%253D&y=1&z=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
204c14d8448e67b23b593160570cd689db2c7598062488aae8c9c148a3fb392d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-goog-hash
crc32c=RCjGxQ==, md5=4G3kqY2JhsQE7eY6zVtbxQ==
date
Mon, 04 Apr 2022 13:01:05 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
931791
cf-polished
origFmt=png, origSize=534902
x-guploader-uploadid
ADPycds13X-ynyVsYWFTHwgnpWyJk4KBo13zAqFnA7iQ6sVXkWXBEXUcU5C1BhI5yoTVLpIUok7250vtvCLxKMbvVNg6B-hCxQ
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
264222
last-modified
Wed, 27 May 2020 07:41:20 GMT
server
cloudflare
etag
"e06de4a98d8986c404ede63acd5b5bc5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dfwRX%2FQogHuGV38iJD%2BZd5RYavMiPrRYal510Y51BFcHXpZK2tpEuwQSWNHK9u3%2BAbDhdFcyIrH6zgP5jD0tysa1yYg2bL8GXy%2BIDPFzKlzWcdrfUH%2BavxwHKq2Xa1cNx3mlmKc7o%2Bjhhr0C"}],"group":"cf-nel","max_age":604800}
x-goog-generation
1590565280497228
content-type
image/webp
expires
Tue, 05 Apr 2022 13:01:05 GMT
cache-control
public, max-age=86400
x-goog-stored-content-length
534902
accept-ranges
bytes
cf-ray
6f6a3b0fda2e9be6-FRA
cf-bgj
imgq:85,h2pri
onepixel.gif
a1.awin1.com/ Frame 7A02
Redirect Chain
  • https://www.awin1.com/cshow.php?s=2243164&v=9162&q=346070&r=414235&pv=1&pref3=oneidVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQoneid__asuidipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_asuid__suite_Netmix_Reach43_TopRotaMo...
  • https://a1.awin1.com/onepixel.gif
43 B
310 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a1.awin1.com/onepixel.gif
Requested by
Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=19458%2C183570%2C25177&b=PJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCp%2Cz4pFRfEYaqR47upHBHMtqtedETJTwTrkSW%2CVPrSwf6mFPE6CVHbHAtRtpPVFkTzTKGTQ&f=bwqTQfYZsxgPFYHbHzt8Cww8UxTJTJPSJ%2C8QjCDfM8FR2wQtgHJHEtqC7gRtPTwT1MUk%2CmE6TefgGH9JPFmHZHZtQC2WKaDTwT41FA&c=300&d=250&e=ipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_&g=12bc4966941cd995447e84927e34b7d0%2F12633427948423530538&i=20774%2C9731%2C27543&j=14%2C16%2C16&k=0&l=0&m=0&n=&p=&q=&o=suite_Netmix_Reach43_TopRotaMonth&r=1649077265653&h=https%3A%2F%2Fas.ad4m.at%2Fdct%3Fed%3D1jq0r83tf9ms6z5xgr6t9fcrw7zebynp0hvtmw1f48fzkmb7wexqm8dqsfdt5xb6v2k6y81s3qgbp4dtgkdyqng0x0y4hbav0j98qn9ey4fh0rpt3f5hr94q8nhkkxcc5722m7yfvjqbpahjxt462fgs7msz4nvzkgzjqrg8a3dgqar8md6h06yvvb37pdjzejbr6psf8da6h406ht69cq62ykx2fr8276w4hhtr9g8w6qgq32befh9kbzzn9e9ykwgbzcd9q7mdmh1j6thg%26h%3Dhttps%253A%252F%252Fadclick.g.doubleclick.net%252Faclk%253Fsa%253DL%2526ai%253DC8AvdD-xKYprgJLL4xgPf2buoCJDhgYRctqjCivACwI23ARABIABgleKQgqAHggEXY2EtcHViLTc1MDA1OTMyMzY3MDczMjWgAcKu6N0DyAEJqQJ-zQ1bh32yPqgDAaoE9gFP0NekhEMOccPBRxlHTM2tbpne9RqQSGliZRHJOtFSsczxYziKA1w73vwgIAuPa8L405RJLwlLcCOT5BmiLi1mxRJ_2HI55VQkjPXKfl_Sk2fzO326RjxQNgF7oMJOdlIjP6ulkh0EG6ftlHZJEch0e8M87S-EM5F0Dxv2T0l65KHW7-jHiA2KK6iPB-KXKy8P7Lexx4K0IbVlGZYnQ_mpKzAseecgsNAI0yikIKJrOC-RXbn-VjnCvokSqFujTbZHmYFhrbnsbyh1vNsUt_FMqzY5dyzE9RxhJ09wCeQ30xecEndzoR6lySbQG5SHbYAp_Cu50WiABry2mfOd_o_LMaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIgOGAEBAB-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_3oKtH-xdlw1QhJLK-4IiAjaPtkyw%2526client%253Dca-pub-7500593236707325%2526adurl%253D&y=1&z=0
Protocol
H2
Server
151.101.2.110 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
73e88dfcd0f3a535341fb641c5400fcf772ffe36c628241104f829d3cf48e29b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:05 GMT
via
1.1 varnish, 1.1 varnish
server
Apache
age
3721
vary
Accept-Encoding
x-cache
HIT, HIT
content-type
image/gif
expires
Mon, 04 Apr 2022 23:59:04 GMT
cache-control
max-age=43200
x-cache-hits
1, 653
fastly-original-body-size
43
accept-ranges
bytes
x-timer
S1649077266.998032,VS0,VE0
content-length
43
x-served-by
cache-fra19138-FRA, cache-hhn4073-HHN

Redirect headers

Date
Mon, 04 Apr 2022 13:01:05 GMT
Strict-Transport-Security
max-age=86400
P3P
policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Location
https://a1.awin1.com/onepixel.gif
Awin-Akamai-Rule-Set
default
Node
Helix
Connection
keep-alive
Content-Length
0
gen_204
pagead2.googlesyndication.com/pagead/ 		0
21 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2022032106&jk=1185834301470211&bg=!EBOlE1fNAAZku-1yRLs7ACkAdvg8Wq0SPtZl5qRrHHoR_KoeYG4fNrR55-nJEHehuSschry7NuU3lQIAAARxUgAAAANoAQeZAuBvL2gZ8j9HSmIlFAxEuiS4ZrlKlnhaQ3BGHGNRX9Rrbzg_kZgiB0YF0Vh4koGqojFDV3ACoVcOaqPbH3GJz5gcX80bMEzOc0HleFUYmpfBDXhlfKMAvI2lgEI-B6AUJU8AMyIKlybGSYyuJmmcdDKwhmp7ZBLVx4KBSaafjbB3gQYMVFG-h-ZPQNL0eyLQ82LS1yu3SsKKzEFf45s4d7WdVS0BKL5GMYsoIrzf2GxJrpdUbzFy5ySLDSq5pAzv6pJ7VqX2VQOYqtSGYwLcGg6v5QsRryEfDDvUw4p-YN1IHDFtUYin4hft5L68W8wlAJetZwaPDHN2mp3aUoRqWWmnoEKnKN_Vov24lJUxO_ztMuUTuoM5uecwTsedbXkm_-FfMWkmDhQSl4pg_u_Vsc8Lu9pPHvJwwWitZRkzSRSm8EjM9IJD0a8UUqErJ_eWdXFSwqiOVqUw0yQIbmLveQT14JW40O_Yc9i2jO_6iAe9HJBO-5zdQj2VYGBpBdpNVeF2yeD0SCU0pgmQb8eNV39EgWVMmz75SMPn7H-tPy-OAhhNydLPxBjXp0V3mtmNPv1jLs9t5-cGzAxTnhRljof6UcEw5CrdDJWK63Sa4FDqWNox8lcYelvRAxCQvE5upgwySpu4xo_BRNSrD9s_7xG-lM5zYwdT5HkUeVXh65x_kn8ik9bXEazgUDYqF_Ju_aLRvpWzS2KbcBm0BSMRb7qI-up0zW_s2g0YBKUgiMNQ8ycWPu_VF2cg1gDplDYovfjIzXH6mvM1R74Tf3qLVt8VSgCv0GO8kiEb0wViKFgdR-ln9nQw4iaR3ntj0ExPl7vdhV6crM2z4kqDnX9yqlGSUpuMMCZSbP0tV8YJF269rsKaWaEVS5bI5Zf_9mkgyXAuZH6lwQau8y7n6uAo4Bp03mJ4bXZyFYzVLPVvlDRb-4T5rP7YJ7F4mV3GRoRsYCqYQvhSrKjV7E01fHjqi603
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 901A 		0
21 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220330&jk=403622214229593&bg=!wsGlwYXNAAZku-1yRLs7ACkAdvg8WpYFJbmm3ygVfeZDLYBpxtiTeYKyYTlYhbJy6Vc0RR1ocnviwAIAAAExUgAAAAJoAQeZAwpKcAG7WBeN3zW_oLXl4aEHtgVyiil0F_jo9iFOpbwl0jYAf80fxV5Bmcx2Z_IDJRxe3FPaVN3EbCVJqke_HmtgAWrWISRabHiF43ItGr_PlNBkz2pX5YXPoIt4ya_aCe1Z-YpOAyqwH_tz2KaDnV4Mj3aZDjqTCMxbbVQ_eMajv_8A1Tlu8LT3-gO_C7NiPezG7NR1RmQ0xz209L0dP0KWNdGk1XYWgd9kNNcMRL88U8xpwe6hxtsf7UNZra6GV5UBRb4Oq53ausGSsLhPbzX_HV9TNNXokHn4ztTq62yVyOHE-uRaC63g6qHD8W9XArOehdvZbZVXPALecPX9c0ZAf0y3fasgz5Wd-x4hzx761Z4LXihUGEMLjgxv7jaRti4SESWLkjqvh2dgtojmVMIc3CV9WkDJU_nQay4rCROc-ucVYnVZLB5_20YlYZUvPfAhP0KR9yXvbq1h8WzJB1iRYSp4_1bqlqbdcwRv-sbqyZmS3u97FpiPU0cOKDCfMH-D5zDN8XzK9gCAoBuWQZLP0COnsTejgWVjPI_vApcXQB9mgxtWGOZTeV9PyIAQNKyrLeQYfrno7trS5riZltd1aJNlB9QEdmaawpd3z-edidClbXql7Ho1_-YIlznW6QvC6HiLZZuWEvzsR7ouitujmoQVLglG5EuJijtdhKXMoABRQU-IvHTecqJvC-EvW3j-6Scy_z8EwZukBqnMLZhcu4jY65voa4lKsAQ-1O1qJhNTzis64QrhaS73ojtzETdi8xTXdYbJaP1rwd7z4WpKFT3Y_Dz3KEuTgtFPVvRWWS91ij3xVIMR4MATEB_oyAYZNFM9qaAkO061xaezA1Cxx2PFv0Insoq7AdWxMh0zTfAZd2HIgeCTfabt_Yesr1LVCDMli6IiALRJYWd8B_bNcabP4zZYnWYbwkn2gVFTpHwtuARYUEsJD2vcZVEp0F9tgp4iDd9Yapr_H6MKS0U1XgWWLg_BkkltUujxO4tYqlksB7tIz_nq9OWnMQX6qtLjBqvMgfDxIgX8
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:06 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
track.adform.net/serving/unload/ Frame 7DAE 		35 B
478 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/serving/unload/?version=15&unload=3184545604644256536@@53795659,6314980109256368187,100|1198|0|0|0|0|0|0|0||54|1|||||1|0|0|DcYCJtv-UzvxBx_RTJEBJ9xRMUZpwSrj_67eh8AEPGBs9G635mFB9fL_QlhaeLlf0|||11||0
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.252 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
s1.adform.net
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://hal900018.redintelligence.net/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:07 GMT
server
nginx
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://hal900018.redintelligence.net
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
bid
c.amazon-adsystem.com/e/dtb/ 		23 B
490 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&pid=zKK1G2va24ZXV&cb=2&ws=1600x1200&v=7.74.0&t=2000&slots=%5B%7B%22id%22%3A%22Amazon_400x225%22%2C%22mt%22%3A%22v%22%7D%5D&cfgv=1&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.62.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-62-173.fra56.r.cloudfront.net
Software
Server /
Resource Hash
5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://threatpost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:07 GMT
via
1.1 cae542650fb32c773cc494fc6e7e71e6.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA56-C1
x-amz-rid
ZTEB8YTG31BK8M7J58VA
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
permissions-policy
interest-cohort=()
strict-transport-security
max-age=47474747; includeSubDomains; preload
timing-allow-origin
*
content-length
23
x-amz-cf-id
ovVWOtM_MkUrsSqig7mYaEUsHSbnt1M2KVT878haMgwv-2QuszHicA==
cta2.png
s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/ Frame 9CE8 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/cta2.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
ca93825d2c94f8ef221b9c824b22ad237a02c54b6b25a660f13ef6da2a2e7eb6
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:56 GMT
server
nginx
etag
"622b19dc-1952"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
6482
cta.png
s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/ Frame 9CE8 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/cta.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
05d83b0e1da8df92cb24f1cf301bfe384c886c55775a158b7b16e506abfd9b4f
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:56 GMT
server
nginx
etag
"622b19dc-2091"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
8337
text.png
s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/ Frame 9CE8 		25 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/text.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
53b4887f44380bad7568eb3cd66c6365eaff23db6026bf0e426bad770ec3ee8e
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:56 GMT
server
nginx
etag
"622b19dc-658f"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
25999
spare.png
s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/ Frame 9CE8 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/spare.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
f6c4dcc844252d68dac675f4651cadf797563d556f0f8b2a3b0ba81eb20ca20b
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:57 GMT
server
nginx
etag
"622b19dd-188f"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
6287
price.png
s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/ Frame 9CE8 		20 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/price.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
67ca47bbd880810c8103fde1d322566ddf4de4c4f1d2eef573b752d116d96d5a
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:57 GMT
server
nginx
etag
"622b19dd-51a7"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
20903
logo2.png
s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/ Frame 9CE8 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/logo2.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
d82555e7414868823132fb86639bf07170946a6c302d35c1d4508d3b35035700
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:56 GMT
server
nginx
etag
"622b19dc-2717"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
10007
pic.jpg
s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/ Frame 9CE8 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/pic.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
f0181d31f83ef3f458c58bc7d262061e41fb053fa048ad03dcdb4493867ebfac
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:56 GMT
server
nginx
etag
"622b19dc-2493"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/jpeg
content-length
9363
logo1.png
s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/ Frame 9CE8 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/logo1.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8a3c71570b993bb40d5bab3449fe55df0db32b75b127da183e903ad630306417
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:56 GMT
server
nginx
etag
"622b19dc-1e3d"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
7741
bg.jpg
s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/ Frame 9CE8 		29 KB
29 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998795/bvpath_258/bg.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
f5f292b79f9d0957047a45ceb9fcbccedaa56f8c84073def1300767d2a9885ae
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900018.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:56 GMT
server
nginx
etag
"622b19dc-7486"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/jpeg
content-length
29830
cta2.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame DDDA 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/cta2.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
159ebfcc5f37ffb30a47afb3153e5f212fffd3e97cf7f528aecd64f2b98ec4c6
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:54 GMT
server
nginx
etag
"622b19da-69b"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
1691
yellowtext.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame DDDA 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/yellowtext.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
864d8c914fa0df77f17e2652e997ce07f71b8f66f0b75a216681c4b004bce11c
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:54 GMT
server
nginx
etag
"622b19da-e50"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
3664
cta.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame DDDA 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/cta.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
7ec6524760febc1d37d614622d1b2c71ad5f2540fcbdc1d210a621c57d023a6c
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:55 GMT
server
nginx
etag
"622b19db-8b5"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
2229
t.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame DDDA 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/t.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
df3ee6542919d7fa834f7a7c879fa5d099b3cbc12cee89b6d05016f76d2c6b97
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:54 GMT
server
nginx
etag
"622b19da-ea5"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
3749
badges.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame DDDA 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/badges.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
32fd7d3af8cc39cd251f3b88469a44f5e778307f532e8810376ea503add096dc
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:55 GMT
server
nginx
etag
"622b19db-1499"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
5273
text.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame DDDA 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/text.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
7502e034f95191b9c0cb8b3e31e342e54ac473e702dd98d0cf3323cb69d3a7f1
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:54 GMT
server
nginx
etag
"622b19da-171b"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
5915
logo2.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame DDDA 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/logo2.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
bb677d7657006fb57417c73ef3da95da5ba9449790f75fb82a2f11afb18cdefb
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:55 GMT
server
nginx
etag
"622b19db-b72"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
2930
pic.jpg
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame DDDA 		40 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/pic.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
2bb210405ba3e443ccf64c5b1d5bfdc42c6bd9a25337f854b8db45d4092de9bf
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:55 GMT
server
nginx
etag
"622b19db-a1fd"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/jpeg
content-length
41469
logo1.png
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame DDDA 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/logo1.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
35861a24167aa45139a124bb7979a78897393977570c8aa01b26f568b85a4eb6
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:54 GMT
server
nginx
etag
"622b19da-113d"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/png
content-length
4413
bg.jpg
s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/ Frame DDDA 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s1.adform.net/Banners/Elements/Files/160090/10998790/bvpath_258/bg.jpg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.235 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
2187408e0d1abf69f6c14789070e6e07abec61c41da1bcec63c33d0531fcb725
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://hal900029.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date
Mon, 04 Apr 2022 13:01:08 GMT
last-modified
Fri, 11 Mar 2022 09:43:54 GMT
server
nginx
etag
"622b19da-1c99"
x-cache-status
HIT
strict-transport-security
max-age=0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
content-type
image/jpeg
content-length
7321
g
capi-tier-1-us-east-2.connatix.com/rtb/ Frame 89D9 		128 B
415 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-1-us-east-2.connatix.com/rtb/g?v=157363
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.223.60.0 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-223-60-0.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
c6c483679c45eb8eb879b3d17690dd23b9cf18de296dff1eab5af96c912f49c9

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Mon, 04 Apr 2022 13:01:07 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
119
translator
hbopenbid.pubmatic.com/ Frame D695 		0
59 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 04 Apr 2022 13:01:07 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
mvo
tag.1rx.io/rmp/216475/0/ Frame D695 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/216475/0/mvo?z=1r&hbv=6.7,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.43 Utrecht, Netherlands, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Mon, 04 Apr 2022 13:01:08 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
cygnus
htlb.casalemedia.com/ Frame D695 		37 B
332 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/cygnus?s=435870&v=8.1&ac=j&sd=1&nf=1&t=900&r=%7B%22id%22%3A%2241abbd9f42adc25%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A0%2C%22iu%22%3A1%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A1%2C%22ren%22%3Afalse%2C%22version%22%3A%226.7.0%22%2C%22userIds%22%3A%5B%22criteoId%22%2C%22pubcid%22%5D%2C%22dms%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22424b0fb1a6da6b5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%2C%22fl%22%3A%22x%22%7D%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%5D%2C%22playerSize%22%3A%5B%5B400%2C225%5D%5D%2C%22linearity%22%3A1%2C%22api%22%3A%5B1%2C2%5D%2C%22skip%22%3A1%2C%22skipmin%22%3A31%2C%22skipafter%22%3A5%2C%22placement%22%3A1%2C%22w%22%3A400%2C%22h%22%3A225%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221005%22%2C%22rid%22%3A%22618ead1e-6d0d-4481-ac4d-e915bf24f879%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%229f1282e0-01d3-4e17-aace-32d1f0478889%22%7D%5D%7D%5D%2C%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%7D
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.85.251.43 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-85-251-43.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
ec0a091e1aeadaee724fab8a21135a7b5045ab9070d6bf34c664cc1df0e62bef

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:08 GMT
x-ak-initial-geo
CC:[DE], RC:[HE], CN:[EU], CIP:[185.213.155.169], XFF:[]
server
Apache
content-type
application/json
access-control-allow-origin
https://threatpost.com
x-cs-client-geo
12
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
37
x-ak-client-geo
12
expires
Mon, 04 Apr 2022 13:01:08 GMT
mvo
tag.1rx.io/rmp/216476/0/ Frame D695 		0
170 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag.1rx.io/rmp/216476/0/mvo?z=1r&hbv=6.7,2.1
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.19.147.43 Utrecht, Netherlands, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
pragma
no-cache
date
Mon, 04 Apr 2022 13:01:08 GMT
cache-control
private, max-age=0, no-cache, no-store
access-control-allow-credentials
true
server
Tengine
translator
hbopenbid.pubmatic.com/ Frame D695 		0
59 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid6.7.0-1.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://threatpost.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://threatpost.com
date
Mon, 04 Apr 2022 13:01:08 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
/
track.adform.net/serving/unload/ Frame 7DAE 		35 B
469 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/serving/unload/?version=15&unload=3184545604644256536@@53795659,6314980109256368187,100|4599|0|0|0|0|0|0|0||209|1|||||1|0|0|DcYCJtv-UzvxBx_RTJEBJ9xRMUZpwSrj_67eh8AEPGBs9G635mFB9fL_QlhaeLlf0|||01||0
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.252 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
s1.adform.net
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://hal900018.redintelligence.net/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:10 GMT
server
nginx
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://hal900018.redintelligence.net
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
/
track.adform.net/serving/unload/ Frame 8E36 		35 B
478 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://track.adform.net/serving/unload/?version=15&unload=3184545604644256536@@53795677,3118306217373243580,0|0|0|0|0|0|0|0|0||0|1|||||1|0|0|3-vmwgS3qejxBx_RTJEBJ9xRMUZpwSrj_67eh8AEPGDaGK8ND3MwKvL_QlhaeLlf0|||11||0
Requested by
Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.252 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
s1.adform.net
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://hal900029.redintelligence.net/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Mon, 04 Apr 2022 13:01:10 GMT
server
nginx
access-control-max-age
86400
access-control-allow-methods
GET, POST
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://hal900029.redintelligence.net
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
access-control-allow-headers
Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires
-1
abt
capi-tier-1-us-east-2.connatix.com/tr/ Frame 89D9 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-1-us-east-2.connatix.com/tr/abt?v=157363
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.223.60.0 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-223-60-0.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Mon, 04 Apr 2022 13:01:10 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20
st
capi-tier-1-us-east-2.connatix.com/tr/ Frame 89D9 		0
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://capi-tier-1-us-east-2.connatix.com/tr/st?v=157363
Requested by
Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.223.60.0 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-223-60-0.us-east-2.compute.amazonaws.com
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
Content-Type
multipart/form-data

Response headers

date
Mon, 04 Apr 2022 13:01:10 GMT
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
application/x-protobuf
access-control-allow-origin
https://threatpost.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
20

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
hbopenbid.pubmatic.com
URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Domain
securepubads.g.doubleclick.net
URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstCTIKuaOieJg6bfczpYQQqeLEw9jXFLFrpgxyxMuVKE3Qoq7cLffjfOKevfV9tNCuhDHyEczR-84rcBBGfhlgJmq-TB6sEocSVuLYK0aSJx8Kpt1HznLzFiQqBDJCQGk7nGLk_X-d_rCqU_576_gtLRDWp4wMU9UxY3Xs84Uqde3YsXqBaqjQrjsrnEWWvYXuJNNuE1ZxtQvgZ9sZ420GfsiKMFTS8TL0O1uDJdmRxxRXI6sEM1EwqK42Sd-SCYn68ocK6qhU5Mgta_Q7RpdoR2pX0p0vIV9XvZfW2IjiDSYKuki7X_D-ii55YbAKzTWXIQDL0hWk&sai=AMfl-YTPWetG1pS24QAVK_Dra3mSomEMnc5nqWceAjJ2ff9pZEWLGF6cL6bcPrsZ-6zW952asRaVEChJStMqBot5hJZCawu_ml7i8sHvbAczMw&sig=Cg0ArKJSzF9VgpMdzlKyEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&adurl=
Domain
partner.googleadservices.com
URL
https://partner.googleadservices.com/gampad/cookie.js?domain=threatpost.com&callback=_gfp_s_&client=ca-pub-7500593236707325&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w
Domain
adservice.google.de
URL
https://adservice.google.de/adsid/integrator.js?domain=threatpost.com
Domain
adservice.google.com
URL
https://adservice.google.com/adsid/integrator.js?domain=threatpost.com
Domain
googleads.g.doubleclick.net
URL
https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-7500593236707325&output=html&h=90&slotname=5620800026&adk=2236077833&adf=776186312&pi=t.ma~as.5620800026&w=970&psa=0&format=970x90&url=https%3A%2F%2Fthreatpost.com%2Flog4jshell-swarm-vmware-servers-miners-backdoors%2F179142%2F%3Fes_id%3D967c5201a3&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649077259281&bpp=18&bdt=1587&idt=388&shv=r20220330&mjsv=m202203240101&ptt=9&saldr=aa&cookie=ID%3Da592ba86ca1482a7%3AT%3D1649077257%3AS%3DALNI_MZSeM-SE-POxZ0-x7kPJ_2Xi8fW7w&correlator=719329608236&frm=23&ife=4&pv=2&ga_vid=444449005.1649077256&ga_sid=1649077260&ga_hid=401462433&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=8&biw=1600&bih=1200&isw=970&ish=90&ifk=1655249595&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44761044&oid=2&pvsid=775667503959110&pem=251&tmod=193232701&uas=0&nvt=1&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C970%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&ifi=1&uci=1.wdjrp9w0hetu&fsb=1&dtd=639
Domain
pagead2.googlesyndication.com
URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220330&st=env
Domain
securepubads.g.doubleclick.net
URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuWameZApKYqANPHiVyFOlu036lGFs0RrTJ-OiOLucBRVswAxpNzp8V_NfCAu5DUVi3-UI28wzxycEeLwL4neStlzHY0pnskRTA6krV_ylayfGD_pAc1ARK6HzNmwGp-mrP4JieBkTcm37YUCS_uU-kcO77NdcZX_ZpiKIbnLPJfeNeE5p_ypjtkIK4zL_YbcC0HwzM67jiU8QLbL2xDH-ADg1LEqzbrYVYkTbcoYyRSsbRgAp8oxUZKmA9IqyEHllL8v288s_wdbmQSxKFmx1aLTjtrSrBNAClFVQvyRE8SUxbpFUq_9pPSFIDJzI5MftIumG6vQ4&sai=AMfl-YTzpu7tiTnlOyGxQVXXCigyIbLer-GacGdAt9NBX7i-gvb-PXCd8wGE8mwmdg4YZrb8YgcHo4z8x45bjbl6yG2nuKNMJp9SGePa0QMgYA&sig=Cg0ArKJSzIO5ugasQ75nEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&adurl=
Domain
securepubads.g.doubleclick.net
URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssbNeLSxMUqiUh5ktvYjE6MiAwYdfkPfRg-BZy8aQh-OYWaA5u5kGilZAl6TxiaCTksCFr6aPJDZBhYb66vbpzv6diXLB1C10knf1Km6yRo-8hOPoy4c26arXNnmN72tqBaTadDDb1efOHf-HGpuSBb3pE9j0s5RAwb3I2kWhLso1sp5fr7ncUUBQyqDaCKXNg_2shAQrfRICZOBO8CxxSrnk4KVck0k4bWeLcGLh1uX0zGhxXMoMeDtbcukelMjLv-ZnQkOAzGMihOFyMOtbHXBVge37S7Ph7nBSy-1Mv0d-PdETp_dDN41gJY7vRtlELdgHXnYg8&sai=AMfl-YSv8jcVbreuryXnxJtMAqQxx_9V9Jjb-NUdgVLoPzjEkKtgzsGjnCK8zzSi7ESd8bK2mz0bdl7Uhen7v8O6DGCM7KT0ntM5NXCELYth_Q&sig=Cg0ArKJSzFV46z0utBpxEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&adurl=
Domain
pagead2.googlesyndication.com
URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstvt1rXhqt6cR-lDRAwVbHzn0TS1y016REvh7dMqkOkU1FyrqymIab1bwP-VqAgOC-iv01ZPigS0A0qmrinyU10BvxWcPRtwHBzCvySVckPKFlE7r-p&sig=Cg0ArKJSzDW6Jnsy35h-EAE&id=lidartos&mcvt=343&p=8,315,98,1285&mtos=343,343,343,343,343&tos=343,0,0,0,0&v=20220330&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=4166723991&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=3&r=b&rst=1649077257694&rpt=2030&isd=0&lsd=0&ec=0&met=ie&wmsd=0
Domain
pagead2.googlesyndication.com
URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssGVguX8rVGXJju0-XPQfOmpR4kyw9DEnlxKBXMHXcfuxcyZAhzPqdqjrjWG1iOp-Hn4lJQi0U8tj9t63JxZMj6B-2Uawlho0RNQfXyJoFvC6OwtPFU&sig=Cg0ArKJSzDGAbzcvzvpCEAE&id=lidartos&mcvt=0&p=0,0,0,0&mtos=0,0,0,0,0&tos=0,0,0,0,0&v=20220330&bin=7&avms=nio&bs=1600,1200&mc=0&vu=1&app=0&itpl=19&adk=1414505084&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=3&r=b&rst=1649077257874&rpt=2203&ec=0&met=ie&wmsd=0
Domain
pagead2.googlesyndication.com
URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu8Y6vAjNq01JGSd-EW_h3YlaIEGprtQRyUrb_HBeI95Dd86Gd9q8EmZ2GC9LbVy1s2DzwJPFcy6YFvngovmNMmaiJj4cUDsaQUsLAObIegDYJjWtzX&sig=Cg0ArKJSzA3YMFu4AqHeEAE&id=lidartos&mcvt=0&p=0,0,0,0&mtos=0,0,0,0,0&tos=0,0,0,0,0&v=20220330&bin=7&avms=nio&bs=1600,1200&mc=0&vu=1&app=0&itpl=19&adk=1356251026&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=3&r=b&rst=1649077257929&rpt=2159&ec=0&met=ie&wmsd=0
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at
Domain
google2waycm.netmng.com
URL
https://google2waycm.netmng.com/cm/?google_gid=CAESEAXpHPQaL_iJYr0LmTwSUtE&google_cver=1&google_push=AYg5qPKaYVlnFdvuNAj2ps55u1-NH6fIbTPPJC6z0q50tj5rRYTLrdXeKTRwxg2no-lFSUlTjd-Mcp2mWYXeoihx6_NQ5fHN4ipH7A
Domain
um.wbtrk.net
URL
https://um.wbtrk.net/doubleclick/user/match?google_gid=CAESEFhdlv-NIQ70DSHXDyQjU84&google_cver=1&google_push=AYg5qPKhXdnMyMVbNP9RZzdZtW6AnujvmTtzH4tU4KcRO6mUpcx7koB46IQZ4i7y9m67JPLkz_rycjmnha14ZBBASiV4ZwmbnIZbQQ
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng
Domain
cm.g.doubleclick.net
URL
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V

Verdicts & Comments Add Verdict or Comment

416 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 object| 24 object| 25 function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails object| gform string| gAMP_urlhost string| gAMP_urlpath string| gAMP_urlquery string| gAMP_contentid string| gAMP_category string| gAMP_contenttags number| kPrebidTimeout number| kRefreshPollTime number| gRefreshCount number| gOXRefreshCount boolean| gRefreshDebug boolean| gPrebidDebug boolean| gTrackVisibility boolean| gLazyLoad boolean| gTrackPageVisibility number| k30SecondRefreshInterval number| k60SecondRefreshInterval number| k90SecondRefreshInterval number| k120SecondRefreshInterval number| k180SecondRefreshInterval number| k999SecondRefreshInterval number| kDoNotRefresh number| kDefaultRefreshInterval object| gSChainNodes undefined| gGDPR_forceLocale boolean| gGDPR_silentNoConsent boolean| gGDPR_forceNoConsent object| gGDPR_NonTCFVendors string| gGDPR_publisherCountryCode string| gGDPR_logoURL string| gGDPR_privacyPolicyURL string| kAmazonPublisherID object| ad728x90ATF object| ad300x250ATF object| ad300x250ATF2 object| ad728x90ATFTAB object| ad728x90STICKY object| ad300x250ATFTAB object| ad300x250ATF2TAB object| ad320x50ATF object| ad300x250ATFM object| ad300x250ATF2M object| ad2x2skin object| adGoogleAdXInterstitial number| gBrowserWidth object| desktopAdUnits object| tabletAdUnits object| mobileAdUnits object| gAllSlotData number| gAllSlotCount function| _0x2484c2 object| gRefreshSlots object| gRefreshIDs object| gRefreshTimes object| gRefreshIntervals object| gThisRefreshIDs object| gThisRefreshSlots boolean| gInitialLoad object| gIntersectionObserver object| gPBJSTimeoutTimer object| gAmazonSlots object| gAmazonBids boolean| gAmazonBidsBack boolean| gPrebidBidsBack object| googletag object| pbjs function| _0x47b6 boolean| gHasGDPRCMP object| gGDPRTCData function| amp_getBidsForAllChannels function| amp_dumpBids function| amp_dumpWins function| amp_dumpTable function| amp_getBestBids function| sendAdserverRequest function| _0x4815 function| checkIfAllBidsBack function| amazonBidsBack function| pbjsBidsBack function| bidsTimeout function| scheduleConsentUpdates function| sendBidRequests function| doSendBidRequests function| amp_refreshAllSlots function| amp_refreshSlots function| refreshAdSlots function| attachCloseBoxSVG function| configureAdSlot function| getCookie object| apstag function| cnx function| $ function| jQuery object| gdprDynamicStrings object| gdprStrings object| kss object| sNew object| s0 object| dataLayer boolean| jQueryMigrateHelperHasSentDowngrade object| cnx_usr_storage function| __uspapi function| __uspOpenUI object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| FontAwesomeConfig object| ___FONT_AWESOME___ function| __tcfapi object| __cmpAPI object| __GVL object| __cmpTCModel function| __cmpOpenUI function| pbjsChunk object| _pbjsGlobals object| ADAGIO string| nobidVersion object| nobid object| ggeac object| google_js_reporting_queue object| pPk53m2 function| pPk53m3 object| xop boolean| apstagLOADED object| kasperskyDynamicaReCaptchaData boolean| creativeVendorLibraryLoaded object| google_tag_manager function| postscribe object| google_tag_manager_external object| GYSwcO function| GYSwcp function| xblacklist object| MZ1D6o2 function| MZ1D6o3 function| xblocker object| recaptcha undefined| google_measure_js_timing object| google_reactive_ads_global_state object| player_instance_0e70f7ab72bc471fa4b2a638092e9fa9 object| cnxEnfStorage function| cnxsetTimeout function| cnxsetInterval object| cnxPlugins object| google_tag_data string| GoogleAnalyticsObject function| ga object| _qevents function| twq object| ID5 object| PublisherCommonId object| twttr function| quantserve function| __qc object| ezt object| _qoptions function| qtrack object| gaplugins object| gaGlobal object| gaData number| google_global_correlator function| cnxProxyTask object| sas object| apntag object| _ADAGIO object| googleToken object| googleIMState function| processGoogleToken number| google_unique_id object| closure_lm_855931 object| ONFOCUS object| jQuery112405485204243399517 object| kaspersky object| prmOm object| omPlatformsSettings function| trackKLReferrer function| trackTrialSubmit function| trackFraud function| getFilename function| trackFile function| trackTrial function| trackTrialKMS function| trackPU function| trackPU2 function| trackDoc function| trackBeta function| trackDBUpdate function| trackDRFile function| trackLink function| trackCountrySelector function| trackLRC function| trackIPP function| trackPage function| trackLRCFallback function| trackMaxymiser function| trackAuditories function| trackCroSegment function| trackCta function| trackDownload function| trackEvent function| trackExit function| trackForm function| trackGoToPayment function| trackChangePaymentMethod function| trackLena function| trackMarketLincGroup function| trackMarketLincVisitor function| trackPageView function| trackPageViewOnLoad function| trackPartnerLocatorSearchEvent function| trackProductView function| trackRegistration function| trackSaleButton function| trackSignin function| trackSignIn function| trackUpsellPage function| omSetContext function| omSetOmnitureParameters function| omChooseCookieDomain function| omGetAbsoluteUrl function| omGetBusinessType function| omGetGoogleAnalyticsClientId function| omGetHostName function| omGetOrigin function| omGetPageNameFromPath function| omGetQueryParam function| omReadCookie function| omRemoveAllUrlParameters function| omRemoveAllUrlParametersForDownloads function| omRemoveUrlParameter function| omRemoveCookie function| omSafeParseJson function| omSetCookie function| omSetInp function| removeHashFromString function| omPushEventToDataLayer function| omCreateEventParamsObj function| omPushTrackingObjectToDataLayer function| omPrepareProductsString function| omHandleClick function| omHandleMessage function| e object| sng object| s object| visitorConfigObj function| AppMeasurement function| s_gi function| s_pgicq object| adobe function| Visitor object| s_c_il number| s_c_in object| _uxa number| s_objectID number| s_giq object| runtime object| regeneratorRuntime function| setImmediate function| clearImmediate object| wp function| sprintf function| vsprintf object| gform_i18n object| gf_global object| gf_legacy_multi object| gf_legacy function| announceAJAXValidationErrors function| gformBindFormatPricingFields function| Currency function| gformCleanNumber function| gformGetDecimalSeparator function| gformIsNumber function| gformIsNumeric function| gformDeleteUploadedFile object| _gformPriceFields undefined| _anyProductSelected function| gformIsHidden function| gformCalculateTotalPrice function| gformUpdateTotalFieldPrice function| gformGetShippingPrice function| gformGetFieldId function| gformCalculateProductPrice function| gformGetProductQuantity function| gformIsProductSelected function| gformGetBasePrice function| gformFormatMoney function| gformFormatPricingField function| gformToNumber function| gformGetPriceDifference function| gformGetOptionLabel function| gformGetProductIds function| gformGetPrice function| gformRoundPrice function| gformRegisterPriceField function| gformInitPriceFields function| gformShowPasswordStrength function| gformPasswordStrength function| gformToggleShowPassword function| gformToggleCheckboxes function| gformToggleRadioOther function| gformAddListItem function| gformDeleteListItem function| gformAdjustClasses function| gformAdjustRowAttributes function| gformToggleIcons function| gformAddRepeaterItem function| gformDeleteRepeaterItem function| gformResetRepeaterAttributes function| gformToggleRepeaterButtons function| gformMatchCard function| gformFindCardType function| gformToggleCreditCard function| gformInitChosenFields function| gformInitCurrencyFormatFields function| GFMergeTag function| GFCalc undefined| __gf_keyup_timeout function| gformFormatNumber function| getMatchGroups function| gf_get_field_number_format function| gformValidateFileSize function| gformInitSpinner function| gformAddSpinner function| gformReInitTinymceInstance function| gf_raw_input_change function| gf_get_input_id_by_html_id function| gf_get_form_id_by_html_id function| gf_get_ids_by_html_id function| gf_input_change function| gformExtractFieldId function| gformExtractInputIndex function| rgars function| rgar function| HandleUnsavedChanges function| renderRecaptcha function| gformIsRecaptchaPending object| gfMultiFileUploader undefined| __gf_timeout_handle function| gf_apply_rules function| gf_check_field_rule function| gf_get_field_logic function| gf_apply_field_rule function| gf_get_field_action function| gf_is_match function| gf_is_match_checkable function| gf_is_checkable_empty function| gf_is_match_default function| gf_format_number function| gf_try_convert_float function| gf_matches_operation function| gf_get_value function| gf_do_field_action function| gf_do_next_button_action function| gf_do_action function| gf_reset_to_default function| gf_is_hidden_pricing_input object| Placeholders object| gf_form_conditional_logic string| gf_number_format function| do_callback function| gtag function| onYouTubeIframeAPIReady object| google_ad_modifications object| google_prev_clients boolean| DFPSFMessageEnabled object| ampInaboxIframes object| ampInaboxPendingMessages object| GoogleGcLKhOms string| main_loc object| in_domain object| locale_out undefined| url_path_start_latam undefined| locale_out_latam string| firstPart undefined| locale object| url_path_start undefined| domain_loc function| SetCookie string| newCookieValue string| _linkedin_data_partner_id object| s_i_kaspersky-single-suite function| lintrk boolean| _already_called_lintrk object| google_image_requests function| cnxAddEventListener

122 Cookies

Domain/Path Name / Value
.3lift.com/sync Name: sync
Value: CgoIoQEQj7mopf8vCgoIgQIQj7mopf8vCgoI4gEQj7mopf8vCgoI5gEQj7mopf8vCgoIhwIQj7mopf8vCgkICRCPuail_y8KCQg6EI-5qKX_LwoJCAsQj7mopf8vCgoIjAIQj7mopf8vCgkIXxCPuail_y8=
i.liadm.com/s Name: _li_ss
Value: MgkI_____wcQ_BE
threatpost.com/ Name: _pbjs_userid_consent_data
Value: 6683316680106290
.lijit.com/ Name: ljtrtb
Value: eJyrrgUAAXUA%2BQ%3D%3D
.lijit.com/ Name: ljt_reader
Value: ecc0e880e0d35add66c56dac
.adnxs.com/ Name: icu
Value: ChgIzLJhEAoYASABKAEwiNirkgY4AUABSAEQiNirkgYYAA..
.adnxs.com/ Name: uuid2
Value: 8615746979499682240
.threatpost.com/ Name: _gid
Value: GA1.2.528781315.1649077256
e.serverbid.com/ Name: azk
Value: ue1-sb1-a488ff72-6761-4746-a867-7bd37bcdf906
.threatpost.com/ Name: _gat_UA-35676203-21
Value: 1
.openx.net/ Name: i
Value: cc65f5d8-71cb-4128-a926-06dc4151e455|1649077256
.rubiconproject.com/ Name: khaos
Value: L1KQ0QWX-26-D7D2
.rubiconproject.com/ Name: audit
Value: 1|hLZGFuTafB2ynL0xc5kI2z5APvdogVCbaTd6KyMQnat7y9GyzaExIXcciOOnuUYnb05ecXDiI+jhlI2uKWkDtsxuhZpbWKLtINWY3Pa16NE=
.t.co/ Name: muc_ads
Value: e0f1eddd-a9e5-43f3-92ef-04c576c25f6d
.quantserve.com/ Name: mc
Value: 624aec09-93776-830b9-33c9f
.threatpost.com/ Name: __qca
Value: P0-499901047-1649077256863
.threatpost.com/ Name: _pubcid
Value: 9f1282e0-01d3-4e17-aace-32d1f0478889
prebid.a-mo.net/ Name: __amc
Value: 2_1649077256_1649077258
.threatpost.com/ Name: _cs_mk
Value: 0.346381815582425_1649077258135
.demdex.net/ Name: demdex
Value: 83717903610884437954011580615560476877
.twitter.com/ Name: personalization_id
Value: "v1_Hz7yOzrLrx5k0vCHEK6G1Q=="
.doubleclick.net/ Name: IDE
Value: AHWqTUmg4zBCe5lrSp6RSCOuIPZC6MihNFz5QJR8FE90_V7a9JfwYSjT_LuDhMFcmqg
.threatpost.com/ Name: AMCVS_983502BE532960BE0A490D4C%40AdobeOrg
Value: 1
threatpost.com/ Name: usprivacy
Value: 1---
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~YkrsDAAAAJKdVwQA
.dpm.demdex.net/ Name: dpm
Value: 83717903610884437954011580615560476877
.threatpost.com/ Name: AMCV_983502BE532960BE0A490D4C%40AdobeOrg
Value: 1585540135%7CMCIDTS%7C19087%7CMCMID%7C88238087729275811294175148010201061015%7CMCAAMLH-1649682059%7C6%7CMCAAMB-1649682059%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1649084459s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19094%7CvVersion%7C4.4.0
.threatpost.com/ Name: _gat_UA-63997723-2
Value: 1
threatpost.com/ Name: CookieConsent
Value: {stamp:1583483262=='|Cnecessary:true|Cpreferences:true|Cstatistics:true|Cmarketing:true|Cver:1|Cutc:514516848|Cregion:'not_gdpr'}
.threatpost.com/ Name: s_cc
Value: true
.mathtag.com/ Name: uuid
Value: 398a624a-ec0e-4b01-a32f-29671dd4853d
.linkedin.com/ Name: UserMatchHistory
Value: AQKggpbATF7NrgAAAX_0qhgeBI4uW-gB0JywhrRBDJgDhPsUrm9rMxCPSGq01ihlRruSF1cCOVgmnw
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQIakjkjZrrsbgAAAX_0qhgeqULcBW8cVnjlp5FA67RWEdcvLYm6IUlk0l-EcijmvWC4wnyX_wGDgwehxkryOQ
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&412efc0b-16cf-4479-853b-d3e15e064dbe"
.linkedin.com/ Name: lidc
Value: "b=VGST07:s=V:r=V:a=V:p=V:g=2315:u=1:x=1:i=1649077262:t=1649163662:v=2:sig=AQFAc38fVwIR_n16q8bVD2_j3q5EOwbE"
.threatpost.com/ Name: _ga_YP1JLG57CH
Value: GS1.1.1649077260.1.0.1649077260.0
.threatpost.com/ Name: _ga
Value: GA1.1.444449005.1649077256
.threatpost.com/ Name: _gcl_au
Value: 1.1.497573009.1649077262
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&2022040413010296c24e35-fb78-423d-8834-39931e669fdfAQF5PA8Pkb1Rni8PME_tQatQENEPT3rc"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NDkwNzcyNjI7MjswMjGN0xIQrMDUDUzbND3B3mlBM4Yoea19CKx/2ebFfMkPxQ==
.adform.net/ Name: C
Value: 1
.threatpost.com/ Name: cto_bundle
Value: XYyBEF9PRmxSUGtpeGxJZlFUZGQ1dDlyNEFSbWdiekFwandCVk9LWDRHR243aW9KYW1ob1U1ejJLTHlNMXZSTTY5VmJ6amVlQ2ZyZGFXJTJCM2JieE0yeEVxbmdZZmQwVDR3dUR6RGI5R3RqSGljJTJGSjh5M0hGQlRRJTJGeldYUHU4Qkl1RlFGMQ
.threatpost.com/ Name: cto_bidid
Value: Zd8lXV9yQ2klMkJWZjJLJTJCak5iTiUyQmZtdWpXS1BxN1hNY1ZNaXFCMHJtNUp2dXk3QnJFRU4xUndZOTR4bXZWWjlwTDhKUm5WWCUyQlhsN3NUQU9LJTJCczFyZjlvdEY4b0ElM0QlM0Q
.3lift.com/ Name: tluid
Value: 3301691811217202990737
.adform.net/ Name: uid
Value: 3184545604644256536
.redintelligence.net/ Name: 8lcfmzhxc8d6_uid
Value: d43de3a982190bf8
.openx.net/ Name: pd
Value: v2|1649077262.1|kiiygevNgun0.gqsLommOnsgi
.threatpost.com/ Name: __gads
Value: ID=a592ba86ca1482a7-229968116ecd00c6:T=1649077257:RT=1649077263:S=ALNI_MYwOzmoE6RR_13jxSAVoJ-gYwloiw
.bidswitch.net/ Name: tuuid
Value: 61911d27-645c-4628-a192-91958e64f135
.bidswitch.net/ Name: c
Value: 1649077263
.w55c.net/ Name: wfivefivec
Value: FuM1Z2B31NBmkn5
.bing.com/ Name: MUID
Value: 1AC0E7DEEDA069240769F6A2EC7268C4
.a-mo.net/ Name: amuid2
Value: 98208ee0-12fe-4234-b79d-199a00d6b88b
.yahoo.com/ Name: A3
Value: d=AQABBBDsSmICEM1gNZN3upwu122vcRw-y6kFEgEBAQE9TGJUYgAAAAAA_eMAAA&S=AQAAAtxCzEVF-DeAix9f0RJzgkE
.lijit.com/ Name: _ljtrtb_273657
Value: 273657
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAAADslzmtoZmJpYG5uZGZiYGYGADtYFpkQAAAA
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAAAOMSNjU0NjY2sjQ1MrAwNzEwMjA0sRDiM9TNNM5yCc8KNfC0CPIEAA4R8tglAAAA
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAAAOMSNjU0NjY2sjQ1MrAwNzEwMjA0sRDiM9TNNM5yCc8KNfC0CPKU4jU0M7E0MDc3MjMxMDMDAAKp_O40AAAA
.bidswitch.net/ Name: tuuid_lu
Value: 1649077264
.servenobid.com/ Name: pid_312
Value: 8615746979499682240
.w55c.net/ Name: matchopenx
Value: 5
.servenobid.com/ Name: pid_327
Value: 98208ee0-12fe-4234-b79d-199a00d6b88b
.servenobid.com/ Name: pid_310
Value: ecc0e880e0d35add66c56dac
.servenobid.com/ Name: pid_324
Value: 5133329520874020148
.bidr.io/ Name: bito
Value: AADG1E7EldgAADc4D3RVaQ
.bidr.io/ Name: bitoIsSecure
Value: ok
.servenobid.com/ Name: pid_337
Value: y-Nfn2Zb9E2uHDl8SDkvCzSG8ow.6IQzs9tu_AmIg-~A
.advertising.com/ Name: APID
Value: UP48fcb14d-b417-11ec-a461-02c4a1bc5354
.smartadserver.com/ Name: pid
Value: 2855230096168324382
.casalemedia.com/ Name: CMPS
Value: 3274
.casalemedia.com/ Name: CMID
Value: YkrsEIZYLJzLV1osrv.wvQAA
.gumgum.com/ Name: vst
Value: e_8ff9a716-3723-4370-a7dc-735986c075cb
.scoota.co/ Name: tuuid
Value: fb5ace67-5a3b-4989-bdd1-e25324821773
.scoota.co/ Name: c
Value: 1649077264
.scoota.co/ Name: tuuid_lu
Value: 1649077264
.go.sonobi.com/ Name: HAPLB5G
Value: s568|YkrsE
.casalemedia.com/ Name: CMPRO
Value: 1143
.analytics.yahoo.com/ Name: IDSYNC
Value: "196n~2451:17ot~2451"
.servenobid.com/ Name: pid_317
Value: 2855230096168324382
.servenobid.com/ Name: pid_309
Value: e_8ff9a716-3723-4370-a7dc-735986c075cb
.adsrvr.org/ Name: TDID
Value: ba772fae-fb7e-433d-b9e8-18ab9acb3f0c
.zemanta.com/ Name: zuid
Value: Jv2xJehK4WL00F5G5QTI
.emxdgt.com/ Name: euid
Value: 21431649077264722786f1
.w55c.net/ Name: matchcasale
Value: 5
.adsrvr.org/ Name: TDCPM
Value: CAEYBSABKAIyCwiEjLeIvZHLOhAFOAE.
.creative-serving.com/ Name: tuuid
Value: a9c2a05d-cd6a-466d-8fe6-3078b59f77fc
.creative-serving.com/ Name: c
Value: 1649077264
.creative-serving.com/ Name: tuuid_lu
Value: 1649077264
.creativecdn.com/ Name: u
Value: aRT0vZg4C1cQyGAlw60s
.creativecdn.com/ Name: ts
Value: 1649077264
.360yield.com/ Name: tuuid
Value: d8cdf6db-a4ab-4ccf-b7a5-19b64a63bbf6
.360yield.com/ Name: tuuid_lu
Value: 1649077264
.servenobid.com/ Name: pid_333
Value: YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB
.emxdgt.com/ Name: eapn_id
Value: 8615746979499682240
.pubmatic.com/ Name: KRTBCOOKIE_699
Value: 22727-AADG1E7EldgAADc4D3RVaQ
.pubmatic.com/ Name: PugT
Value: 1649077264
.pubmatic.com/ Name: PUBMDCID
Value: 3
.amazon-adsystem.com/ Name: ad-id
Value: AwobEjzbeUYgrAm6O6pdDYs
.amazon-adsystem.com/ Name: ad-privacy
Value: 0
.quantserve.com/ Name: d
Value: EBQBDwHpJYEPisMA
.simpli.fi/ Name: suid
Value: 7821CA79C478447EB502D2C0B6ECD5DB
.technoratimedia.com/ Name: tads_uid
Value: GDPR
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: 56d42919d4aee491
.liadm.com/ Name: lidid
Value: 04daad81-2d0e-4038-bceb-3e87f0910835
.outbrain.com/ Name: obuid
Value: 5a0d94fb-d58b-4e26-8edb-9a6213fd961a
sync.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-45af342e-9fe6-49dd-6feb-3c8fcb722e07.rvz6GkvhBbbVqAQ7fbIrYzWX2nEYcOrhpXiiIpqC4Zw
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3ARa80Lp_mSd1v6zyPy3IuB7nVm6k.3FqHYPYZHAKax%2FVSGkvZdhu2E0nKZley%2BDdeOEOkOkI
.ipredictive.com/ Name: cu
Value: 49647300-b417-11ec-aad8-9f94043e2d80|1649077265021
.smartadserver.com/ Name: csync
Value: 76:CAESEOZbWEus1qSphqHPpDd-vOY|92:obIgMiDSrxAT|134:OB_OK
.adform.net/ Name: TPC
Value: 1649077265151
.casalemedia.com/ Name: CMST
Value: YkrsEGJK7BEA
.casalemedia.com/ Name: CMRUM3
Value: f1624aec1005a0&5a624aec1005a0&2f624aec102760FuM1Z2B31NBmkn5&58624aec1005a0&c4624aec1005a0&e6624aec102760&2d624aec112760CAESEI8m9HK0cgvzxifD2svdZpw&27624aec100b40
.pubmatic.com/ Name: KADUSERCOOKIE
Value: 7C1C4B16-6AFB-4CCE-876C-1EDD58F45EF5
.tribalfusion.com/ Name: ANON_ID
Value: adnsIHuyTYFBErv6YbokfCydf9Nxuv1eZcpYT6CdEsHriY7UEZdOOdQnA1l4APwYUBFBvsW3VTYx7yTBBD380dY08C
.awin1.com/ Name: awpv11601
Value: 412871|1649077265|49ee6350-b417-11ec-a39e-223476ecdc8f
.awin1.com/ Name: awpv9162
Value: 414235|1649077265|49eeff90-b417-11ec-a39e-223476ecdc8f
.awin1.com/ Name: AWSESS
Value: 346070:2243164
.o2online.de/ Name: nscT485
Value: v01MTQyMTExMzExMTExMTExMTEwMTQyMTY3MDAwMDAwMDA2MTY0OTA3NzI2NnZsZWExZGUyMDIyMDQwNDE1MDEwNTY2NjgzMzI5MTQzWDExNzY3OVYxMjI2MTMyNzAyTVNvbmVpZFBKNEhCZkViYUp3NEM5SGpIYnRNdFBQeHVaVDlUa0dDcG9uZWlkX19hc3VpZGlwbXFic2dWdXVSdW9Ib19RQ3lSVnhGNUZiM1lYdWFfYXN1aWRfX3N1aXRlX05ldG1peF9SZWFjaDQzX1RvcFJvdGFNb250aDExNzY3OQ
.o2online.de/ Name: nscQ485
Value: V
.o2online.de/ Name: webShopPV
Value: ?partnerId=O2_AFF_POV_EXA_15008&mediacode=AFF_la_117679_-HTLP&utm_term=AFF_la_117679_-HTLP&utm_content=O2_AFF_POV_EXA_15008&spid=2022040415010566683329143X117679V1226132702MSoneidPJ4HBfEbaJw4C9HjHbtMtPPxuZT9TkGCponeid__asuidipmqbsgVuuRuoHo_QCyRVxF5Fb3YXua_asuid__suite_Netmix_Reach43_TopRotaMonth&wfid=117679&affiliateId=v01MTQyMTExMzExMTExMTExMTEwMTQyMTY3MDAwMDAwMDA2MTY0OTA3NzI2NnZsZWExZGUyMDIyMDQwNDE1MDEwNTY2NjgzMzI5MTQzWDExNzY3OVYxMjI2MTMyNzAyT

30 Console Messages

Source Level URL
Text
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://js-sec.indexww.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://js-sec.indexww.com').
javascript warning URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500italic-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-900-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100italic-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-900italic-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript warning URL: https://threatpost.com/log4jshell-swarm-vmware-servers-miners-backdoors/179142/?es_id=967c5201a3
Message:
The resource https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2 was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://js-sec.indexww.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
network error URL: https://id.rlcdn.com/709414.gif
Message:
Failed to load resource: the server responded with a status of 451 ()
network error URL: https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1649077264605
Message:
Failed to load resource: the server responded with a status of 502 ()
network error URL: https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1
Message:
Failed to load resource: the server responded with a status of 503 ()
network error URL: https://id.rlcdn.com/711890.gif?credir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D136%26partneruserid%3D&gdpr=0&gdpr_consent=
Message:
Failed to load resource: the server responded with a status of 400 ()
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://hal900018.redintelligence.net').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://hal900029.redintelligence.net').
security error URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 7)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://threatpost.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKL8lCXGotkq-y5mBHOFd7_nAxhrcXQpF3vkjbpBlStbAPMgByi-OfuRQ7-n97EUCeB-gPzItkF6Oo-beZboQQjOknJ9IWHng
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=2M3226SrTM-3pRm2SmO79g&google_push=AYg5qPK5Xx7lSggLA6FniYu_i5YueYjEFG7pKsKmEH1pd_NaX4zdXYnvHvw5VoqULQMYN_0wp6t197xhgVRHq5RanVRiyXqxfH4V
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS
network error URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YkrsEIZYLJzLV1osrv-wvQAABHcAAAAB&google_gid=CAESEETn3NTqkUyDoagNgAEuZAk&google_cver=1&google_push=AYg5qPKffspvL0IqjAhYjsZcnyr-HSzH5CFoJnJUCB7jDGpDrbKC6hhDgh0GzuCwQh9nTQBxcrdFApIBc4tToHxWXaamOCR2b-at
Message:
Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9582686.fls.doubleclick.net
a.tribalfusion.com
a1.awin1.com
aax-eu.amazon-adsystem.com
acdn.adnxs.com
ad.360yield.com
ad4m.at
ads.creative-serving.com
ads.pubmatic.com
ads.servenobid.com
ads.yahoo.com
adservice.google.com
adservice.google.de
analytics.twitter.com
ap.lijit.com
as.ad4m.at
assets.ad4m.at
assets.threatpost.com
b1sync.zemanta.com
beacon-fra2.rubiconproject.com
bh.contextweb.com
btlr.sharethrough.com
c.amazon-adsystem.com
c.bing.com
c1.adform.net
c2shb.pubgw.yahoo.com
c2shb.ssp.yahoo.com
capi-tier-1-us-east-2.connatix.com
capi.connatix.com
cd.connatix.com
cdn.contentspread.net
cdn.id5-sync.com
cds.connatix.com
ce.lijit.com
ce949157bec60f70576440ba0a6f021c.safeframe.googlesyndication.com
cm.everesttech.net
cm.g.doubleclick.net
cms.quantserve.com
creativecdn.com
cs-server-s2s.yellowblue.io
cs.emxdgt.com
dpm.demdex.net
dsum-sec.casalemedia.com
e.serverbid.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
g2.gumgum.com
geo.ipify.org
gift-connect-d.openx.net
go.sonobi.com
google2waycm.netmng.com
googleads.g.doubleclick.net
gu.dyntrk.com
gum.criteo.com
hal9000.redintelligence.net
hal900018.redintelligence.net
hal900029.redintelligence.net
hbopenbid.pubmatic.com
htlb.casalemedia.com
i.liadm.com
i6.liadm.com
ib.adnxs.com
id.rlcdn.com
id5-sync.com
image2.pubmatic.com
image6.pubmatic.com
imasdk.googleapis.com
img.connatix.com
ins.connatix.com
js-sec.indexww.com
kaspersky.d3.sc.omtrdc.net
kaspersky.demdex.net
kasperskycontenthub.com
match.adsrvr.org
match.deepintent.com
match.prod.bidr.io
media.kaspersky.com
media.threatpost.com
mp.4dex.io
mug.criteo.com
onetag-sys.com
p.rfihub.com
pagead2.googlesyndication.com
partner.googleadservices.com
partner.o2online.de
pixel-us-east.rubiconproject.com
pixel.33across.com
pixel.advertising.com
pixel.mathtag.com
pixel.quantserve.com
pixel.rubiconproject.com
pm.w55c.net
pr-bh.ybp.yahoo.com
prebid.a-mo.net
prod-rtb.ad4mat.net
public.servenobid.com
px.ads.linkedin.com
px4.ads.linkedin.com
qd.admetricspro.com
r.scoota.co
rtb-csync.smartadserver.com
rtb.gumgum.com
rtb.openx.net
rtb2-useast.torchad.com
rules.quantcount.com
s.amazon-adsystem.com
s.tribalfusion.com
s0.2mdn.net
s1.adform.net
script.4dex.io
secure-assets.rubiconproject.com
secure.adnxs.com
secure.cdn.fastclick.net
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
snap.licdn.com
ssbsync.smartadserver.com
ssum-sec.casalemedia.com
stags.bluekai.com
static-de.ad4mat.net
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.1rx.io
sync.go.sonobi.com
sync.ipredictive.com
sync.mathtag.com
sync.outbrain.com
sync.serverbid.com
sync.srv.stackadapt.com
sync.technoratimedia.com
t.co
tag.1rx.io
tagan.adlightning.com
tags.mathtag.com
teachingaids-d.openx.net
tg.socdm.com
threatpost.com
tlx.3lift.com
token.rubiconproject.com
tpc.googlesyndication.com
track.adform.net
u.openx.net
um.simpli.fi
um.wbtrk.net
ups.analytics.yahoo.com
us-u.openx.net
usersync.gumgum.com
vid.connatix.com
www.awin1.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.lead-alliance.net
www.linkedin.com
www.telefonica-partner.de
x.bidswitch.net
adservice.google.com
adservice.google.de
cm.g.doubleclick.net
google2waycm.netmng.com
googleads.g.doubleclick.net
hbopenbid.pubmatic.com
pagead2.googlesyndication.com
partner.googleadservices.com
securepubads.g.doubleclick.net
um.wbtrk.net
104.109.78.125
104.244.42.197
104.244.42.67
104.85.251.43
13.107.42.14
13.248.245.213
135.125.160.77
138.201.63.164
142.250.181.226
142.250.186.66
144.76.91.199
147.75.38.124
15.188.95.229
15.197.193.217
151.101.193.108
151.101.194.137
151.101.2.110
151.101.2.137
151.101.2.49
165.227.252.242
169.197.150.8
169.50.137.184
172.217.16.134
178.162.133.148
178.162.133.149
178.250.2.146
18.156.0.31
18.156.195.47
18.194.22.119
18.195.155.181
18.196.121.26
18.198.240.99
18.202.206.42
18.223.60.0
184.25.158.112
185.184.8.90
185.29.134.244
185.29.134.245
185.33.221.50
185.33.221.87
185.64.189.112
185.64.190.80
185.85.15.23
185.86.137.108
185.86.137.131
192.82.242.209
193.0.160.128
193.122.130.38
198.148.27.139
199.232.136.157
2.19.35.65
202.241.208.53
205.185.216.42
206.189.254.17
209.54.180.3
213.19.147.43
213.19.147.45
23.45.103.213
23.58.217.190
23.67.134.223
2600:1901:0:76b9::
2600:1f18:444a:4602:2c20:3113:5c28:1366
2600:9000:2057:6400:2:9275:3d40:93a1
2600:9000:206f:f000:6:44e3:f8c0:93a1
2600:9000:214f:e600:0:5c46:4f40:93a1
2602:803:c004:200::140
2602:803:c004:200::154
2604:9e00:1:129::2:a01
2606:4700:20::681a:8a9
2606:4700:20::681a:ad1
2606:4700:20::681a:bd1
2606:4700:20::ac43:444e
2606:4700:3031::6815:456d
2606:4700::6812:372
2606:4700::6812:d05
2620:116:800d:21:36a9:ecb:e518:b308
2620:1ec:21::14
2620:1ec:46::45
2620:1ec:c11::200
2a00:1288:80:807::1
2a00:1450:4001:801::2001
2a00:1450:4001:802::2002
2a00:1450:4001:802::2004
2a00:1450:4001:809::2003
2a00:1450:4001:80e::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:812::2002
2a00:1450:4001:827::2006
2a00:1450:4001:828::2001
2a00:1450:4001:82b::200a
2a00:1450:4001:82f::2008
2a00:1450:4001:830::200e
2a00:1450:4001:831::2002
2a00:1450:400c:c07::9b
2a02:2638::1c
2a02:26f0:3500:7::17d8:4dc8
2a05:d018:d29:3605:9f4c:83a8:7085:a009
3.122.214.5
3.122.58.191
34.241.76.6
34.242.106.163
35.173.160.135
35.186.253.211
35.244.159.8
35.244.174.68
37.157.6.235
37.157.6.252
46.105.202.126
51.89.9.254
52.203.60.58
52.21.142.155
52.28.166.250
52.28.203.152
52.49.221.146
52.95.126.160
54.154.15.255
54.154.244.32
54.225.98.71
54.246.18.24
54.36.109.183
54.75.174.52
54.75.68.230
54.83.246.18
64.140.160.2
64.202.112.127
64.202.112.63
65.9.62.173
65.9.66.117
67.202.105.21
69.173.144.139
69.173.144.165
69.173.151.100
72.247.225.32
72.247.225.98
72.251.249.13
72.251.249.9
78.46.85.162
84.200.5.215
85.114.131.235
88.99.219.174
014b24b9f921d57218038483c9fe91d034341795fdd1ed3e86af0a918c8d5dd8
014e379f32a2f097092976500f992084d4cd65488d471572f5e2aaae82ded6f7
02465f79cfb28eaa438ad7f3f17a14060ddac8bfc403ef72f36f8d1d9e1215f9
02a4f533291fddfe6e522debc6e84482e6dfe92e0e3ec82c1620df975db67a6c
038fc4d49a9191d416d49841f371b6e0b06bb40f719124099d40fe8f393b9e2c
03cc687f0c8a2d1694e509b91fcd6c62c0fbdbdbdb850b8007b8052f649c7f77
0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
05a1d2c97dab86882c75625d3f8481b3764a3ba31d7e670578b68db56322747d
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1
05d83b0e1da8df92cb24f1cf301bfe384c886c55775a158b7b16e506abfd9b4f
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
08072a60078355b35831d9de7e9628ef201de11378fedca448fff989a19d29a9
08392ff877c5d17c9e4794b9c47c1b671b9501fbfeb78c906438008ee78aa87d
084885652dacd1b70a7979e7631caa6fe5985a5c1b872c28dd890d9ea39cec3d
0849eef021b381cb3f64d424bdd29839513dbb4e964aef0420136906426a18de
08973f5319888f5bc472fa88bf6b84fddab2ee8292cb1160ab280b898743e45f
0ac2e8b703898e10c303ba046d2ab970637e88801cbc4cdda6585e61b6f9b01b
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5
0c6420a2a054c1be4bddb86d4a472bebf82bdd50a20bb8e596669bb04117a73a
0ce5fc08d0f617e71e1d61bcd79fc7cc1855f4221945b0c09ac774685fe7f52c
10792ba188ea5d2ecb0fffeec2aece8ea2fbd37204c4b5a6f3b528eca21320ec
118cabdfcdef519c01c13bdd1d6e922fe838d3b0b33dd26c989d90873e9da415
1346e9414628a4c6d106f570b2e78911684b9c3f87b2b3b2e9f9d38fd1838f6d
14f7418616b029172fe23347ff6c4003fd133e0013fb529cbf08ca2551cf4f08
159ebfcc5f37ffb30a47afb3153e5f212fffd3e97cf7f528aecd64f2b98ec4c6
1791bf831c158912a11ca40bcf5f3573fc54ec8f8343c37780dab679c0203d63
17aee1fe3d7d16e647b97f568230c2ff36c1855ce35ce930c26aec5d2c58eaf4
17c36e9523e8b97999649b89a0f8480d574d7a1fe1dd4f3d8fe841e5649cd0c5
1a125096dce20357e3049f8166f66af69a0e57f5f802696000ab095613703e8f
1a71b807ce4e56e46f3a58c5243928292277b85560060068c48a0bff35f8867d
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f
1aeb3ee07f4b462935c5d8047ff038c8e279d75f9be1dcd0b848ba68223a3ee2
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
1cd86a0f1c2f19383dca65854e869a95316faea14a0a976c6d84969c4185b2c4
1d5a65e5129df0b4c89e73f205c6cb89cba0cd1d8e21a1512ca76b769634052d
1e74ddf52d74a4db0641a3e669ef47c36189c0206c434ff6aa2880b44f648d50
1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4
1f3d8b57f69b73694c38ba6bbf8ddc46c8a5e52db401795fa8ab80643e14236d
1f795bca081568c2a3800db7469b24f498296c697a7e7e8b2a5914e39bd0e9d0
1fcd5be68b59b4fef4f4d950c369de931a13c82cd4cb3c194b834710d80cbd75
1fd859612ea46aa57354d7b20da20979c096d2467b6a3ca9a2ba17e431023e9c
204c14d8448e67b23b593160570cd689db2c7598062488aae8c9c148a3fb392d
212cec1e3b733de905030f0f7defc66725a566cf795a3cf52c8eceea620fe6d7
2187408e0d1abf69f6c14789070e6e07abec61c41da1bcec63c33d0531fcb725
22c90613db09ef65c964b143e6adbe584b42eae85c9b7a75fa27c22b25cccb90
233adb7eb31a24bdf8a03a6419d57432d6162ef0ccbd68cc67b65295e74ecaee
2700d79a7d4fc0066996f0a3002c37fab7cbef0a0bf63668303b52726fe4bc39
2916b1da41266e7cc16ed5d7597fedbafcdf79a06a6e9d8d6c94e8a8d8ad1ee9
29284f710388112ccdaed4a1e4a8a49ebaf44178a8e6cbad631ad174989bcec4
29314c3c04c124ca7bd0c11412671f9eb37385a9dae741f783fc9cc03af60d25
2a647d79b31b4b19f30c795aac862bcf5b424731c732e239775127b8ac4aae0a
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2bb210405ba3e443ccf64c5b1d5bfdc42c6bd9a25337f854b8db45d4092de9bf
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e5fbf796957265d266f18bca82506983d8eda6a4368f11711f43ef79cd5a350
2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e
30c3fec93060e1d17e88aaf8a361ac1fbb241cbe28b72a1b801b788250ac7eca
32fd7d3af8cc39cd251f3b88469a44f5e778307f532e8810376ea503add096dc
3373dca69883fd4d5298c955d822359a23e9c3658b63e06b483e251c10024f21
35861a24167aa45139a124bb7979a78897393977570c8aa01b26f568b85a4eb6
3705d0878203cc0b2525dcb0f874d85cc6b881d1fca1869191da4e599c768241
3788f6d78d3779c5cb9799b5a5194c8e4f56de10b3c7cc962dd4ff56a006c076
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
399ffea8046b8f3d49b79ad4a17ea689aac73c73abc3f6288988758fcc2e924d
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
3a08d2b1de76612fac62b55acb6ef3c43ee8596ac0033b156db08278c92602ed
3b9d39edb2591de65a095117689dd79effa44a7cf3e0a594d01c978b2f05d00e
3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26
3ceb2e84bb066f4a30a2419168d7b8ba1897760f0f0674bedcbe0594d9e43840
3d0bf782b47dcd079eedf6bb34ecb0742c114a4e4b90e37a58a412482101b475
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3d8e43748397c9055cd5d0ff5cd81e31865c9e3f7914457091976107f5def3e7
3ef5bfd224e0baa902eb88c94979cfaeccf2169a996c601fa3de4c3f3b33da01
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
41f047950d4db7e04d250ebe65613aaaf482546a855d9321d1536ecb8ab6cccf
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
429321a814615c2b46db8510a4e1253dbd006e413d63026f43de9ebb58749b17
43c3db268dcffacbd978d28973c2448bbc5550f030d3289891624a6df871c500
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
4643cdf224ae55f57457b86b0ec9f2a92d25aa1ae8b550f81091c70854c6cb9e
4658e1122a2190db712f6731d3e8c14b027f0a42bd7c1333b11d272f8e9ea3fd
4823c011e4b4cb4b7f35ced3ab09d57215ee243676d9bfcc24d10ec77d3db398
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4be06cf99cd685a0f4f2162ae9b76f416e95a8cc0a0da96f461559490f249e3b
4d52f37b83f70c5035632548c652508d793eec55e17f2ac19552f4fa19d323be
4d8f864aed2d746918261e411ee2422b2d82fb085eb228b7af075cd4f98ced2e
4d94a0f51bade076fa154e469f12563fcee377fd94d79ca6d080d231e0e8b1d1
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e0b5563ff1fc5175d65e11e1546bee1945486d65d76c9248bdd77487532dadf
500288356853c7199a27a6a2cdcd14b217d18dd9c8103272d8e6def6acbe2580
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70
519815bc4a3dd9a571cb56f57c7c6abfbda2b4e2de8c4b884a7535a1705438f2
53b4887f44380bad7568eb3cd66c6365eaff23db6026bf0e426bad770ec3ee8e
53f6440548312e912300ca5fafa1cba39283dca8ba7c84e4a6a8ace656b95adb
546be401414bcb20cdea07cdbcd806409b9629e4895737e214401948c40409f3
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
56e21c0b93290490c1b1bcd3c541dc358b4f5bb43b24d954dc075e82fe48dcaf
57f23d924134c1e69cb19609ee15c7b1fd54da5ec1b39cc7422ef08d025a51f0
58f40e70904ea6117401789b2c4daf93831eeafa1079afbcb04026f5883edfae
591993084654d5f4cc7653675191becd17764e7ec44340b8cb4e712f7231181c
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
5d5cf5a4a5b7c02915bc261dca0c755d29beda0c0c3a005c78c1682c9934bb3c
5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5
60b1781f67ce46f0cfc0f96fdfae97843bfde0f26c98bc98450914baaffd654a
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
62c667b703ed49159b52915cd57967e979d2d0a108794fe8722e7aa7357566f7
62cbf085d014439b719c84c3d2f3222fde66e299c2da1b41dfc4dbb315db0456
6493fe707262fb8d9bc0e4d487e319fc9ebe7de26ebe7e3b4f58a5d17f03a9ea
64a070c03bfaed7c72d80f87044e30f0f8add5f9412bc8641d72a5cb969aa97e
662c2a94ddbefd80383f947d986fdf188283cb827e3bd48e7caa477209616262
67ca47bbd880810c8103fde1d322566ddf4de4c4f1d2eef573b752d116d96d5a
68026f99511fbc5c2275b7068b5fac19797d638977ffb9db12c5c1523614c18f
68cc26362c0cc4baa161311ed8f92a440624b120f844cecef402a4c7f94bf39d
68cdaaeccd079ab33df06d3e5fb47594a4458a6491d48a8ae2f394defb419eb5
693c8b61667ac94847264924178702a190c5113b41b82085dad0641f89e3f864
69445fd8e1a8e96fc098b81f84d19b23cb88621fbc780e7dc24d0f6b3ae5bd80
69f0ade8cca67112ef495f707fb73c68fd5099a6cd9c51d9ba9ceda8dcca16f7
69fe3507454103e0f80720546a11348be584f70823b74e81d132d47438efc9d2
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b1bb389b13a881a2cefef04679293b420d442949428cb6fe32a876324fdf5d3
6c8e343da3b15a6a26e0367b83d1c97813863ea6e6a905bd9e69870bb0a0ebd0
6e6377776a1104aed9b11142115b22dcaad3cf78ae76d255e454b04b7189af32
6ee01e065dff517ba78e03c1692a6d7bacba2d47302ebe41687efab7afcf2666
7104f88840a420f1702717d900db98910deb6141ad639bb7338b88993e989c72
717ac88612cde92669ca85963eac24bc3832909dad47e2f79cb860a80ba393ec
730fa1f3e8b3c4a223c4e69f4a27e690a4552f96ab97dba05b943dff44967658
738ee0b280500a64e936646d56bd7b97cf345a52f37bf66370697a183b359099
739ab1cbd5fc795c806cfbc012e937834a1d566f02ed72ff02af2700c0629eb4
73e88dfcd0f3a535341fb641c5400fcf772ffe36c628241104f829d3cf48e29b
7502e034f95191b9c0cb8b3e31e342e54ac473e702dd98d0cf3323cb69d3a7f1
7a3278fb19fc43ee6153a721e59c7f83168924d5c705823fbfcf827f13dfdda4
7b06577922291f33b79bf89d32290e97e9c8264af48b3f94bdf27adf46e70a16
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7c3b96f238042f73d0bedf5877fa02eb834e89649bbd122e2f10cc35238173cf
7ddcdb425051dbc349b91079fe450031f1c28e182aa24974ddfa20a92b4facbd
7e4e518db6ef82fc5bd4a52ac46e3eed1ee128021cdd80869bca85eab17a265c
7e75ade51afcae47ec8dedc46bd50962ebb58b46638a69951f1f494c5052fe14
7ec6524760febc1d37d614622d1b2c71ad5f2540fcbdc1d210a621c57d023a6c
7fd9983a3429d6ead1f66bf933770f9b790818b189e39ff0f2a0d3f590bbf67b
7ff5a06daa51558452cabcb83bf4c7aafd0be8abc6ce98d027496776b1cacdaf
806690292ecf78098ce849f7322b2f087a113a7ac8021b01425bbacec108b8c8
81aad196eb5b0fd18d4ae314e89e260affe5bbe6d6e6b065514e380270b40a7b
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
85dbba0089503ee23422468ede0994ba879e96a25ce4bfaf2406f1654bbb2410
864d8c914fa0df77f17e2652e997ce07f71b8f66f0b75a216681c4b004bce11c
88825aa6711a2083445d3b77ec2178aaaa6ed3622bf938e045dd9ea492deb91f
89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a3c71570b993bb40d5bab3449fe55df0db32b75b127da183e903ad630306417
8d6580af877387b05d9ffac3ebeacfe25a7728c77adef6d9b32fd72ccbe21468
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8da979458600536726a4bfca5e105c96a405e0740c16e55a7d6cc59108706417
8ebcfe6d879fbfc22c88777434fcf1cd8c50899e18041fd23d7a9572a5a3956d
8edaef698e025c37ba9e8d632a895d7252c62251df3f095d5cff17b6f3304854
8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5
8fb4a4f4521a94032afdb851a8612f898a1e8a40705d06df03ddfa932d3ca274
90091319f77fae62b671a59a04c05c87d4d6d56f0f2c01c2b40be7d226de545a
90d444d71168eb54a5d30205b0878d181e9041d13a4ccac78c9ab1cdfcf596e4
927e16d837ac9f46ddb4a64c8fea1cbe39343902c91b14e11b484e9b01f98cdd
931dc539e87db7f509be9c77dfcc9b2baee0b91e5236aa04580ab14ed81e2cc0
9348552099a43c0139caafab45ef6413d7cefac6722387854ad3f360660fd2af
9476350068dbd8b61373906f6d9dba49ed31ed5d64d6ee2d48da082c44a447dc
97f5070aadd9475bb56a49a7bc1114e9fe1b992b55f2b227502f35f8bba71d74
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9ba52dcd38164c8f4e406ddfafc28471ef5c92e052c95451b8bbee6c4b6d01f9
9c3b4ae64ba79687d183404ed80c00f909330c0e1bd8a260b5886c107a27ffec
9e89048f0456e3b02cedb7cf76410b3576a32bad0f1cc024640f01e1339b3a71
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a1a67351bfc55c2db35bf6e28e27108e56fa0cce416c663343696b21e9856798
a1e501c32fd16834ccafb815b04ef0133d5e2eef235996b29ef40b1345329476
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a3e64300797e8078baa41dbc49e2affc1d2bedd04a470f0c929ed7fac698fbcd
a4350fed8ed92bbf4f462fc245028928ac33afa25d2231b28c334b91cd0d3952
a458687751e48d0f34909564714e7c6dd152c0bef1e10c7c78d3f0d8a2ba1b91
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a856921ec103f775728e2327336f39eb61c04f4605e537fc8e81710eb5a1c934
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
abaa484421865309a7781e540844f1b5260ed131080f8dd9f083d8f18beea107
abfb1f15c2cb3df79d00d5c685c6840b8f5c91ecebb41650eacb4611aeff6071
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
ae2d5c94fe1def9e51e6497f11b21b9a00d549a9e398dc63b1f62245c189bce1
b0c35bcc511183abbaf158b20f6f4a85a54cf4353b4df88163dc9425d97e4ca6
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1a37dafa1028347188cc748fb71c7d8d7357988b2004b12ec92c5dda3dc2235
b1f863d13dbad7d5240f577a73b47b06227d218909259042da95301e2eb8be55
b7781f6fa62c80c336671d895754a77ce8d0f5e9fe30e0b1f40d08c66261408b
b8bb46fa9e3b8dd06c8f74c1b0e4af0c9975bee50f3032987946822a5aaace86
b8e352006cc3bc3c7c2206316ef5ecc3a319959d6b6a3b4da9702afd1dff10de
b9c6bb98a7e0817caa24fd161dc04b9300fe124056cd912d9246785ca944917c
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb677d7657006fb57417c73ef3da95da5ba9449790f75fb82a2f11afb18cdefb
bbe4e4e4e847a32bd717d963f0ac04b619a7a9cdd631a7454d9dfec16fbae73f
bcdf010ba3dc61605c33de9b33e7e76dbc3bb4326dcec49f33970345e517fb25
bdfd60b477fc3a53026309cc91965dae061323c4a99562dabdd08831147528b2
bea63616949c80ff0dfdbb1e8547f1585882fc691483317b06441688e3e5f14a
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c4636e5d625edef8957656051a5f7bd9f25d8a1c0d4071c864e808f84e3073b6
c6c483679c45eb8eb879b3d17690dd23b9cf18de296dff1eab5af96c912f49c9
c8c03fd4dea0f2c83fa05b10dfd913bfcff51d05e0c6e84b7f340b857fdda517
c9f2e34a5b621232e6b0d9bc180a2b07f3425aafd8fa8a0c3e3971b04bae7b32
ca0c444aae496568a573398c2e7d3bf6057f44eec50331b16664967fefa0e9ad
ca93825d2c94f8ef221b9c824b22ad237a02c54b6b25a660f13ef6da2a2e7eb6
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cd3767c9daaaaf6b31ba6dd8821d1cf09594ffdddb05a60b81d960aa4e2f44e9
cee550c754b603a8dd705a8de703ac2eb8e1c2c6fd5a9b4acfef424364824a1d
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
d12a71cd626ac8f0fc91e6f1b98280cfb49fd724f2dcc118d192adff9a0154b4
d278491b1de51ad826d16be5ab27b1746999c02d45200f107218427e34eed798
d593fdf64289375adaa96b87ebf4c4beec2995d730e3601254e0a226808bfe57
d613258b7f3d911a83031987bc5fc9f017bbdf9c789f7a6973103eb4ccae68f8
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d63a979624d0168362ee85d71af7eece046e02ce0b42dd71cf8ad8809e237175
d7650213aed884d4eb7b8300b890ef7f6a0b18fd3448413497c8ab30b9799d3d
d82555e7414868823132fb86639bf07170946a6c302d35c1d4508d3b35035700
d8bd1954d35c36441c577e571af12e327da0115465a35f85bca7f6976ad49dda
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df3ee6542919d7fa834f7a7c879fa5d099b3cbc12cee89b6d05016f76d2c6b97
dff2681d8f5f16b61b464b599d7c62f61efe496b54a77044145495bc8cad36d0
e0f1df7af81fd8eb920863093c426fdafd241b8d9aeb6126fb2fd24f36c061b3
e127aead57cd6625f795f8c41d8b7c463c2c50158e3a3dc398424db2b16bd5db
e20ddb9ed1fa044cb624f0253bb06b13c92ed9915063bd63a5806440c6b1ce7c
e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528
e2835af998d5ef885bfa14a1b1995c7724d5b6a76f545b4a491763bff6f0dac5
e2c4332b6cd0fea250e89907921adaf7e597b52808cf19c995d6173ae0263f21
e388df0a2d325b5c1562bcabfa19bccb30646f0f98d09205d10e0c818cc9454f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e5935466216a250bb06338805b32ffb19eeda9042ead790ebc6e5dda27820adb
e724a3d2ddcbceff241a7a4ce807b115b69e36d56612ae5d954c236cff34daec
e736de183dc3e5ea94905f3925ad71b012c65a101f6fe31ef8b8fe9a6cb50898
e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389
e98eb1460234fd6b5825c8abddbcdfa37f9cdfd1c757c433aa0756dda317f4e5
e998d70d54146b70fbd8882efdd0682978dbc337f03a6e22367cb97aadf9e573
ea39dba2b498dfe4e18255e241acf246f9229c8deb54e5b2530cadb51a25bd58
ec0a091e1aeadaee724fab8a21135a7b5045ab9070d6bf34c664cc1df0e62bef
ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152
ecc2e585ea072abb205881f3aad6f36e92d556537e7100a8a128ddbc75edb436
ed9e77a7cc7d2301d9e4b5466db374c5da9adcfafdcdf9a9b125372aa96659cc
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0181d31f83ef3f458c58bc7d262061e41fb053fa048ad03dcdb4493867ebfac
f36d6f39c5e18053e0fd5e117a1c899a87a4bf1cd8b8c440bddf52b7eba62893
f3d66b78ca0c93adf48dec8533da3c4db538cc648dc60e383d5fd0b666859206
f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea
f5eea1c9406e22225635f46d7ddde71a450b2337a7cd0b25ff834aef95734258
f5f292b79f9d0957047a45ceb9fcbccedaa56f8c84073def1300767d2a9885ae
f6c4dcc844252d68dac675f4651cadf797563d556f0f8b2a3b0ba81eb20ca20b
f7cdf71044448cb736733f5163fff96081d51ba4101567d61d22ee5998a7a399
f7e06ae449bdd4ebece6e26cdb36840f7cb19f28b57bbb6b8647a54535557d3f
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189
f93b24cf2e261837a56a959179d201f8ffd8100c9efae679b20e90d1adb00541
fa45be5f94ed67d5adbacd25e63380ec4f624801cf3be0f3755d024eeaeedfc7